四、 源代码 

#define  UNICODE
#define  _UNICODE

#include <windows.h>
#include <winnetwk.h>
#include <tchar.h>
#include "include\lmaccess.h"
#include "include\lmserver.h"
#include "include\lmshare.h"
#include <lm.h>

#pragma  comment (lib,"mpr")
#pragma  comment (lib,"netapi32")
 
void start();
void usage();
int  datetime(PTSTR server);
int  fingerprint(PTSTR server);
int  netbios(PTSTR server);
int  users(PTSTR server);
int  localgroup(PTSTR server);
int  globalgroup(PTSTR server);
int  transport(PTSTR server);
int  session(PTSTR server);

int wmain(int argc,TCHAR *argv[])
{ 
    NETRESOURCE nr;
    DWORD       ret;
    TCHAR       username[100]=_T("");
    TCHAR       password[100]=_T("");
    TCHAR       ipc[100]=_T("");

    system("cls.exe");
    start();
    if(argc!=2)
    {
        usage();
        return -1;
    }
    swprintf(ipc,_T("\\\\%s\\ipc$"),argv[1]);
    nr.lpLocalName=NULL;
    nr.lpProvider=NULL;
    nr.dwType=RESOURCETYPE_ANY;
    nr.lpRemoteName=ipc;
    ret=WNetAddConnection2(&nr,username,password,0);
    if(ret!=ERROR_SUCCESS)
    {
        _tprintf(_T("\nIPC$ Connect Failed.\n"));
        return -1;
    }

       datetime(argv[1]);
       fingerprint(argv[1]);
       netbios(argv[1]);
       users(argv[1]);
       localgroup(argv[1]);
       globalgroup(argv[1]);
       transport(argv[1]);
       session(argv[1]);

    ret=WNetCancelConnection2(ipc,0,TRUE);    
    if(ret!=ERROR_SUCCESS)
    {
        _tprintf(_T("IPC$ Disconnect Failed.\n"));
        return -1;
    }
    return 0;
}

void start()
{
    _tprintf(_T("=====[ T-SMB Scan, by TOo2y        ]=====\n"));
    _tprintf(_T("=====[ E-mail: TOo2y@safechina.net ]=====\n"));
    _tprintf(_T("=====[ HomePage: www.safechina.net ]=====\n"));
    _tprintf(_T("=====[ Date: 12-12-2002            ]=====\n"));
}

void usage()
{
    _tprintf(_T("\nUsage:\t  T-SMB  Remoteip"));
    _tprintf(_T("\nRequest:  Remote host must be opening port 445/tcp of Microsoft-DS.\n"));
}

int datetime(PTSTR server)
{
    PTIME_OF_DAY_INFO  pBuf=NULL;
    NET_API_STATUS     nStatus;
    DWORD              lerror;

    _tprintf(_T("\n*** Date and Time ***\n"));
    nStatus=NetRemoteTOD(server,(PBYTE*)&pBuf); 
    if(nStatus==NERR_Success)
    { 
        if(pBuf!=NULL)
        {
            _tprintf(_T("\nCurrent date:\t%.2d-%.2d-%d"),pBuf->tod_month,pBuf->tod_day,pBuf->tod_year);
            _tprintf(_T("\nCurrent time:\t%.2d:%.2d:%.2d.%.2d (GMT)"),pBuf->tod_hours,pBuf->tod_mins,pBuf->tod_secs,pBuf->tod_hunds);
            pBuf->tod_hours=(pBuf->tod_hours+8)%24;
            _tprintf(_T("\nCurrent time:\t%.2d:%.2d:%.2d.%.2d (GMT+08:00)\n"),pBuf->tod_hours,pBuf->tod_mins,pBuf->tod_secs,pBuf->tod_hunds);
        }   
    }
    else
    {
        lerror=GetLastError();
        if(lerror==997)
        {
            _tprintf(_T("\nDateTime:\tOverlapped I/O operation is in progress. \n"));
        }
        else                            
        {
             _tprintf(_T("\nDatetime Error:\t%d\n"),lerror);
        }
    }
    if(pBuf!=NULL)
    {
        NetApiBufferFree(pBuf);
    }
    return 0;
}

int fingerprint(PTSTR server)  
{ 
       DWORD              dwlength; 
    DWORD              dwLevel; 
    NET_API_STATUS     nStatus;
    PSERVER_INFO_101   pBuf;
    DWORD              lerror;
 
    dwLevel=101;
    pBuf=NULL; 
    dwlength=_tcslen(server);

    _tprintf(_T("\n**** Fingerprint ****\n"));
    nStatus=NetServerGetInfo(server,dwLevel,(PBYTE *)&pBuf);
    if(nStatus==NERR_Success)
    {
        _tprintf(_T("\nComputername:\t%s"),pBuf->sv101_name);
        _tprintf(_T("\nComment:\t%s"),pBuf->sv101_comment);
        _tprintf(_T("\nPlatform:\t%d"),pBuf->sv101_platform_id);
        _tprintf(_T("\nVersion:\t%d.%d"),pBuf->sv101_version_major,pBuf->sv101_version_minor);
        _tprintf(_T("\nType:")); 
        if(pBuf->sv101_type & SV_TYPE_NOVELL)
        {
            _tprintf(_T("\t\tNovell server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_XENIX_SERVER)
        {
            _tprintf(_T("\t\tXenix server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DOMAIN_ENUM)
        {
            _tprintf(_T("\t\tPrimary domain .\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_TERMINALSERVER)
        {
            _tprintf(_T("\t\tTerminal Server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_WINDOWS)
        {
            _tprintf(_T("\t\tWindows 95 or later.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_SERVER)
        {
            _tprintf(_T("\t\tA LAN Manager server.\n"));
        }
              if(pBuf->sv101_type & SV_TYPE_WORKSTATION)       
        {
             _tprintf(_T("\t\tA LAN Manager workstation.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_PRINTQ_SERVER)
        {
            _tprintf(_T("\t\tServer sharing print queue.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DOMAIN_CTRL)
        {
            _tprintf(_T("\t\tPrimary domain controller.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DOMAIN_BAKCTRL)
        {
            _tprintf(_T("\t\tBackup domain controller.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_AFP)
        {
            _tprintf(_T("\t\tApple File Protocol server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DOMAIN_MEMBER)
        {
            _tprintf(_T("\t\tLAN Manager 2.x domain member.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_LOCAL_LIST_ONLY)
        {
            _tprintf(_T("\t\tServers maintained by the browser.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DIALIN_SERVER)
        {
            _tprintf(_T("\t\tServer running dial-in service.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_TIME_SOURCE)
        {
            _tprintf(_T("\t\tServer running the Timesource service.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_SERVER_MFPN)
        {
            _tprintf(_T("\t\tMicrosoft File and Print for NetWare.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_NT)
        {
            _tprintf(_T("\t\tWindows NT/2000/XP workstation or server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_WFW)
        {
            _tprintf(_T("\t\tServer running Windows for Workgroups.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_POTENTIAL_BROWSER)
        {
            _tprintf(_T("\t\tServer that can run the browser service.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_BACKUP_BROWSER)
        {
            _tprintf(_T("\t\tServer running a browser service as backup.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_MASTER_BROWSER)
        {
            _tprintf(_T("\t\tServer running the master browser service.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_DOMAIN_MASTER)
        {
            _tprintf(_T("\t\tServer running the domain master browser.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_CLUSTER_NT)
        {
            _tprintf(_T("\t\tServer clusters available in the domain.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_SQLSERVER)
        {
            _tprintf(_T("\t\tAny server running with Microsoft SQL Server.\n"));
        }
        if(pBuf->sv101_type & SV_TYPE_SERVER_NT)
        {
            _tprintf(_T("\t\tWindows NT/2000 server that is not a domain controller.\n"));
        }
    }
    else
    {
        lerror=GetLastError();
        if(lerror==997)
        {
            _tprintf(_T("\nFingerprint:\tOverlapped I/O operation is in progress.\n"));
        }
        else
        {
                   _tprintf(_T("\nFingerprint Error:\t%d\n"),lerror);
        }
    }
     if(pBuf!=NULL)
    {
        NetApiBufferFree(pBuf);
    }
    return 0;
}

int netbios(PTSTR server)      
{
    DWORD              er,tr,resume;
    DWORD              i,dwLength,dwLevel;
    PSHARE_INFO_1      pBuf,pBuffer;
    NET_API_STATUS     nStatus;
    DWORD              lerror;

    er=0;             
    tr=0;
    resume=1;
    dwLevel=1;
    dwLength=_tcslen(server);

       _tprintf(_T("\n****** Netbios ******\n"));
    do
    {                                                
        nStatus=NetShareEnum(server,dwLevel,(PBYTE *)&pBuf,MAX_PREFERRED_LENGTH,&er,&tr,&resume);
        if((nStatus==ERROR_SUCCESS) || (nStatus==ERROR_MORE_DATA))
        {
                    pBuffer=pBuf;
                   for(i=1;i<=er;i++)  
            {
                _tprintf(_T("\nName:\t\t%s"),pBuffer->shi1_netname);
                _tprintf(_T("\nRemark:\t\t%s"),pBuffer->shi1_remark);
                _tprintf(_T("\nType:\t\t")); 
                if(pBuffer->shi1_type==STYPE_DISKTREE)     
                { 
                    _tprintf(_T("Disk drive.\n"));
                }
                else if(pBuffer->shi1_type==STYPE_PRINTQ)  
                {
                    _tprintf(_T("Print queue.\n"));
                }
                else if(pBuffer->shi1_type==STYPE_DEVICE)
                {
                    _tprintf(_T("Communication device.\n"));
                }
                else if(pBuffer->shi1_type==STYPE_IPC)   
                {
                    _tprintf(_T("Interprocess communication (IPC).\n"));  
                }
                else if(pBuffer->shi1_type==STYPE_SPECIAL) 
                {
                    _tprintf(_T("Special share reserved for interprocess communication (IPC$) or remote administration of the server (ADMIN$).\n"));
                }
                else
                {
                    _tprintf(_T("\n"));
                }
                pBuffer++;
            }
        }
        else
        {
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nNetbios:\tOverlapped I/O operation is in progress.\n"));
            }
            else 
            {
                _tprintf(_T("\nNetbios Error:\t%d\n"),lerror);
            }
        }
               if(pBuf!=NULL)
        {
                       NetApiBufferFree(pBuf);
        }
    }
    while(nStatus==ERROR_MORE_DATA);
    return 0;
}

int users(PTSTR server) 
{
    PNET_DISPLAY_USER  pBuf,pBuffer;
    DWORD              nStatus;
    DWORD              dwRec;
    DWORD              i=0;
    DWORD              lerror;
    DWORD              dwLevel;

    dwLevel=1;

    _tprintf(_T("\n******* Users *******\n"));
    do
    {
        nStatus=NetQueryDisplayInformation(server,dwLevel,i,100,0xFFFFFFFF,&dwRec,(PVOID *)&pBuf);
        if((nStatus==ERROR_SUCCESS) || (nStatus==ERROR_MORE_DATA))
        {
            pBuffer=pBuf;
            for(;dwRec>0;dwRec--)
            {
                _tprintf(_T("\nName:\t\t%s"),pBuffer->usri1_name);
                _tprintf(_T("\nFull Name:\t%s"),pBuffer->usri1_full_name);
                _tprintf(_T("\nUser ID:\t%u"),pBuffer->usri1_user_id);
                _tprintf(_T("\nComment: \t%s"),pBuffer->usri1_comment);
                _tprintf(_T("\nFlag:"));  
                if(pBuffer->usri1_flags & UF_ACCOUNTDISABLE)
                {
                    _tprintf(_T("\t\tThe user''s account is disabled.\n"));
                }
                if(pBuffer->usri1_flags & UF_TRUSTED_FOR_DELEGATION)
                {
                    _tprintf(_T("\t\tThe account is enabled for delegation. \n"));
                }
                if(pBuffer->usri1_flags & UF_LOCKOUT)
                {
                    _tprintf(_T("\t\tThe account is currently locked out (blocked).\n"));
                }
                if(pBuffer->usri1_flags & UF_SMARTCARD_REQUIRED)
                {
                    _tprintf(_T("\t\tRequires the user to log on to the user account with a smart card. \n"));
                }
                if(pBuffer->usri1_flags & UF_DONT_REQUIRE_PREAUTH)
                {
                    _tprintf(_T("\t\tThis account does not require Kerberos preauthentication for logon.\n"));
                }
                if(pBuffer->usri1_flags & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)
                {
                    _tprintf(_T("\t\tThe user''s password is stored under reversible encryption in the Active Directory. \n"));
                }
                if(pBuffer->usri1_flags & UF_NOT_DELEGATED)
                {
                    _tprintf(_T("\t\tMarks the account as \"sensitive\"; other users cannot act as delegates of this user account.\n"));
                }
                if(pBuffer->usri1_flags & UF_USE_DES_KEY_ONLY)
                {
                    _tprintf(_T("\t\tRestrict this principal to use only Data Encryption Standard (DES) encryption types for keys.\n"));
                }
                if(pBuffer->usri1_flags & UF_HOMEDIR_REQUIRED)
                {
                    _tprintf(_T("\t\tThe home directory is required. Windows NT/Windows 2000/Windows XP ignores this value.\n"));
                }
                if(pBuffer->usri1_flags & UF_SCRIPT)
                {
                    _tprintf(_T("\t\tThe logon script executed. This value must be set for LAN Manager 2.0 and Windows NT/2000/XP.\n"));
                }
                i=pBuffer->usri1_next_index;
                pBuffer++;
            }
        }
        else
        {  
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nUsers:\t\tOverlapped I/O operation is in progress.\n"));
            }
            else
            {
                _tprintf(_T("\nUsers Error:\t%d\n"),lerror);
            }
        }
          if(pBuf!=NULL)
        {
                   NetApiBufferFree(pBuf);
        }
    }while(nStatus==ERROR_MORE_DATA);
    return 0;
}

int localgroup(PTSTR server)  
{
    NET_API_STATUS      nStatus;
    PLOCALGROUP_INFO_1  pBuf,pBuffer;
    DWORD               i,dwLevel;
       DWORD               er,tr,resume; 
    DWORD               lerror;

    resume=0;
    dwLevel=1; 

    _tprintf(_T("\n**** Local Group ****\n"));
    do
    {                                                    
        nStatus=NetLocalGroupEnum(server,dwLevel,(PBYTE *)&pBuf,MAX_PREFERRED_LENGTH,&er,&tr,&resume);
        if((nStatus==NERR_Success) || (nStatus==ERROR_MORE_DATA))
        {
            pBuffer=pBuf;
            for(i=1;i<=er;i++)
            {
                _tprintf(_T("\nName:\t\t%s"),pBuffer->lgrpi1_name);
                _tprintf(_T("\nComment:\t%s"),pBuffer->lgrpi1_comment);
                _tprintf(_T("\n"));
                pBuffer++;
            }
        }
        else
        {
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nLocal Group:\tOverlapped I/O operation is in progress.\n"));
            }
            else
            {
                _tprintf(_T("\nLocal Group Error:\t%d\n"),lerror);
            }
        }
        if(pBuf!=NULL)
        {
               NetApiBufferFree(pBuf);
        }
    }while(nStatus==ERROR_MORE_DATA);
    return 0;
} 

int globalgroup(PTSTR server)  
{
    PNET_DISPLAY_GROUP   pGBuf,pGBuffer;
    PGROUP_USERS_INFO_0  pUBuf,pUBuffer;
    DWORD                nGStatus,nUStatus;
    DWORD                i;
    DWORD                dwLevel,dwRec;
    DWORD                k;
    DWORD                er,tr,resume;
    DWORD                lerror;
    
    i=0;
    dwLevel=3;
    er=0;
    tr=0;
    resume=0;
    _tprintf(_T("\n**** Global group ****\n"));
       do
    {
        nGStatus=NetQueryDisplayInformation(server,dwLevel,i,100,0xFFFFFFFF,&dwRec,(PVOID*)&pGBuf);
             if((nGStatus==ERROR_SUCCESS) || (nGStatus==ERROR_MORE_DATA))
        {
            pGBuffer=pGBuf;
            for(;dwRec>0;dwRec--)
            {
                _tprintf(_T("\nName:\t\t%s"),pGBuffer->grpi3_name);
                       _tprintf(_T("\nComment:\t%s"),pGBuffer->grpi3_comment);
                         _tprintf(_T("\nGroup ID:\t%u"),pGBuffer->grpi3_group_id);
                        _tprintf(_T("\nAttributs:\t%u"),pGBuffer->grpi3_attributes);
                _tprintf(_T("\nMembers:\t"));

                       nUStatus=NetGroupGetUsers(server,pGBuffer->grpi3_name,0,(PBYTE *)&pUBuf,MAX_PREFERRED_LENGTH,&er,&tr,&resume);
                if(nUStatus==NERR_Success)
                {
                    pUBuffer=pUBuf;
                    for(k=1;k<=er;k++)
                    {
                        _tprintf(_T("%s  "),pUBuffer->grui0_name);
                           pUBuffer++;
                    }
                       if(pUBuf!=NULL)
                    {
                                NetApiBufferFree(pUBuf);
                    }
                }
                _tprintf(_T("\n"));
                i=pGBuffer->grpi3_next_index;
                pGBuffer++;
            }
        }
        else
        {
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nGlobal Group:\tOverlapped I/O operation is in progress.\n"));
            }
            else
            {
                _tprintf(_T("\nGlobal Group Error:\t%d\n"),lerror);
            }
        }
        if(pGBuf!=NULL)
        {
                     NetApiBufferFree(pGBuf);
        }
    }while(nGStatus==ERROR_MORE_DATA);
    return 0;
}

int transport(PTSTR server)  
{
    NET_API_STATUS           nStatus;
    PSERVER_TRANSPORT_INFO_0 pBuf,pBuffer;
    DWORD                    dwLevel;
    DWORD                    i;
       DWORD                    er,tr,resume;
       DWORD                    dwTotalCount;
    DWORD                    dwLength;
    DWORD                    lerror;

       er=0;
    tr=0;
    resume=0;
    dwLevel=0;
    dwTotalCount=0;

    _tprintf(_T("\n***** Transport *****\n"));
    dwLength=_tcslen(server);
    do
    {
        nStatus=NetServerTransportEnum(server,dwLevel,(PBYTE *)&pBuf,MAX_PREFERRED_LENGTH,&er,&tr,&resume);
        if((nStatus==NERR_Success) || (nStatus==ERROR_MORE_DATA))
        {
                     pBuffer=pBuf;
            for(i=0;i<er;i++)
            {
                         _tprintf(_T("\nTransport:\t%s"),pBuffer->svti0_transportname);
                _tprintf(_T("\nNetworkAddr:\t%s"),pBuffer->svti0_networkaddress);
                _tprintf(_T("\nActiveClient:\t%d User(s)\n"),pBuffer->svti0_numberofvcs);
                           pBuffer++;
                          dwTotalCount++; 
            }
        }
        else
        {
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nTransport:\tOverlapped I/O operation is in progress.\n"));
            }
            else
            {
                _tprintf(_T("\nTransport Error:\t%d\n"),lerror);
            }
        }
          if(pBuf!=NULL)
        {
                      NetApiBufferFree(pBuf);
        }
    }while(nStatus==ERROR_MORE_DATA);
    _tprintf(_T("\nTotal of %d entrie(s) enumerated.\n"),dwTotalCount);
    return 0;
}
    
int session(PTSTR server)   
{
    PSESSION_INFO_10   pBuf,pBuffer;
    NET_API_STATUS     nStatus;
    DWORD              i,dwLevel;
    DWORD              er,tr,resume;
    DWORD              dwTotalCount;
    DWORD              dwLength;
    PTSTR              pszClient;
    PTSTR              pszUser;
    DWORD              lerror;

    _tprintf(_T("\n****** Session ******\n"));
    dwLevel=10;
    dwTotalCount=0;
    pszClient=NULL;
    pszUser=NULL;
    er=0;
    tr=0;
    resume=0;
    dwLength=_tcslen(server);

    do
    {
        nStatus=NetSessionEnum(server,pszClient,pszUser,dwLevel,(PBYTE *)&pBuf,MAX_PREFERRED_LENGTH,&er,&tr,&resume);
        if((nStatus==NERR_Success) || (nStatus==ERROR_MORE_DATA))
        {
            pBuffer=pBuf;
            for(i=0;i<er;i++)
            {
                if(pBuffer==NULL)
                {
                    _tprintf(_T("An access violation has occurred.\n"));
                    break;
                }
                _tprintf(_T("\nClient:\t\t%s"),pBuffer->sesi10_cname);
                _tprintf(_T("\nUser:\t\t%s"),pBuffer->sesi10_username);
                _tprintf(_T("\nSeconds Active:\t%d"),pBuffer->sesi10_time);
                _tprintf(_T("\nSeconds Idle:\t%d\n"),pBuffer->sesi10_idle_time);
                pBuffer++;
                dwTotalCount++;
            }
        }
        else
        {
            lerror=GetLastError();
            if(lerror==997)
            {
                _tprintf(_T("\nSession:\tOverlapped I/O operation is in progress.\n"));
            }
            else
            {
                _tprintf(_T("\nSession Error:\t%d\n"),lerror);
            }
        }
        if(pBuf!=NULL)
        {
            NetApiBufferFree(pBuf);
        }
    }while(nStatus==ERROR_MORE_DATA);
       _tprintf(_T("\nTotal of %d entrie(s) enumerated.\n"),dwTotalCount);
    return 0;
}

上一页  [1] [2]