rapid7/metasploit-framework — pull request #1669 by m-1-k-3 (2013-03-26 20:01:57+00:00)
Title: http login module for DLink DIR300revB, DIR600revB, DIR815

tested on DIR300 rev B, DIR 600 rev B and DIR 815:

DIR 600

Exploiting Demo - 192.168.178.105 / 0 auxiliary(dlink_dir_300b_600b_http_login) > run

[*] Attempting to login to http://192.168.178.133:80/session.cgi
[*] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [1/3] - /session.cgi - Trying username:'admin' with password:''
[-] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [1/3] - /session.cgi - Failed to login as 'admin'
[*] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [2/3] - /session.cgi - Trying username:'admin' with password:'admin'
[-] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [2/3] - /session.cgi - Failed to login as 'admin'
[*] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [3/3] - /session.cgi - Trying username:'admin' with password:'test'
[+] http://192.168.178.133:80/session.cgi - Successful login 'admin' : 'test'
[*] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [3/3] - /session.cgi - Trying random username with password:'test'
[*] 192.168.178.133:80 DLINK_DIR_300B_600B_HTTP - [3/3] - /session.cgi - Trying username:'admin' with random password
[*] http://192.168.178.133:80/session.cgi - Random usernames are not allowed.
[*] http://192.168.178.133:80/session.cgi - Random passwords are not allowed.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed