rapid7/metasploit-framework — pull request #906 by jgor (2012-10-14 18:19:41+00:00)
Title: added Lantronix telnet password recovery module

Description: This module retrieves the setup record from Lantronix serial-to-ethernet devices via the config port (30718/udp, enabled by default) and extracts the telnet password.

Lantronix device configuration is performed via telnet to port 9999, optionally protected by a 4-character password. Existing MSF module auxiliary/scanner/telnet/lantronix_telnet_version gets the version banner of this telnet service. This new module adds the ability to retrieve the credentials for the telnet service.

The code was modeled after modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb. It has been tested against a Lantronix CoBox-E2 device running the latest firmware (v5.8.0.1), reset to factory defaults and configured with a telnet password. It is based on PoC code of mine that I have successfully run against at least two additional Lantronix models, and theoretically will work on any device that uses the standard Lantronix discovery/config port (30718/udp) and supports accessing setup records through this port.

I can make a test device reachable if necessary. Let me know if more info is needed.