Notedpad++ NppFTP plugin retrieval of passwords

Question

Is there a way we can retrieve passwords saved for FTP accounts under NppFTP plugin with Notepad++?

Thank you. Jae

Solution 1

There is one way but you must put some effort:

1. Download Wireshark http://www.wireshark.org/ (program for network monitoring)
2. After installation, open it as administrator
3. Click: Capture->Interfaces
4. Choose interface which has some packets (you will see them if you wait on this screen for a while) and click Start
5. Open Notepad++ and connect to FTP of your choice
6. Go back to the wireshark and click stop (4th button on the left)
7. Inside filter field type: ftp
8. Your password will be listed among other stuff about this FTP connection (check out the Info column for Request: PASS)

It's not an easy solution but it's good for every FTP program not only Npp

Solution 2

It is in %APPDATA%\Notepad++\plugins\Config\NppFTP\NppFTP.xml however the passwords are hashed somehow.

Comments

[Lajos Mészáros]

It supposed to be a reversible hash or maybe an index into a database based on the same length.

[Lajos Mészáros]

Mister, you saved my life! Please accept my humble upvote.

[Jesse Chisholm]

re: "supposed to be a reversible hash" -- it is DES 64-bit Cipher Feedback. See: RFC 2948 : ietf.org/rfc/rfc2948.txt for details. The default master password is "NppFTP00" (or what you gave instead) and is used as the KEY for decrypting the hashed password for connections in that file.

[Codesmith]

@JesseChisholm, thanks, but, first, standard 2948 refers to an OFB mode of DES, not a CFB mode, and second, for either, what's used for the IV?

[Jesse Chisholm]

Then, to be even more specific, NppFTP uses the DES algorithms in OpenSSL. Here is someones code for this: gist.github.com/alecgorge/1623895 which you are right, is RFC 2947, not 2948 : tools.ietf.org/html/rfc2947

[DiMono]

Worked for me too. Thanks!