Script `http-vuln-wnr1000-creds`

Script types: portrule
Categories: exploit, vuln, intrusive
Download: https://svn.nmap.org/nmap/scripts/http-vuln-wnr1000-creds.nse

Script Summary

A vulnerability has been discovered in WNR 1000 series that allows an attacker to retrieve administrator credentials with the router interface. Tested On Firmware Version(s): V1.0.2.60_60.0.86 (Latest) and V1.0.2.54_60.0.82NA

Vulnerability discovered by c1ph04.

Script Arguments

http-vuln-wnr1000-creds.uri: URI path where the passwordrecovered.cgi script can be found. Default: /
creds.[service], creds.global: See the documentation for the creds library.
vulns.short, vulns.showall: See the documentation for the vulns library.
slaxml.debug: See the documentation for the slaxml library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.

Example Usage

nmap -sV --script http-vuln-wnr1000-creds <target> -p80

Script Output

PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack
| http-vuln-wnr1000-creds:
|   VULNERABLE:
|   Netgear WNR1000v3 Credential Harvesting Exploit
|     State: VULNERABLE (Exploitable)
|     IDs:  None, 0-day
|     Description:
|       A vulnerability has been discovered in WNR 1000 series that allows an attacker
|       to retrieve administrator credentials with the router interface.
|       Tested On Firmware Version(s): V1.0.2.60_60.0.86 (Latest) and V1.0.2.54_60.0.82NA
|     Disclosure date: 26-01-2014
|     References:
|_      http://packetstormsecurity.com/files/download/124759/netgearpasswd-disclose.zip

Requires

Authors:

Paul AMAR <aos.paul@gmail.com>
Rob Nicholls