Attached are two VBS scripts. One lists all users and aliases, the other
will descript the specified account password. You can combine them to get a
dump of all accounts and passwords.
Darin.
----- Original Message -----
From: "John Doyle" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Wednesday, August 23, 2006 4:42 PM
Subject: RE: [Declude.JunkMail] Gateway question
Sandy
I'm looking for something to extract to a file, will this do it?
John
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
Sanford Whiteman
Sent: Wednesday, August 23, 2006 12:04 PM
To: John Doyle
Subject: Re: [Declude.JunkMail] Gateway question
> I know this has come up in the past several times, but I'm looking
> for a recommendation by someone who has actually used it.
Well, I've used it. Though I did write it. :)
The free ldap2aliases script in my sig is designed to sync IMail users
and aliases on one server into corresponding aliases on an upstream
(IMail) MX.
--Sandy
------------------------------------
Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]
SpamAssassin plugs into Declude!
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release
/
Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
http://www.imprimia.com/products/software/freeutils/exchange2aliases/downloa
d/release/
http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/re
lease/
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer
& "\root\default:StdRegProv")
strKeyPath = "Software\Ipswitch\IMail\Domains"
' List the Domain keys
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
For Each subkey In arrSubKeys
If left(subkey,8) <> "$virtual" Then
' Find the domains keys with a Users key
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath & "\" & subkey, arrSubKeys2
If not isnull(arrSubKeys2) Then
For Each subkey2 In arrSubKeys2
If subkey2 = "Users" Then
StdOut.WriteLine "Domain: " & subkey
' List the users
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath & "\" & subkey &
"\Users", arrSubKeys3
If not isnull(arrsubkeys3) Then
For each subkey3 in arrSubKeys3
If subkey3 <> "_aliases" and subkey3 <> "root" Then
StdOut.Write " " & subkey3
' Are they admins?
strValueName = "Flags"
oReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath & "\" &
subkey & "\Users" & "\" & subkey3, strValueName, dwValue
'bitHostAdmin = dwValue AND 0x100
If (dwValue AND &H100) Then StdOut.Write " (Host Admin)"
If (dwValue AND &H200) Then StdOut.Write " (Imail Admin)"
If (dwValue AND &H400) Then StdOut.Write " (List Admin)"
StdOut.WriteLine
End If
Next
End If
' List the aliases
oReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath & "\" & subkey &
"\Users\_aliases", arrValueNames, arrValueTypes
If not isnull(arrValueNames) Then
For i = 0 to UBound(arrValueNames)
' If ValueName <> "postmaster" Then
oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\" &
subkey & "\Users\_aliases", arrValueNames(i), strValue
StdOut.Write " " & arrValueNames(i) & " (alias -> " & strValue
& ")"
StdOut.WriteLine
Next
End If
End If
Next
End If
End If
Next
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
option explicit
Dim WshShell, objArgs, domain, username, passwordEncrypted, password
Dim count, characterU, characterP, asciiU, asciiTotal, asciiP, tempnumber1,
tempNumber2
Dim uCount, emailAddress, splitemail
set objArgs = WScript.Arguments
Set WshShell = WScript.CreateObject("WScript.Shell")
emailAddress = lcase(trim(objArgs(0)))
splitEmail = split(emailAddress,"@")
username = splitEmail(0)
domain = splitEmail(1)
passwordEncrypted = WshShell.RegRead("HKLM\Software\IPSwitch\IMail\Domains\" &
domain & "\Users\" & username & "\Password")
count = 1
Ucount = count
password = ""
do until (count * 2) > len(passwordEncrypted)
characterU = right(left(username, Ucount),1)
characterP = right(left(passwordEncrypted, count * 2), 2)
tempNumber1 = left(characterP, 1)
select case left(characterP, 1)
case "A"
tempNumber1 = 10
case "B"
tempNumber1 = 11
case "C"
tempNumber1 = 12
case "D"
tempNumber1 = 13
case "E"
tempNumber1 = 14
case "F"
tempNumber1 = 15
end select
tempNumber2 = right(characterP, 1)
select case right(characterP, 1)
case "A"
tempNumber2 = 10
case "B"
tempNumber2 = 11
case "C"
tempNumber2 = 12
case "D"
tempNumber2 = 13
case "E"
tempNumber2 = 14
case "F"
tempNumber2 = 15
end select
asciiTotal = (16 * tempNumber1) + tempNumber2
asciiU = asc(characterU)
asciiP = asciiTotal - asciiU
password = password & chr(asciiP)
count = count + 1
if Ucount = len(username) then
Ucount = 1
else
Ucount = Ucount + 1
end if
loop
Wscript.echo password
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
