4) samsrv!SampGetCurrentAdminPassword()

用IDA Pro逆向英文版XP SP1的samsrv!SampGetCurrentAdminPassword:

下面是C风格的伪代码:

--------------------------------------------------------------------------
/*
 * 标号SampUpdateEncryption_exit不直接对应汇编代码中的标号
 *
 * 由主调函数确保第一形参UserInfoBuf不为NULL
 */
NTSTATUS __stdcall SampGetCurrentAdminPassword
(
    PSAM_USER_OWF_PASSWORD_INFORMATION  UserInfoBuf                 // 第01形参，[EBP+0x008]
)
{
    PSAM_USER_OWF_PASSWORD_INFORMATION  UserOWFPasswordInfo;        // 第01个局部变量，[EBP-0x004]
    NTSTATUS                            status;                     // 第02个局部变量，[EBP-0x008]
    HANDLE                              UserHandle;                 // 第03个局部变量，[EBP-0x00C]
    HANDLE                              DomainHandle;               // 第04个局部变量，[EBP-0x010]
    /*
     * typedef struct _POLICY_ACCOUNT_DOMAIN_INFO
     * {
     *     LSA_UNICODE_STRING  DomainName;
     *     PSID                DomainSid;
     * } POLICY_ACCOUNT_DOMAIN_INFO, *PPOLICY_ACCOUNT_DOMAIN_INFO;
     */
    PPOLICY_ACCOUNT_DOMAIN_INFO         PolicyAccountDomainInfo;    // 第05个局部变量，[EBP-0x014]
    HANDLE                              SamHandle;                  // 第06个局部变量，[EBP-0x018]

    PolicyAccountDomainInfo = ( PPOLICY_ACCOUNT_DOMAIN_INFO )NULL;
    UserOWFPasswordInfo     = ( PSAM_USER_OWF_PASSWORD_INFORMATION )NULL;
    SamHandle               = ( HANDLE )NULL;
    DomainHandle            = ( HANDLE )NULL;
    UserHandle              = ( HANDLE )NULL;
    status                  = SamIConnect
                              (
                                  0,
                                  &SamHandle,   // [out]参数
                                  0x10000000,   // Access Mask，参SamrConnect2()的Ethereal解码
                                  1
                              );
    if ( !NT_SUCCESS( status ) )
    {
        goto SampGetCurrentAdminPassword_exit;
    }
    /*
     * 隐式动态分配空间，需要释放！
     */
    status                  = SampGetAccountDomainInfo
                              (
                                  &PolicyAccountDomainInfo
                              );
    if ( !NT_SUCCESS( status ) )
    {
        goto SampGetCurrentAdminPassword_exit;
    }
    status                  = SamrOpenDomain
                              (
                                  SamHandle,
                                  0x10000000,                           // Access Mask，参Ethereal解码
                                  PolicyAccountDomainInfo->DomainSid,
                                  &DomainHandle                         // [out]参数
                              );
    if ( !NT_SUCCESS( status ) )
    {
        goto SampGetCurrentAdminPassword_exit;
    }
    status                  = SamrOpenUser
                              (
                                  DomainHandle,
                                  0x10000000,       // Access Mask，参Ethereal解码
                                  500,              // RID，0x1F4，Administrator
                                  &UserHandle       // [out]参数
                              );
    if ( !NT_SUCCESS( status ) )
    {
        goto SampGetCurrentAdminPassword_exit;
    }
    /*
     * 隐式动态分配空间，需要释放！
     */
    status                  = SamrQueryInformationUser2
                              (
                                  UserHandle,
                                  SamUserOWFPasswordInformation,    // InformationClass，0x12
                                  &UserOWFPasswordInfo
                              );
    if ( !NT_SUCCESS( status ) )
    {
        goto SampGetCurrentAdminPassword_exit;
    }
    /*
     * 这里居然没有动用SEH机制进行保护，不可思议，想必在外圈另有保护吧。
     */
    CopyMemory
    (
        UserInfoBuf,                                    // dst
        UserOWFPasswordInfo,                            // src
        sizeof( SAM_USER_OWF_PASSWORD_INFORMATION )     // 35个字节
    );
    /*
     * 安全起见，对用过的敏感数据缓冲区清零。
     */
    ZeroMemory
    (
        UserOWFPasswordInfo,
        sizeof( SAM_USER_OWF_PASSWORD_INFORMATION )     // 35个字节
    );

SampGetCurrentAdminPassword_exit:

    if ( NULL != UserOWFPasswordInfo )
    {
        /*
         * 与SamrQueryInformationUser2()配对
         */
        SamIFree_SAMPR_USER_INFO_BUFFER
        (
            UserOWFPasswordInfo,
            SamUserOWFPasswordInformation   // InformationClass，0x12
        );
    }
    if ( NULL != UserHandle )
    {
        /*
         * 与SamrOpenUser()配对
         */
        SamrCloseHandle( &UserHandle );
    }
    if ( NULL != DomainHandle )
    {
        /*
         * 与SamrOpenDomain()配对
         */
        SamrCloseHandle( &DomainHandle );
    }
    if ( NULL != PolicyAccountDomainInfo )
    {
        /*
         * 与SampGetAccountDomainInfo()配对
         */
        LsaIFree_LSAPR_POLICY_INFORMATION
        (
            PolicyAccountDomainInformation,     // PolicyAccountDomainInformation(5)，枚举值
            PolicyAccountDomainInfo
        );
    }
    if ( NULL != SamHandle )
    {
        /*
         * 与SamIConnect()配对
         */
        SamrCloseHandle( &SamHandle );
    }
    return( status );
}  /* end of SampGetCurrentAdminPassword */
--------------------------------------------------------------------------

将SampUpdateEncryption、SampGetCurrentAdminPassword结合一下，获取LM Hash、
NTLM Hash的流程跃然纸上。