This module exploits an authentication bypass vulnerability in different Netgear devices. It allows to extract the password for the remote management interface. This module has been tested on a Netgear WNDR3700v4 - V220.127.116.11, but other devices are reported as vulnerable: NetGear WNDR3700v4 - V18.104.22.168SH, NetGear WNDR3700v4 - V22.214.171.124, NetGear WNR2200 - V126.96.36.199, NetGear WNR2500 - V188.8.131.52, NetGear WNDR3700v2 - V184.108.40.206 (Tested by Paula Thomas), NetGear WNDR3700v1 - V220.127.116.11 (Tested by Michal Bartoszkiewicz), NetGear WNDR3700v1 - V18.104.22.168 (Tested by Michal Bartoszkiewicz), NetGear WNDR4300 - V22.214.171.124 (Tested by Ronny Lindner), NetGear R6300v2 - V126.96.36.199 (Tested by Robert Mueller), NetGear WNDR3300 - V1.0.45 (Tested by Robert Mueller), NetGear WNDR3800 - V188.8.131.52 (Tested by an Anonymous contributor), NetGear WNR1000v2 - V184.108.40.206 (Tested by Jimi Sebree), NetGear WNR1000v2 - V220.127.116.11 (Tested by Chris Boulton), NetGear WNR2000v3 - v18.104.22.168 (Tested by h00die)
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security