chntpw.c

修改NT密码的程序

/*
 * chntpw.c - Offline Password Edit Utility for NT 3.51 & 4.0 SAM database.
 * 1999-feb: Now able to browse registry hives. (write support to come)
 * 2000-jan: Attempt to detect and disable syskey
 * 
 * Copyright (c) 1997-2000 Petter Nordahl-Hagen.
 * Freely distributable in source or binary for noncommercial purposes.
 * 
 * Uses (links with) DES SSL Library by Eric Young ([e-mail])
 * and MD4 routines by RSA.
 * 
 * Part of some routines, information and ideas taken from
 * pwdump by Jeremy Allison.
 *
 * Some stuff (like proto.h) from NTCrack by Jonathan Wilkins.
 * 
 * Please see the COPYING file for more details on
 * copyrights & credits.
 *  
 * THIS SOFTWARE IS PROVIDED BY PETTER NORDAHL-HAGEN `AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */ 

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <ctype.h>
#include <stdlib.h>
#include <string.h>
/* #include <unistd.h> */

/* These are from the DESlib & MD packages, see Makefile & README */
#include <des.h>
#include <mddriver/global.h>
#include <md4/md4.h>

#include "proto.h"

#include "ntreg.h"

const char chntpw_version[] = "chntpw version 0.98.1 000607, (c) Petter N Hagen";

extern char *val_types[REG_MAX+1];

#define MAX_HIVES 10
#define H_SAM 0
#define H_SYS 1
#define H_SEC 2


/* Array of loaded hives */
struct hive *hive[MAX_HIVES+1];
int no_hives = 0;

int syskeyreset = 0;
int dirty = 0;

/*
 * of user with RID 500, because silly MS decided
 * to localize the bloody admin-username!! AAAGHH!
 */
char admuser[129]="StupidMS";

/* ============================================================== */

/* Crypto-stuff & support for what we'll do in the V-value */

/* Zero out string for lanman passwd, then uppercase
 * the supplied password and put it in here */

void make_lanmpw(char *p, char *lm, int len)
{
   int i;
   
   for (i=0; i < 15; i++) lm[i] = 0;
   for (i=0; i < len; i++) lm[i] = toupper(p[i]);
}

/*
 * Convert a 7 byte array into an 8 byte des key with odd parity.
 */

void str_to_key(unsigned char *str,unsigned char *key)
{
	void des_set_odd_parity(des_cblock *);
	int i;

	key[0] = str[0]>>1;
	key[1] = ((str[0]&0x01)<<6) | (str[1]>>2);
	key[2] = ((str[1]&0x03)<<5) | (str[2]>>3);
	key[3] = ((str[2]&0x07)<<4) | (str[3]>>4);
	key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5);
	key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6);
	key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7);
	key[7] = str[6]&0x7F;
	for (i=0;i<8;i++) {
		key[i] = (key[i]<<1);
	}
	des_set_odd_parity((des_cblock *)key);
}

/*
 * Function to convert the RID to the first decrypt key.
 */

void sid_to_key1(unsigned long sid,unsigned char deskey[8])
{
	unsigned char s[7];

	s[0] = (unsigned char)(sid & 0xFF);
	s[1] = (unsigned char)((sid>>8) & 0xFF);
	s[2] = (unsigned char)((sid>>16) & 0xFF);
	s[3] = (unsigned char)((sid>>24) & 0xFF);
	s[4] = s[0];
	s[5] = s[1];
	s[6] = s[2];

	str_to_key(s,deskey);
}

/*
 * Function to convert the RID to the second decrypt key.
 */

void sid_to_key2(unsigned long sid,unsigned char deskey[8])
{
	unsigned char s[7];
	
	s[0] = (unsigned char)((sid>>24) & 0xFF);
	s[1] = (unsigned char)(sid & 0xFF);
	s[2] = (unsigned char)((sid>>8) & 0xFF);
	s[3] = (unsigned char)((sid>>16) & 0xFF);
	s[4] = s[0];
	s[5] = s[1];
	s[6] = s[2];

	str_to_key(s,deskey);
}

/* DES encrypt, for LANMAN */

void E1(uchar *k, uchar *d, uchar *out)
{
  des_key_schedule ks;
  des_cblock deskey;

  str_to_key(k,(uchar *)deskey);
#ifdef __FreeBSD__
  des_set_key(&deskey,ks);
#else /* __FreeBsd__ */
  des_set_key((des_cblock *)deskey,ks);
#endif /* __FreeBsd__ */
  des_ecb_encrypt((des_cblock *)d,(des_cblock *)out, ks, DES_ENCRYPT);
}


/* Decode the V-struct, and change the password
 * vofs - offset into SAM buffer, start of V struct
 * rid - the users RID, required for the DES decrypt stage
 *       If rid==0 it will try to extract the rid out of the V struct
 *       else the supplied one will be used
 *
 * Some of this is ripped & modified from pwdump by Jeremy Allison
 * 
 */
char *change_pw(char *buf, int rid, int vlen, int stat)
{
   
   uchar x1[] = {0x4B,0x47,0x53,0x21,0x40,0x23,0x24,0x25};
   char magic[] = {0x24, 0, 0x44 };
   int pl,ridofs,vend;
   char *vp;
   static char username[128],fullname[128];
   char comment[128],homedir[128],md4[32],lanman[32];
   char newunipw[34], newp[20], despw[20], newlanpw[16], newlandes[20];
   char yn[4];
   int username_offset,username_len;
   int fullname_offset,fullname_len;
   int comment_offset,comment_len;
   int homedir_offset,homedir_len;
   int ntpw_len,lmpw_len,ntpw_offs,lmpw_offs,i;
   des_key_schedule ks1, ks2;
   des_cblock deskey1, deskey2;

   MD4_CTX context;
   unsigned char digest[16];


   vp = buf;
   username_offset = get_int(vp + 0xC);
   username_len = get_int(vp + 0x10); 
   fullname_offset = get_int(vp + 0x18);
   fullname_len = get_int(vp + 0x1c);
   comment_offset = get_int(vp + 0x24);
   comment_len = get_int(vp + 0x28);
   homedir_offset = get_int(vp + 0x48);
   homedir_len = get_int(vp + 0x4c);
   lmpw_offs = get_int(vp + 0x9c);
   lmpw_len = get_int(vp + 0xa0);
   ntpw_offs = get_int(vp + 0xa8);
   ntpw_len = get_int(vp + 0xac);

#if 0
   printf("lmpw_offs: 0x%x, lmpw_len: %d (0x%x)\n",lmpw_offs,lmpw_len,lmpw_len);
   printf("ntpw_offs: 0x%x, ntpw_len: %d (0x%x)\n",ntpw_offs,ntpw_len,ntpw_len);
#endif

   *username = 0;
   *fullname = 0;
   *comment = 0;
   *homedir = 0;
   
   if(username_len <= 0 || username_len > vlen ||
      username_offset <= 0 || username_offset >= vlen ||
      comment_len < 0 || comment_len > vlen   ||
      fullname_len < 0 || fullname_len > vlen ||
      homedir_offset < 0 || homedir_offset >= vlen ||
      comment_offset < 0 || comment_offset >= vlen ||
      lmpw_offs < 0 || lmpw_offs >= vlen)
     {
	if (stat != 1) printf("Not a legal struct? (negative lengths)\n");
	return(NULL);
     }

   /* Offsets in top of struct is relative to end of pointers, adjust */
   username_offset += 0xCC;
   fullname_offset += 0xCC;
   comment_offset += 0xCC;
   homedir_offset += 0xCC;
   ntpw_offs += 0xCC;
   lmpw_offs += 0xCC;
   
   cheap_uni2ascii(vp + username_offset,username,username_len);
   cheap_uni2ascii(vp + fullname_offset,fullname,fullname_len);
   cheap_uni2ascii(vp + comment_offset,comment,comment_len);
   cheap_uni2ascii(vp + homedir_offset,homedir,homedir_len);
   
#if 0
   if (!rid) {
      printf("No RID supplied, doing some magic to find it.\n");
      ridofs = find_in_buf(buf, magic,3, 0);
      if (!ridofs || ridofs > vlen) {
	 printf("No RID found in struct..\n");
	 rid = 0;
      } else {
	 rid = get_int(buf+ridofs+0x1e);
      }
   }
#endif

#if 0
   /* Reset hash-lengths to 16 if syskey has been reset */
   if (syskeyreset && ntpw_len > 16 && !stat) {
     ntpw_len = 16;
     lmpw_len = 16;
     ntpw_offs -= 4;
     (unsigned int)*(vp+0xa8) = ntpw_offs - 0xcc;
     *(vp + 0xa0) = 16;
     *(vp + 0xac) = 16;
   }
#endif
   if (stat) {
      printf("RID: %04x, Username: <%s>%s\n",
	     rid, username,  ( !rid ? ", account locked?" : (ntpw_len < 16) ? ", *BLANK password*" : "")  );
      return(username);
   }

   printf("RID     : %04d [%04x]\n",rid,rid);
   printf("Username: %s\n",username);
   printf("fullname: %s\n",fullname);
   printf("comment : %s\n",comment);
   printf("homedir : %s\n\n",homedir);
   
   if (ntpw_len < 16) {
      printf("** This user _probably_ has a BLANK password! (Unable to change it, let NT do it instead :)\n\n");
      return(0);
   }
   
   if (!rid) {
     printf("No RID given. Unable to change passwords..\n");
     return(0);
   }
   
   hexprnt("Crypted NT pw: ",(vp+ntpw_offs),16);
   hexprnt("Crypted LM pw: ",(vp+lmpw_offs),16);

   /* Get the two decrpt keys. */
   sid_to_key1(rid,(unsigned char *)deskey1);
   des_set_key((des_cblock *)deskey1,ks1);
   sid_to_key2(rid,(unsigned char *)deskey2);
   des_set_key((des_cblock *)deskey2,ks2);
   
   /* Decrypt the NT md4 password hash as two 8 byte blocks. */
   des_ecb_encrypt((des_cblock *)(vp+ntpw_offs ),
		   (des_cblock *)md4, ks1, DES_DECRYPT);
   des_ecb_encrypt((des_cblock *)(vp+ntpw_offs + 8),
		   (des_cblock *)&md4[8], ks2, DES_DECRYPT);

   /* Decrypt the lanman password hash as two 8 byte blocks. */
   des_ecb_encrypt((des_cblock *)(vp+lmpw_offs),
		   (des_cblock *)lanman, ks1, DES_DECRYPT);
   des_ecb_encrypt((des_cblock *)(vp+lmpw_offs + 8),
		   (des_cblock *)&lanman[8], ks2, DES_DECRYPT);
   
   
   hexprnt("MD4 hash     : ",md4,16);
   hexprnt("LANMAN hash  : ",lanman,16);
   
   pl = fmyinput("\nPlease enter new password\nor nothing to leave unchanged: ",newp,16);
   
   /*   printf("password: [%s] have length %d\n",newp,pl); */

   if (!pl) { printf("Nothing changed.\n"); return(0); }
   
   cheap_ascii2uni(newp,newunipw,pl);
   
   make_lanmpw(newp,newlanpw,pl);

   /*   printf("Ucase Lanman: %s\n",newlanpw); */
   
   MD4Init (&context);
   MD4Update (&context, newunipw, pl<<1);
   MD4Final (digest, &context);
   
   hexprnt("\nNEW MD4 hash    : ",digest,16);
   
   E1(newlanpw,   x1, lanman);
   E1(newlanpw+7, x1, lanman+8);
   
   hexprnt("NEW LANMAN hash : ",lanman,16);
   
   /* Encrypt the NT md4 password hash as two 8 byte blocks. */
   des_ecb_encrypt((des_cblock *)digest,
		   (des_cblock *)despw, ks1, DES_ENCRYPT);
   des_ecb_encrypt((des_cblock *)(digest+8),
		   (des_cblock *)&despw[8], ks2, DES_ENCRYPT);

   des_ecb_encrypt((des_cblock *)lanman,
		   (des_cblock *)newlandes, ks1, DES_ENCRYPT);
   des_ecb_encrypt((des_cblock *)(lanman+8),
		   (des_cblock *)&newlandes[8], ks2, DES_ENCRYPT);

      
   hexprnt("NEW DES crypt   : ",despw,16);
   hexprnt("NEW LANMAN crypt: ",newlandes,16);
  
   fmyinput("\nDo you really wish to change it? (y/n) [n] ",yn,2);

   /* Reset hash length to 16 if syskey enabled, this will cause
    * a conversion to syskey-hashes upon next boot */
   if (syskeyreset && ntpw_len > 16) {
     ntpw_len = 16;
     lmpw_len = 16;
     ntpw_offs -= 4;
     (unsigned int)*(vp+0xa8) = ntpw_offs - 0xcc;
     *(vp + 0xa0) = 16;
     *(vp + 0xac) = 16;
   }

   if (*yn == 'y') {
      for (i = 0; i < 16; i++) {