Accessing sensitive data FileZilla

FileZilla FTP Passwords now Stored in Plaintext.

It's an old vulnerability FileZilla, but we can still find servers with such a security breach, Vulnerability allows access to sensitive files from the server. Containing passwords and FTP users.

FileZilla version ~ 3.0.9.2+ (and possibly older) store all FTP connection data .xml files in plain text.

The following files are what you need to know about:

filezilla.xml – Stores most recent server info including password in plaintext.
recentservers.xml – Stores all recent server info including password in plaintext.
sitemanager.xml – Stores all saved sites server info including password in plaintext.

These files can usually be found in the following directories:
Windows XP/2K: "C:\Documents and Settings\username\Application Data\FileZilla"
Windows Vista: "C:\Users\username\AppData\Roaming\FileZilla\"
Linux: "/home/username/.filezilla/"

FileZilla configuration files
FileZilla is a cross-platform application. That’s why it stores its settings in platform-neutral XML files.

sitemanager.xml 
The XML files are readable for reading with access data, As you can see, everything is stored in plain text, including the password.

filezilla.xml
The filezilla.xml file follow the same example sitemanager.xml, It starts with naming <LastServer>

Quick connect 
QuickConnect lets you connect to servers without adding them to your administrative panel. when instaciado a fast connection it is added in recentservers.xml file.

Danger?
Yes the same way that you can read these files. Malicious applications can do the same, and can be read also on web servers.
ex:
www.target.com.br/folder/{file.xml}
www.target.com.br/microsite/geo243/FileZilla.xml www.target.com.br/149224/prg/programok/Total%20Commander/FileZilla/recentservers.xml

Other files:

1. sitemanager.xml
2. recentservers.xml
3. filezilla.xml
4. bookmarks.xml
5. filters.xml
6. layout.xml
7. queue.xml

Looking for vulnerable servers
Now let's use the inurlbr tool to search sites with such breach and confirm such information.
Download tool: 
https://github.com/googleinurl/SCANNER-INURLBR

Setting command:
using search engines..

SET DORK:
Choose your dork search

• "\FileZilla\" ext:xml
• inurl:"\FileZilla\" & inurl:sitemanager.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:recentservers.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:filezilla.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:bookmarks.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:filters.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:layout.xml -github -sourceforge
• inurl:"\FileZilla\" & inurl:queue.xml -github -sourceforge
• inurl:sitemanager.xml & ext:xml & -github -sourceforge
• inurl:recentservers.xml & ext:xml & -github -sourceforge
• inurl:filezilla.xml & ext:xml & -github -sourceforge
• inurl:bookmarks.xml & ext:xml & -github -sourceforge
• inurl:filters.xml & ext:xml & -github -sourceforge
• inurl:layout.xml & ext:xml & -github -sourceforge
• inurl:queue.xml & ext:xml & -github -sourceforge
• inurl:"\FileZilla\" & inurl:(sitemanager.xml | recentservers.xml | filezilla.xml | filters.xml | bookmarks.xml | layout.xml | queue.xml) ext:xml -github -sourceforge

--dork 'YOU_DORK'
- Setting: --dork '"\FileZilla\" ext:xml'

SET FILE OUTPUT:
- Setting: -s filezilla.txt

SET TIPE VALIDATION: 
- Setting: -t 2 
   2 The second type tries to valid the error defined by: -a 'VALUE_INSIDE_THE _TARGET' It    also establishes connection with the exploit through the get method.

SET STRING VALIDATION:
Specify the string that will be used on the search script:
   Example: -a {string}
   Usage:    -a '<title>hello world</title>'
   If specific value is found in the target he is considered vulnerable.
- Setting:     -a '<FileZilla3>'
All filezilla file there is a primary tag called <FileZilla3>. It is trough this that we will validate.
Ex:

Full command - using search engines:
php inurlbr.php --dork '"\FileZilla\" ext:xml' -s filezilla.txt -t 2 -a '<FileZilla3>'

OR SCANNER DORKING-FILE:
php inurlbr.php --dork-file dorks.txt -s filezilla.txt -t 2 -a '<FileZilla3>'

OUTPUT PRINT:

Using FileZilla the safe way

FileZilla is a great FTP client and I use it myself. But since it doesn’t protect your FTP credentials, you should protect them yourselves. Here is what you can do:

1. Don’t use the “Normal” logon type. There are the “Ask for password” and the “Interactive” types that won’t save your passwords on disk. So malware simply won’t be able to get enough information from FileZilla configuration files to hack your sites.

Pros
Malware cannot steal your FTP credential from configuration files.

Cons
You’ll have to enter your password every time you connect to your site.
It won’t save you from more sophisticated spyware such as keyloggers and traffic sniffers. But I hope this sort of trojans can be better detected by you antivirus tools since they need to hook known system functions. To protect yourself from traffic sniffers, always use SFTP instead of FTP (if possible).

2. Hosts trick. If you manage multiple web sites, interactive logon types may be really inconvenient. There is a trick that can let you use the “Normal” logon type in a more secure manner. You should create aliases of your sites’ addresses in the “hosts” file (on Windows, you can find it in C:\WINDOWS\system32\drivers\etc\).

For example you have a site “example.com” with an IP-address "208.xxx.188.166".
To create an alias you need to add the following line into the hosts file:

208.xxx.188.166         my_example

"my_example" will work the same way as “example.com” when you use it on your computer.
However, on other computers it won’t make any sense. Now use this alias in FTP connection settings instead of “example.com”.
If hackers manage to steal your FTP credentials, all they’ll have will be: (host: my_example, user: unmask, password: parasites) – the username/password pair is valid, but the host name doesn’t make any sense to them. It’s like having a key and not knowing where the door is.

Pros
Once you have added new aliases to the hosts file and to FileZilla Site Manager, you can enjoy the ease of one-click connections.
Cons

This trick will only work as long as malware steals FTP credentials from configuration files verbatim (and I have proofs that at least some malware steal the data verbatim).  If they only add a simple check that converts host names to IP-addresses before sending the credentials to their central database, the trick will be useless.  This trick is better than no protection at all, but you should not count on it.
You’ll need to update the hosts file if IP-addresses change.

3. Public Key Authentication. If your hosting plan included SSH (secure shell), you can use FileZilla in SFTP mode. One of convenient SSH features is public key authentication. And FileZilla supports this type of authorization (I didn’t use it myself, but at least have seen the UI in the “Settings” dialog). FileZilla recognizes PuTTY’s Pageant, so the configuration should be easy if you already use PuTTY for SSH.

Pros
Secure one-click connections.

Cons

This authentication method will only work if your hosting plan includes SSH/SFTP. Unfortunately, this option is rearly included into shared hosting plans.
Creating the keys and configuring FileZilla to use them is not a trivial process.
You might still have to enter a pass phrase when adding keys to the Pageant.
Other FTP programs

In this article I reviewed FileZilla only because it’s a popular FTP client that I have on my computer and it was very easy to demonstrate how little it does to protect users’ FTP credentials. However the same concerns apply to all other  programs that have FTP functions: classical FTP clients, web page editors, file managers. Popular applications like DreamWeaver, CuteFTP, Total Commander, etc. account for majority of FTP credentials leaks.

Solution Source: http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/

Referencias:
http://seclists.org/fulldisclosure/2008/Apr/508
http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/
http://bl0wj0bb3r.blogspot.com.br/2015/08/d3lphi-filezilla-password-stealer.html
http://unsharptech.com/2008/05/20/filezilla-ftp-passwords-stored-in-plaintext/