Local System 权限读取用户IE 代理设置的研究及简单HTTP代理验证

#include "windows.h"
#include "stdio.h"
#include "string.h"
//#include "winsock2.h"
//#include "wininet.h"

#pragma comment (lib,"ws2_32")

void LogToFile(char *LogText);

//有ProxyServer键值就取回来返回true，否则返回false;
bool CheckProxySetting(char * subkey,struct ProxyData * pCurrent);

//check proxyserver connection status
bool CheckProxyConnection(struct ProxyData * head);

//test http conn to either the proxy server or ditect the web server.
bool CheckHTTPconnction(char *hostname,int port,char * req,char * key);

//check intranet connection status
bool CheckIntranetConn();

struct ProxyData
{
 char pServer[128];
 int  pPort;
 ProxyData * pdNext;
};


void main()
{
 /*
 //使用wininet函数在system权限下是没有办法获得正确的结果的，另外，还存在另外一种情况，
 //就是没有勾选"使用代理服务器访问网络"的时候Internet Setting子键里面一样有Proxy Server的值，
 //这种情况存在的概率是相当大的，因为很多用户并不会用bypass设置来同时访问内外网，要访问内网就
 //关掉上面的勾选。读取注册表键理论上可以有效减少漏报。

//同样要解决system权限下current_user键没有办法使用的问题，测试的时候使用psu在system权限下看到
 //current_user里面的确没有信息，但是在HEKY_USERS/S-1-5-21-1935655697-725345543-839522115-500/
 //下面却有相应的信息。回到administrators权限下还是/S-1-5-21-1935655697-725345543-839522115-500/
 //有了下面枚举子键的想法。尝试中。

 INTERNET_PROXY_INFO *pIEinfo = NULL;
 DWORD dwSize = 0;
 BOOL bRet = InternetQueryOption(NULL, INTERNET_OPTION_PROXY, pIEinfo, &dwSize);
 pIEinfo = (INTERNET_PROXY_INFO*)new char[dwSize];
 bRet = InternetQueryOption(NULL, INTERNET_OPTION_PROXY, pIEinfo, &dwSize);
 LogToFile((char *)(pIEinfo+1));
 printf("/nResult:%s",pIEinfo+1);
 */

 int  index=0;
 char keyBuff[256]={0};
 DWORD dwSize=sizeof(keyBuff);
 struct ProxyData *p,*q,*head;
 char *got=NULL;
 bool succ=false;

 head=NULL;
 p=NULL;
 q=NULL;

 while(RegEnumKeyEx(HKEY_USERS,index,keyBuff,&dwSize,NULL,NULL,NULL,NULL)!=ERROR_NO_MORE_ITEMS)
 {
  printf("/nSubkey: %s",keyBuff);
  //LogToFile(keyBuff);

  //handle the result we have got
  if((strstr(keyBuff,"DEFAULT")==NULL)&&(strstr(keyBuff,"Classes")==NULL)) //we can only find right result in de key like xxxxx-xxx,experience from my test.
  {
   q=(struct ProxyData *)GlobalAlloc(GMEM_ZEROINIT,sizeof(struct ProxyData));   
   if(q == NULL)
   {
    printf("/nAllocate memory error!");
    return;
   }
   q->pdNext=NULL;

   if(CheckProxySetting(keyBuff,q))//once we got a result,the answer is success.
   {
    if(head!=NULL)
    {
     p->pdNext=q;
    }
    else
    {
     head=q;
    }
    p=q;
    succ=true;
   }
  }
  
  index++;
  memset(keyBuff,0,sizeof(keyBuff));
  dwSize=sizeof(keyBuff);
 }

 //test
 //CheckProxyConnection(head);
 CheckIntranetConn();

 //=================================
 //释放掉
 
 if(head != NULL)
 {
  q=p=head;  
  while(1)
  {
   printf("/nGlobalFree happen once!");
   q=p->pdNext;
   GlobalFree(p);
   if(q==NULL)
   {
    break;
   }
   p=q;
  }
 }
 //=================================
 /*if(succ)
 {
  printf("/nit seems that we have got the result.");
  return;
 }
 else
 {
  printf("/n!:( Bad luck!");
  return;
 }*/

}

//有ProxyServer键值就取回来返回true，否则返回false;
bool CheckProxySetting(char * subkey,ProxyData * pCurrent)
{
 char *path = "Software//Microsoft//Windows//CurrentVersion//Internet Settings";
 char *key = "ProxyServer";
 char *token;
 char *head = "http=";
 char *seps = ":";
 char *segs = ";";
 char buff[512] = {0};
 //struct hostent * hp=NULL;
 HKEY hResult;
 DWORD lpcbData;

 lpcbData=sizeof(buff);
 lstrcat(subkey,"//");
 lstrcat(subkey,path);//coherent
 //printf("/nsubkey formed:%s",subkey);

 LONG lFlag = RegOpenKeyEx( HKEY_USERS,subkey, NULL,KEY_ALL_ACCESS, &hResult);
 if(lFlag == ERROR_SUCCESS)
 {   
  lFlag = RegQueryValueEx(hResult, key, NULL, NULL, (LPBYTE)buff, &lpcbData);
  if(lFlag == ERROR_SUCCESS)
  {
   printf("/nbuffer:%s",buff);
   lFlag = RegCloseKey(hResult);
   if(lFlag != ERROR_SUCCESS)
   {
    printf("Close Registry Key: %s Failed!/n", subkey);
   }

   //*(buff+lpcbData+1)=0;//end the string with 0.may be no need.
   token = NULL;
   token = strstr(buff,head);
   if(token == NULL)//the address is like "10.10.10.10:8080" or "server:888" form.
   {
    token=strstr(buff,seps);
    if(token != NULL)
    {
     *token = 0; //break up the string.
     strcpy(pCurrent->pServer,buff);
     printf("/nTry:%s",pCurrent->pServer);
     pCurrent->pPort=atoi(token+1);
     printf("/npPort:%d",pCurrent->pPort);
    }
    else
    {
     GlobalFree(pCurrent);
     return false;
    }
   }
   else //address like "ftp=20.128.25.215:555;gopher=20.128.25.215:444;http=20.128.25.215:808;https=20.128.25.215:666;socks=20.128.25.215:333"
   {
    char *p = token+lstrlen(head); //at first, p point to 2 in upon example;
    token = strstr(p,segs);
    if(token != NULL)
    {
     *token = 0; //break up
    }
    token=strstr(p,seps);
    if(token != NULL)
    {
     *token = 0; //break up the string.
     strcpy(pCurrent->pServer,p);
     printf("/nTry:%s",pCurrent->pServer);
     pCurrent->pPort=atoi(token+1);
     printf("/npPort:%d",pCurrent->pPort);
    }
    else
    {
     GlobalFree(pCurrent);
     return false;
    }
   }
   // allright,if it does not return , we have got the addr,now we should resolve the addr to IP Address
   /*it seems we can't initiate the hostent derectly,so we return the string.  
   __try
   {    
    *pCurrent->server.sin_family = AF_INET;
    *pCurrent->server.sin_port = htons(atoi(port));
    *pCurrent->server.sin_addr.s_addr = inet_addr(addr);
    if(*pCurrent->server.sin_addr.s_addr == INADDR_NONE)//like www.sina.com form
    {
     hp = gethostbyname(addr);
     if (hp == NULL)
     {
      GlobalFree(pCurrent);
      pCurrent=NULL;
      printf("Can't resolve target address:[%s]./n",addr);
      return false;
     }
     memcpy(&(*pCurrent->server.sin_addr), hp->h_addr_list[0],hp->h_length);
    }
    //*pCurrent->pdNext=NULL;
    printf("/naddress we got:%s,port:%s.",addr,port);
    return true; //it's time to return,we have got the right result.
   }
   __finally
   {
    GlobalFree(pCurrent);
    pCurrent=NULL;
    return false;
   }*/
  }
  else
  {
   printf("/nQuery Registry Value: %s Failed!", key);
   lFlag = RegCloseKey(hResult);
   if(lFlag != ERROR_SUCCESS)
   {
    printf("/nClose Registry Key: %s Failed!", subkey);
    return false;
   }
   GlobalFree(pCurrent);
   return false;
  }
 }
 else
 {
  printf("Open Registry Key: %s Failed!/n",subkey);
  GlobalFree(pCurrent);
  return false;
 }
 return true;
}

void LogToFile(char *LogText)
{
 FILE *fp;
 SYSTEMTIME lpTime;
 char * LogFileName="c://log.txt";
 fp = fopen(LogFileName, "a+");
 if(fp)
 {
  GetSystemTime(&lpTime);
  fprintf(fp,"Performing Time: %d/%d/%d %d:%d:%d --> %s", lpTime.wMonth,lpTime.wDay,lpTime.wYear,lpTime.wHour,lpTime.wMinute,lpTime.wSecond,LogText);
  fclose(fp);
 }
}

//this function is used to check the proxy connection status.
//As the HKEY_USERS reg branch may have more users' information , that we may got more proxy information.
//We should test all the proxy we have got.
bool CheckProxyConnection(struct ProxyData * p)
{
 struct ProxyData * head=p;
 char* req = "GET http://www.baidu.com/ HTTP/1.0/r/n"
    "Accept: */*/r/n"
    "Accept-Language: zh-cn/r/n"
    "Pragma: no-cache/r/n"
    "If-Modified-Since: Wed, 05 Apr 2006 10:25:00 GMT/r/n"
    "If-None-Match: /"28986d-b53-44339afc/"/r/n"
    "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)/r/n"
    "Host: www.baidu.com/r/n"
    "Proxy-Connection: Keep-Alive/r/n"
    "Cookie: BAIDUID=F4138A121665C89084A8E99FD286D7B4/r/n/r/n";

 char *key = "百度——全球最大中文搜索引擎";

 
 while(head!=NULL)
 {
  if(CheckHTTPconnction(head->pServer,head->pPort,req,key))
  {
   return true;
  }
  head=head->pdNext;
 }
 printf("/nWe failed!");
 return false;
 
}

bool CheckHTTPconnction(char *hostname,int port,char * req,char * key)
{
 SOCKADDR_IN  saServer;
LPHOSTENT  lphostent;
WSADATA   wsadata;
unsigned short winsock_version;
SOCKET   hsocket;
int    nRet;

winsock_version = MAKEWORD( 2,0 );
if(WSAStartup(winsock_version,&wsadata))
{
printf("/ncan't initial socket");
return false;
}
lphostent=gethostbyname(hostname);

if(lphostent==NULL)
{
printf("/nlphostent is null");
  WSACleanup();
return false;
}

hsocket = socket(AF_INET, SOCK_STREAM, 0);
saServer.sin_family = AF_INET;
// Use def. now, need to handle general case
saServer.sin_port = htons(port);
saServer.sin_addr = *((LPIN_ADDR)*lphostent->h_addr_list);
nRet = connect(hsocket, (LPSOCKADDR)&saServer, sizeof(SOCKADDR_IN));
if (nRet == SOCKET_ERROR)
{
printf("/ncan't connect");
closesocket(hsocket);
  WSACleanup();
return false;
}
else
 {
printf("/nconnected with %s",hostname);
 }

nRet = send(hsocket, req, strlen(req), 0);
if (nRet == SOCKET_ERROR)
{
printf("/nsend() failed");
closesocket(hsocket);
  WSACleanup();
return false;
}
else
 {
printf("/nsend() OK");
 }

char dest[2048];
 int index=0;
nRet=1;
while(index<3&&nRet>0) //normally we use "<title>" section to check connection status, so it's not necessary to recive all size of the destination document.
{
  index++;
nRet=recv(hsocket,(LPSTR)dest,sizeof(dest),0);
if(nRet>0)
dest[nRet]=0;
else
dest[0]=0;
printf("/nReceived bytes:%d",nRet);
printf("/nResult:/n%s",dest);
  if(strstr(dest,key))
  {
   printf("/nWe got it!");
   closesocket(hsocket);
   WSACleanup();
   return true;
   
  }
}
 printf("/nBad luck :~( !");
 closesocket(hsocket);
 WSACleanup();
return false;
}


bool CheckIntranetConn()
{
 char* req = "GET / HTTP/1.1/r/n"
    "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*/r/n"
    "Accept-Language: zh-cn/r/n"
    "Accept-Encoding: gzip, deflate/r/n"
    "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)/r/n"
    "Host: 10.128.4.34/r/n"
    "Connection: Keep-Alive/r/n/r/n";

 char *key = "铁叉部";
 char *des = "10.128.4.34";
 int  dPort= 80;

 return CheckHTTPconnction(des,dPort,req,key);
}