调戏系列，从上次的硬断梗之后，很久没有更新，今天更新的梗有2个，不过合并成一个了。
第一个：
局域网检测，只是用来检测局域网规模，主要代码从MSDN上复制而来，没啥特别的东西，只是用来举个例子。使用netapi探测局域网主机而已（TODO：进一步完善则是在探测到之后进行连接特定的端口进行某些特殊的确认——类似IDA的局域网授权检测，but IDA的授权检测是广播模式）。

#include "stdafx.h"
#include <windows.h>
#include <WinNetWk.h>
#include <stdio.h>
#include <Shlwapi.h>
#pragma comment(lib,"shlwapi.lib")
#pragma comment(lib,"mpr.lib")

BOOL WINAPI EnumerateFunc(LPNETRESOURCE lpnr);
void DisplayStruct(int i, LPNETRESOURCE lpnrLocal);
ULONG m_Count=0;
int _tmain(int argc, _TCHAR* argv[])
{

	LPNETRESOURCE lpnr = NULL;
	printf("运行局域网扫描将占用你的一部分时间，请稍等\r\n");
	if (EnumerateFunc(lpnr) == FALSE) {
		printf("Call to EnumerateFunc failed\n");
		return 1;
	}
	else
	{
		printf("\n扫描结束\n总共发现主机数量：%d\n按任意键退出\r\n",m_Count);
		system("PAUSE");
		return 0;
	}
}

BOOL WINAPI EnumerateFunc(LPNETRESOURCE lpnr)
{
	DWORD dwResult, dwResultEnum;
	HANDLE hEnum;
	DWORD cbBuffer = 16384;     // 16K is a good size
	DWORD cEntries = -1;        // enumerate all possible entries
	LPNETRESOURCE lpnrLocal;    // pointer to enumerated structures
	DWORD i;
	//
	// Call the WNetOpenEnum function to begin the enumeration.
	//
	dwResult = WNetOpenEnum(RESOURCE_GLOBALNET, // all network resources
		RESOURCETYPE_ANY,   // all resources
		0,  // enumerate all resources
		lpnr,       // NULL first time the function is called
		&hEnum);    // handle to the resource

	if (dwResult != NO_ERROR) {
		//printf("WnetOpenEnum failed with error %d\n", dwResult);
		return FALSE;
	}
	//
	// Call the GlobalAlloc function to allocate resources.
	//
	lpnrLocal = (LPNETRESOURCE) GlobalAlloc(GPTR, cbBuffer);
	if (lpnrLocal == NULL) {
		//printf("WnetOpenEnum failed with error %d\n", dwResult);
		//      NetErrorHandler(hwnd, dwResult, (LPSTR)"WNetOpenEnum");
		return FALSE;
	}

	do {
		//
		// Initialize the buffer.
		//
		ZeroMemory(lpnrLocal, cbBuffer);
		//
		// Call the WNetEnumResource function to continue
		//  the enumeration.
		//
		dwResultEnum = WNetEnumResource(hEnum,  // resource handle
			&cEntries,      // defined locally as -1
			lpnrLocal,      // LPNETRESOURCE
			&cbBuffer);     // buffer size
		//
		// If the call succeeds, loop through the structures.
		//
		if (dwResultEnum == NO_ERROR) {
			for (i = 0; i < cEntries; i++) {
				// Call an application-defined function to
				//  display the contents of the NETRESOURCE structures.
				//
				DisplayStruct(i, &lpnrLocal[i]);

				// If the NETRESOURCE structure represents a container resource, 
				//  call the EnumerateFunc function recursively.

				if (RESOURCEUSAGE_CONTAINER == (lpnrLocal[i].dwUsage
					& RESOURCEUSAGE_CONTAINER))

					EnumerateFunc(&lpnrLocal[i]);
				
			}
		}
		// Process errors.
		//
		else if (dwResultEnum != ERROR_NO_MORE_ITEMS) {
			break;
		}
	}
	//
	// End do.
	//
	while (dwResultEnum != ERROR_NO_MORE_ITEMS);
	//
	// Call the GlobalFree function to free the memory.
	//
	GlobalFree((HGLOBAL) lpnrLocal);
	//
	// Call WNetCloseEnum to end the enumeration.
	//
	dwResult = WNetCloseEnum(hEnum);

	if (dwResult != NO_ERROR) {

		return FALSE;
	}

	return TRUE;
}

void DisplayStruct(int i, LPNETRESOURCE lpnrLocal)
{
	if (lpnrLocal->lpRemoteName!=NULL
		&&_tcsstr(lpnrLocal->lpRemoteName,_T("\\\\"))!=NULL)
	{
		printf("发现主机 %S\n",lpnrLocal->lpRemoteName);
		if(_tcsstr(&lpnrLocal->lpRemoteName[2],_T("\\"))==NULL)
			InterlockedIncrement(&m_Count);
	}
}

[培训]科锐逆向工程师培训第53期2025年7月8日开班！