得到远程主机操作系统类型（只适用于发现NT5.2及以下系统）

使用方法如下（探测IP段时默认30线程）：

Execute # getos
Usage: getos [IP range] <TN>
Example:
        getos 192.168.1.1/24 30
        getos 192.168.1.32-192.168.1.96

Execute # getos 192.168.190.129
192.168.190.129   CHECKERZ    Windows Server 2003 5.2 3790 Service Pack 2

 

代码如下：

//Code by Anle
//部分代码借鉴了网上的
// GetOS.cpp : Defines the entry point for the console application.
//
#define  UNICODE
#define  _UNICODE

#include "stdafx.h"
#include "GetOS.h"
#include <process.h>

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/
// The one and only application object
#pragma comment(linker, "/opt:nowin98 /IGNORE:4078 /MERGE:.rdata=.text /MERGE:.data=.text /section:.text,RW")

CWinApp theApp;

using namespace std;

char sessionrequest[] =
"\x81\x00\x00\x44\x20\x43\x4b\x46\x44\x45\x4e\x45\x43\x46\x44\x45"
"\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43\x41\x43\x41\x43\x41\x43"
"\x41\x43\x41\x43\x41\x00\x20\x45\x4b\x45\x44\x46\x45\x45\x49\x45"
"\x44\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"
"\x41\x43\x41\x43\x41\x41\x41\x00";

char negotiate[] =
"\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"
"\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e"
"\x31\x32\x00";

char setupaccount[] =
"\x00\x00\x00\x48\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"
"\x00\x00\x00\x00\x0d\xff\x00\x00\x00\xff\xff\x02\x00\x5c\x02\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0b"
"\x00\x00\x00\x4a\x43\00\x41\x54\x54\x48\x43\x00";

void Usage(TCHAR *lpInfo);
BOOL InitSocket(); //初始化
int my_fprintf(FILE *hIn,const TCHAR *form,...);
void BuildHostRange(LPCTSTR HostParam,DWORD &realStartIP,DWORD &realEndIP);
HANDLE MyCreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes,
					  SIZE_T dwStackSize,                       // initial stack size
					  LPTHREAD_START_ROUTINE lpStartAddress,    // thread function
					  LPVOID lpParameter,                       // thread argument
					  DWORD dwCreationFlags,                    // creation option
					  LPDWORD lpThreadId);
DWORD WINAPI ConnectTargetPro(LPVOID lParam);
inline wchar_t* A2U(const char *szStr);
inline char* U2A(const wchar_t *szStr);

CRITICAL_SECTION	_cs;  //临界区句柄
HANDLE	_semaphore;			//信号量句柄
DWORD	_threadsUsed=0;		//正在扫描的线程数


int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])
{
	int nRetCode = 0;
	
	//