Delete all network connections

>> Friday, October 16, 2009


The process of logging off Windows is certainly complex ( I will describe in other articles ). Now a part of this process is deleting all network connections of

the current user.
All secrets here 're inside 4 functions of module mpr.dll. Look into the code for more information.


BOOL
DeleteNetworkConnections(
PGLOBALS pGlobals
)
{
HANDLE ImpersonationHandle;
DWORD WNetResult;
BOOL Result = FALSE; // Default is failure
TCHAR szMprDll[] = TEXT("mpr.dll");
CHAR szWNetNukeConn[] = "WNetClearConnections";
CHAR szWNetOpenEnum[] = "WNetOpenEnumW";
CHAR szWNetEnumResource[] = "WNetEnumResourceW";
CHAR szWNetCloseEnum[] = "WNetCloseEnum";
PWNETNUKECONN lpfnWNetNukeConn = NULL;
PWNETOPENENUM lpfnWNetOpenEnum = NULL;
PWNETENUMRESOURCE lpfnWNetEnumResource = NULL;
PWNETCLOSEENUM lpfnWNetCloseEnum = NULL;
HWND hNetDelDlg;
HANDLE hEnum;
BOOL bConnectionsExist = TRUE;
NETRESOURCE NetRes;
DWORD dwNumEntries = 1;
DWORD dwEntrySize = sizeof (NETRESOURCE);

//
// Impersonate the user
//

ImpersonationHandle = ImpersonateUser(&pGlobals->UserProcessData, NULL);

//
// Load mpr if it wasn't already loaded.
//

if (!pGlobals->hMPR){
pGlobals->hMPR = LoadLibrary(szMprDll));
}

//
// Get the function pointers
//

lpfnWNetOpenEnum = (PWNETOPENENUM) GetProcAddress(pGlobals->hMPR,
(LPSTR)szWNetOpenEnum);
lpfnWNetEnumResource = (PWNETENUMRESOURCE) GetProcAddress(pGlobals->hMPR,
(LPSTR)szWNetEnumResource);
lpfnWNetCloseEnum = (PWNETCLOSEENUM) GetProcAddress(pGlobals->hMPR,
(LPSTR)szWNetCloseEnum);
lpfnWNetNukeConn = (PWNETNUKECONN) GetProcAddress(pGlobals->hMPR,
(LPSTR)szWNetNukeConn);


if ( (*lpfnWNetOpenEnum)(RESOURCE_CONNECTED, RESOURCETYPE_ANY,
0, NULL, &hEnum) == NO_ERROR) {

if ((*lpfnWNetEnumResource)(hEnum, &dwNumEntries, &NetRes,
&dwEntrySize) == ERROR_NO_MORE_ITEMS) {
bConnectionsExist = FALSE;
}

(*lpfnWNetCloseEnum)(hEnum);
}

//
// If we don't have any connections, then we can exit.
//

if (!bConnectionsExist) {
goto DNCExit;
}

//
// Delete the network connections.
//
(*lpfnWNetNukeConn)(NULL);

DNCExit:

//
// Unload mpr.dll
//

if ( pGlobals->hMPR ) {
FreeLibrary(pGlobals->hMPR);
pGlobals->hMPR = NULL;
}

//
// Revert to being 'ourself'
//

StopImpersonating(ImpersonationHandle);
return(Result);
}

0 comments: