FileZilla Client Installed

#
# (C) Tenable, Inc.
#

include("compat.inc");

if (description)
{
  script_id(69475);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");

  script_name(english:"FileZilla Client Installed");

  script_set_attribute(attribute:"synopsis", value:"An open source FTP client is installed on the remote host.");
  script_set_attribute(attribute:"description", value:
"FileZilla, an open source FTP/SFTP client, is installed on the remote
host.");
  script_set_attribute(attribute:"see_also", value:"https://filezilla-project.org/");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:filezilla:filezilla");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"asset_inventory_category", value:"software_enumeration");
  script_set_attribute(attribute:"agent", value:"windows");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2013-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);
  exit(0);
}

include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("install_func.inc");
include("universal_collection.inc");

# @collection-signature
var signature = {
  'Windows': {
    'Files': [
      {
        'Signature': [
          { 'Name': { 'Equals': 'FileZilla.exe' } }
        ],
        'Get': {
          'PEVersion': [
            { 'Value': 'FileVersion', 'Label': 'FileZilla.exe FileVersion' }
          ]
        }
      }
    ]
  }
};

function live_collect_func()
{
  var paths = [];

  registry_init();
  var hklm = registry_hive_connect(hive:HKEY_LOCAL_MACHINE, exit_on_fail:TRUE);

  var values = get_registry_values(handle:hklm, items:make_list(
    # version 3.x stores it here
    "SOFTWARE\FileZilla Client\",
    # version 2.x stores it here
    "SOFTWARE\FileZilla\Install_Dir"
  ));

  if (!isnull(values["SOFTWARE\FileZilla Client\"]))
    append_element(var:paths, value:values["SOFTWARE\FileZilla Client\"]);

  if (!isnull(values["SOFTWARE\FileZilla\Install_Dir"]))
    append_element(var:paths, value:values["SOFTWARE\FileZilla\Install_Dir"]);

  RegCloseKey(handle:hklm);

  var hku = registry_hive_connect(hive:HKEY_USERS, exit_on_fail:TRUE);
  var subkeys = get_registry_subkeys(handle:hku, key:'');
  var key, hku_path;
  foreach key (subkeys)
  {
    hku_path = get_registry_value(handle:hku, item:key + "\SOFTWARE\FileZilla Client\");

    if(!isnull(hku_path)) # add a path to check
      append_element(var:paths, value:hku_path);
  }
  RegCloseKey(handle:hku);

  if (empty_or_null(paths))
  {
    # no paths found in the registry
    close_registry();
    return NULL;
  }
  close_registry(close:FALSE);

  # If any installs were found, mark it as installed in the KB and issue a report.
  var collector = new universal_collection::collector();
  var path, signature_entry, file_signature, sig_field, sig_operator, exe, file_path, ver, error;

  foreach path (paths)
  {
    foreach signature_entry (signature['Windows']['Files'])
    {
      foreach file_signature (signature_entry['Signature'])
      {
        sig_field = 'Name';
        sig_operator = 'Equals';

        exe = file_signature[sig_field][sig_operator];

        if (empty_or_null(exe)) continue;

        file_path = hotfix_append_path(path:path, value:exe);

        # if we don't already have this file's version
        ver = hotfix_get_fversion(path:file_path);
        
        error = hotfix_handle_error(error_code:ver['error'], file:file_path);
        if (error && ver['error'] != HCF_NOVER)
        {
          dbg::detailed_log(msg:error, lvl:1, src:FUNCTION_NAME);
          continue;
        }

        collector.add_fileversion_match(
          filepath       : file_path,
          version        : ver.version,
          sig_field      : sig_field,
          sig_operator   : sig_operator,
          sig_val        : exe,
          peversion_info : signature_entry['Get']['PEVersion']
        );
      }
    }
  }

  hotfix_check_fversion_end();

  return collector;
}

##
# Main
##
var app = "FileZilla Client";
var cpe = "cpe:/a:filezilla:filezilla";
var kb_base = "SMB/filezilla/";

var collector = get_collector_or_collect(signature:signature, collect_func:@live_collect_func);

var installs = 0;
var finding, filepath, version, version_number, display_version, match_data, matches;

foreach finding (collector.collection)
{
  filepath = finding['CollectData']['FilePath'];

  version = NULL;
  foreach match_data (finding['MatchData'])
  {
    if (match_data['Label'] == 'FileZilla.exe FileVersion')
    {
      version = match_data['Values'][0];
      break;
    }
  }

  # At least one version of FileZilla ends with a letter, which
  # ver_compare() can't handle.
  version_number = 0;
  display_version = NULL;
  if (!isnull(version))
  {
    display_version = version;
    matches = pregmatch(string:version, pattern:"^([0-9.]+)");
    if (!empty_or_null(matches))
      version_number = matches[1];
  }

  # Note: legacy stored the full executable filepath as the 'Path' KB
  set_kb_item(name:kb_base + "install/" + installs + "/Path", value:filepath);

  if (!isnull(version))
    set_kb_item(name:kb_base + "install/" + installs + "/Version", value:version);

  if (!isnull(version_number))
    set_kb_item(name:kb_base + "install/" + installs + "/VersionNumber", value:version_number);

  register_install(
    vendor          : "FileZilla",
    product         : "FileZilla",
    app_name        : app,
    path            : filepath,
    version         : version,
    display_version : display_version,
    cpe             : cpe
  );

  installs++;
}

# If any installs were found, mark it as installed in the KB
if (installs > 0)
{
  set_kb_item(name:kb_base + "Installed", value:TRUE);
  set_kb_item(name:kb_base + "installs", value:installs);
}

get_install_count(app_name:app, exit_if_zero:TRUE);

report_installs(app_name:app, port:kb_smb_transport());