?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libgpo/security_CSE: fix unicode preamble check of SecEdit/GptTmpl.inf files.
[Samba.git] / source3 / rpcclient / cmd_lsarpc.c
blob9117ce655976c240b2784424d48796f6ecf72f6c
1 /*
2 Unix SMB/CIFS implementation.
3 RPC pipe client
4
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
7 Copyright (C) Guenther Deschner 2008
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpcclient.h"
25 #include "../libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_lsa.h"
27 #include "../librpc/gen_ndr/ndr_lsa_c.h"
28 #include "rpc_client/cli_lsarpc.h"
29 #include "rpc_client/init_lsa.h"
30 #include "../libcli/security/security.h"
31
32 /* useful function to allow entering a name instead of a SID and
33 * looking it up automatically */
34 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
35 TALLOC_CTX *mem_ctx,
36 struct dom_sid *sid, const char *name)
37 {
38 struct policy_handle pol;
39 enum lsa_SidType *sid_types;
40 NTSTATUS status, result;
41 struct dom_sid *sids;
42 struct dcerpc_binding_handle *b = cli->binding_handle;
43
44 /* maybe its a raw SID */
45 if (strncmp(name, "S-", 2) == 0 &&
46 string_to_sid(sid, name)) {
47 return NT_STATUS_OK;
48 }
49
50 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
51 SEC_FLAG_MAXIMUM_ALLOWED,
52 &pol);
53 if (!NT_STATUS_IS_OK(status))
54 goto done;
55
56 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
57 if (!NT_STATUS_IS_OK(status))
58 goto done;
59
60 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
61
62 *sid = sids[0];
63
64 done:
65 return status;
66 }
67
68 static void display_query_info_1(struct lsa_AuditLogInfo *r)
69 {
70 d_printf("percent_full:\t%d\n", r->percent_full);
71 d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
72 d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
73 d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
74 d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
75 d_printf("next_audit_record:\t%d\n", r->next_audit_record);
76 }
77
78 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
79 {
80 int i;
81 d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
82 d_printf("Auditing categories:\t%d\n", r->count);
83 d_printf("Auditsettings:\n");
84 for (i=0; i<r->count; i++) {
85 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
86 const char *policy = audit_description_str(i);
87 d_printf("%s:\t%s\n", policy, val);
88 }
89 }
90
91 static void display_query_info_3(struct lsa_DomainInfo *r)
92 {
93 d_printf("Domain Name: %s\n", r->name.string);
94 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
95 }
96
97 static void display_query_info_5(struct lsa_DomainInfo *r)
98 {
99 d_printf("Domain Name: %s\n", r->name.string);
100 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
101 }
102
103 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
104 {
105 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
106 }
107
108 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
109 {
110 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
111 d_printf("Log is full: %d\n", r->log_is_full);
112 }
113
114 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
115 {
116 d_printf("Domain NetBios Name: %s\n", r->name.string);
117 d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
118 d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
119 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
120 d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
121 &r->domain_guid));
122 }
123
124 static void display_lsa_query_info(union lsa_PolicyInformation *info,
125 enum lsa_PolicyInfo level)
126 {
127 switch (level) {
128 case 1:
129 display_query_info_1(&info->audit_log);
130 break;
131 case 2:
132 display_query_info_2(&info->audit_events);
133 break;
134 case 3:
135 display_query_info_3(&info->domain);
136 break;
137 case 5:
138 display_query_info_5(&info->account_domain);
139 break;
140 case 10:
141 display_query_info_10(&info->auditfullset);
142 break;
143 case 11:
144 display_query_info_11(&info->auditfullquery);
145 break;
146 case 12:
147 display_query_info_12(&info->dns);
148 break;
149 default:
150 printf("can't display info level: %d\n", level);
151 break;
152 }
153 }
154
155 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
156 TALLOC_CTX *mem_ctx, int argc,
157 const char **argv)
158 {
159 struct policy_handle pol;
160 NTSTATUS status, result;
161 union lsa_PolicyInformation *info = NULL;
162 struct dcerpc_binding_handle *b = cli->binding_handle;
163
164 uint32 info_class = 3;
165
166 if (argc > 2) {
167 printf("Usage: %s [info_class]\n", argv[0]);
168 return NT_STATUS_OK;
169 }
170
171 if (argc == 2)
172 info_class = atoi(argv[1]);
173
174 switch (info_class) {
175 case 12:
176 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
177 SEC_FLAG_MAXIMUM_ALLOWED,
178 &pol);
179
180 if (!NT_STATUS_IS_OK(status))
181 goto done;
182
183 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
184 &pol,
185 info_class,
186 &info,
187 &result);
188 break;
189 default:
190 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
191 SEC_FLAG_MAXIMUM_ALLOWED,
192 &pol);
193
194 if (!NT_STATUS_IS_OK(status))
195 goto done;
196
197 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
198 &pol,
199 info_class,
200 &info,
201 &result);
202 }
203
204 if (!NT_STATUS_IS_OK(status)) {
205 goto done;
206 }
207 status = result;
208 if (NT_STATUS_IS_OK(result)) {
209 display_lsa_query_info(info, info_class);
210 }
211
212 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
213
214 done:
215 return status;
216 }
217
218 /* Resolve a list of names to a list of sids */
219
220 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
221 TALLOC_CTX *mem_ctx, int argc,
222 const char **argv)
223 {
224 struct policy_handle pol;
225 NTSTATUS status, result;
226 struct dom_sid *sids;
227 enum lsa_SidType *types;
228 int i;
229 struct dcerpc_binding_handle *b = cli->binding_handle;
230
231 if (argc == 1) {
232 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
233 return NT_STATUS_OK;
234 }
235
236 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
237 SEC_FLAG_MAXIMUM_ALLOWED,
238 &pol);
239
240 if (!NT_STATUS_IS_OK(status))
241 goto done;
242
243 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
244 (const char**)(argv + 1), NULL, 1, &sids, &types);
245
246 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
247 NT_STATUS_V(STATUS_SOME_UNMAPPED))
248 goto done;
249
250 status = NT_STATUS_OK;
251
252 /* Print results */
253
254 for (i = 0; i < (argc - 1); i++) {
255 fstring sid_str;
256 sid_to_fstring(sid_str, &sids[i]);
257 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
258 sid_type_lookup(types[i]), types[i]);
259 }
260
261 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
262
263 done:
264 return status;
265 }
266
267 /* Resolve a list of names to a list of sids */
268
269 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
270 TALLOC_CTX *mem_ctx, int argc,
271 const char **argv)
272 {
273 struct policy_handle pol;
274 NTSTATUS status, result;
275 struct dom_sid *sids;
276 enum lsa_SidType *types;
277 int i, level;
278 struct dcerpc_binding_handle *b = cli->binding_handle;
279
280 if (argc < 3) {
281 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
282 return NT_STATUS_OK;
283 }
284
285 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
286 SEC_FLAG_MAXIMUM_ALLOWED,
287 &pol);
288
289 if (!NT_STATUS_IS_OK(status))
290 goto done;
291
292 level = atoi(argv[1]);
293
294 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
295 (const char**)(argv + 2), NULL, level, &sids, &types);
296
297 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
298 NT_STATUS_V(STATUS_SOME_UNMAPPED))
299 goto done;
300
301 status = NT_STATUS_OK;
302
303 /* Print results */
304
305 for (i = 0; i < (argc - 2); i++) {
306 fstring sid_str;
307 sid_to_fstring(sid_str, &sids[i]);
308 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
309 sid_type_lookup(types[i]), types[i]);
310 }
311
312 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
313
314 done:
315 return status;
316 }
317
318 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
319 TALLOC_CTX *mem_ctx, int argc,
320 const char **argv)
321 {
322 NTSTATUS status, result;
323
324 uint32_t num_names;
325 struct lsa_String *names;
326 struct lsa_RefDomainList *domains = NULL;
327 struct lsa_TransSidArray3 sids;
328 uint32_t count = 0;
329 int i;
330 struct dcerpc_binding_handle *b = cli->binding_handle;
331
332 if (argc == 1) {
333 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
334 return NT_STATUS_OK;
335 }
336
337 ZERO_STRUCT(sids);
338
339 num_names = argc-1;
340 names = talloc_array(mem_ctx, struct lsa_String, num_names);
341 NT_STATUS_HAVE_NO_MEMORY(names);
342
343 for (i=0; i < num_names; i++) {
344 init_lsa_String(&names[i], argv[i+1]);
345 }
346
347 status = dcerpc_lsa_LookupNames4(b, mem_ctx,
348 num_names,
349 names,
350 &domains,
351 &sids,
352 1,
353 &count,
354 0,
355 0,
356 &result);
357 if (!NT_STATUS_IS_OK(status)) {
358 return status;
359 }
360 if (!NT_STATUS_IS_OK(result)) {
361 return result;
362 }
363
364 if (sids.count != num_names) {
365 return NT_STATUS_INVALID_NETWORK_RESPONSE;
366 }
367
368 for (i = 0; i < sids.count; i++) {
369 fstring sid_str;
370 sid_to_fstring(sid_str, sids.sids[i].sid);
371 printf("%s %s (%s: %d)\n", argv[i+1], sid_str,
372 sid_type_lookup(sids.sids[i].sid_type),
373 sids.sids[i].sid_type);
374 }
375
376 return status;
377 }
378
379 /* Resolve a list of SIDs to a list of names */
380
381 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
382 int argc, const char **argv)
383 {
384 struct policy_handle pol;
385 NTSTATUS status, result;
386 struct dom_sid *sids;
387 char **domains;
388 char **names;
389 enum lsa_SidType *types;
390 int i;
391 struct dcerpc_binding_handle *b = cli->binding_handle;
392
393 if (argc == 1) {
394 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
395 return NT_STATUS_OK;
396 }
397
398 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
399 SEC_FLAG_MAXIMUM_ALLOWED,
400 &pol);
401
402 if (!NT_STATUS_IS_OK(status))
403 goto done;
404
405 /* Convert arguments to sids */
406
407 sids = talloc_array(mem_ctx, struct dom_sid, argc - 1);
408
409 if (!sids) {
410 printf("could not allocate memory for %d sids\n", argc - 1);
411 goto done;
412 }
413
414 for (i = 0; i < argc - 1; i++)
415 if (!string_to_sid(&sids[i], argv[i + 1])) {
416 status = NT_STATUS_INVALID_SID;
417 goto done;
418 }
419
420 /* Lookup the SIDs */
421
422 status = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
423 &domains, &names, &types);
424
425 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
426 NT_STATUS_V(STATUS_SOME_UNMAPPED))
427 goto done;
428
429 status = NT_STATUS_OK;
430
431 /* Print results */
432
433 for (i = 0; i < (argc - 1); i++) {
434 fstring sid_str;
435
436 sid_to_fstring(sid_str, &sids[i]);
437 if (types[i] == SID_NAME_DOMAIN) {
438 printf("%s %s (%d)\n", sid_str,
439 domains[i] ? domains[i] : "*unknown*",
440 types[i]);
441 } else {
442 printf("%s %s\\%s (%d)\n", sid_str,
443 domains[i] ? domains[i] : "*unknown*",
444 names[i] ? names[i] : "*unknown*",
445 types[i]);
446 }
447 }
448
449 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
450
451 done:
452 return status;
453 }
454
455 /* Resolve a list of SIDs to a list of names */
456
457 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
458 TALLOC_CTX *mem_ctx,
459 int argc, const char **argv)
460 {
461 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
462 int i;
463 struct lsa_SidArray sids;
464 struct lsa_RefDomainList *domains = NULL;
465 struct lsa_TransNameArray2 names;
466 uint32_t count = 0;
467 struct dcerpc_binding_handle *b = cli->binding_handle;
468
469 if (argc == 1) {
470 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
471 return NT_STATUS_OK;
472 }
473
474 ZERO_STRUCT(names);
475
476 /* Convert arguments to sids */
477
478 sids.num_sids = argc-1;
479 sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
480 if (!sids.sids) {
481 printf("could not allocate memory for %d sids\n", sids.num_sids);
482 goto done;
483 }
484
485 for (i = 0; i < sids.num_sids; i++) {
486 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
487 if (sids.sids[i].sid == NULL) {
488 status = NT_STATUS_NO_MEMORY;
489 goto done;
490 }
491 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
492 status = NT_STATUS_INVALID_SID;
493 goto done;
494 }
495 }
496
497 /* Lookup the SIDs */
498 status = dcerpc_lsa_LookupSids3(b, mem_ctx,
499 &sids,
500 &domains,
501 &names,
502 1,
503 &count,
504 0,
505 0,
506 &result);
507 if (!NT_STATUS_IS_OK(status)) {
508 goto done;
509 }
510 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
511 NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
512 status = result;
513 goto done;
514 }
515
516 status = NT_STATUS_OK;
517
518 /* Print results */
519
520 for (i = 0; i < names.count; i++) {
521 fstring sid_str;
522
523 if (i >= sids.num_sids) {
524 break;
525 }
526 sid_to_fstring(sid_str, sids.sids[i].sid);
527 printf("%s %s (%d)\n", sid_str,
528 names.names[i].name.string,
529 names.names[i].sid_type);
530 }
531
532 done:
533 return status;
534 }
535
536
537 /* Enumerate list of trusted domains */
538
539 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
540 TALLOC_CTX *mem_ctx, int argc,
541 const char **argv)
542 {
543 struct policy_handle pol;
544 NTSTATUS status, result;
545 struct lsa_DomainList domain_list;
546 struct dcerpc_binding_handle *b = cli->binding_handle;
547
548 /* defaults, but may be changed using params */
549 uint32 enum_ctx = 0;
550 int i;
551 uint32_t max_size = (uint32_t)-1;
552
553 if (argc > 2) {
554 printf("Usage: %s [enum context (0)]\n", argv[0]);
555 return NT_STATUS_OK;
556 }
557
558 if (argc == 2 && argv[1]) {
559 enum_ctx = atoi(argv[2]);
560 }
561
562 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
563 LSA_POLICY_VIEW_LOCAL_INFORMATION,
564 &pol);
565
566 if (!NT_STATUS_IS_OK(status))
567 goto done;
568
569 status = STATUS_MORE_ENTRIES;
570
571 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
572
573 /* Lookup list of trusted domains */
574
575 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
576 &pol,
577 &enum_ctx,
578 &domain_list,
579 max_size,
580 &result);
581 if (!NT_STATUS_IS_OK(status)) {
582 goto done;
583 }
584 if (!NT_STATUS_IS_OK(result) &&
585 !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
586 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
587 status = result;
588 goto done;
589 }
590
591 /* Print results: list of names and sids returned in this
592 * response. */
593 for (i = 0; i < domain_list.count; i++) {
594 fstring sid_str;
595
596 sid_to_fstring(sid_str, domain_list.domains[i].sid);
597 printf("%s %s\n",
598 domain_list.domains[i].name.string ?
599 domain_list.domains[i].name.string : "*unknown*",
600 sid_str);
601 }
602 }
603
604 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
605 done:
606 return status;
607 }
608
609 /* Enumerates privileges */
610
611 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
612 TALLOC_CTX *mem_ctx, int argc,
613 const char **argv)
614 {
615 struct policy_handle pol;
616 NTSTATUS status, result;
617 struct lsa_PrivArray priv_array;
618 struct dcerpc_binding_handle *b = cli->binding_handle;
619
620 uint32 enum_context=0;
621 uint32 pref_max_length=0x1000;
622 int i;
623
624 if (argc > 3) {
625 printf("Usage: %s [enum context] [max length]\n", argv[0]);
626 return NT_STATUS_OK;
627 }
628
629 if (argc>=2)
630 enum_context=atoi(argv[1]);
631
632 if (argc==3)
633 pref_max_length=atoi(argv[2]);
634
635 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
636 SEC_FLAG_MAXIMUM_ALLOWED,
637 &pol);
638
639 if (!NT_STATUS_IS_OK(status))
640 goto done;
641
642 status = dcerpc_lsa_EnumPrivs(b, mem_ctx,
643 &pol,
644 &enum_context,
645 &priv_array,
646 pref_max_length,
647 &result);
648 if (!NT_STATUS_IS_OK(status))
649 goto done;
650 if (!NT_STATUS_IS_OK(result)) {
651 status = result;
652 goto done;
653 }
654
655 /* Print results */
656 printf("found %d privileges\n\n", priv_array.count);
657
658 for (i = 0; i < priv_array.count; i++) {
659 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
660 priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
661 priv_array.privs[i].luid.high,
662 priv_array.privs[i].luid.low,
663 priv_array.privs[i].luid.high,
664 priv_array.privs[i].luid.low);
665 }
666
667 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
668 done:
669 return status;
670 }
671
672 /* Get privilege name */
673
674 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
675 TALLOC_CTX *mem_ctx, int argc,
676 const char **argv)
677 {
678 struct policy_handle pol;
679 NTSTATUS status, result;
680 struct dcerpc_binding_handle *b = cli->binding_handle;
681
682 uint16 lang_id=0;
683 uint16 lang_id_sys=0;
684 uint16 lang_id_desc;
685 struct lsa_String lsa_name;
686 struct lsa_StringLarge *description = NULL;
687
688 if (argc != 2) {
689 printf("Usage: %s privilege name\n", argv[0]);
690 return NT_STATUS_OK;
691 }
692
693 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
694 SEC_FLAG_MAXIMUM_ALLOWED,
695 &pol);
696
697 if (!NT_STATUS_IS_OK(status))
698 goto done;
699
700 init_lsa_String(&lsa_name, argv[1]);
701
702 status = dcerpc_lsa_LookupPrivDisplayName(b, mem_ctx,
703 &pol,
704 &lsa_name,
705 lang_id,
706 lang_id_sys,
707 &description,
708 &lang_id_desc,
709 &result);
710 if (!NT_STATUS_IS_OK(status))
711 goto done;
712 if (!NT_STATUS_IS_OK(result)) {
713 status = result;
714 goto done;
715 }
716
717 /* Print results */
718 printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
719
720 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
721 done:
722 return status;
723 }
724
725 /* Enumerate the LSA SIDS */
726
727 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
728 TALLOC_CTX *mem_ctx, int argc,
729 const char **argv)
730 {
731 struct policy_handle pol;
732 NTSTATUS status, result;
733 struct dcerpc_binding_handle *b = cli->binding_handle;
734
735 uint32 enum_context=0;
736 uint32 pref_max_length=0x1000;
737 struct lsa_SidArray sid_array;
738 int i;
739
740 if (argc > 3) {
741 printf("Usage: %s [enum context] [max length]\n", argv[0]);
742 return NT_STATUS_OK;
743 }
744
745 if (argc>=2)
746 enum_context=atoi(argv[1]);
747
748 if (argc==3)
749 pref_max_length=atoi(argv[2]);
750
751 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
752 SEC_FLAG_MAXIMUM_ALLOWED,
753 &pol);
754
755 if (!NT_STATUS_IS_OK(status))
756 goto done;
757
758 status = dcerpc_lsa_EnumAccounts(b, mem_ctx,
759 &pol,
760 &enum_context,
761 &sid_array,
762 pref_max_length,
763 &result);
764 if (!NT_STATUS_IS_OK(status))
765 goto done;
766 if (!NT_STATUS_IS_OK(result)) {
767 status = result;
768 goto done;
769 }
770
771 /* Print results */
772 printf("found %d SIDs\n\n", sid_array.num_sids);
773
774 for (i = 0; i < sid_array.num_sids; i++) {
775 fstring sid_str;
776
777 sid_to_fstring(sid_str, sid_array.sids[i].sid);
778 printf("%s\n", sid_str);
779 }
780
781 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
782 done:
783 return status;
784 }
785
786 /* Create a new account */
787
788 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
789 TALLOC_CTX *mem_ctx, int argc,
790 const char **argv)
791 {
792 struct policy_handle dom_pol;
793 struct policy_handle user_pol;
794 NTSTATUS status, result;
795 uint32 des_access = 0x000f000f;
796 struct dcerpc_binding_handle *b = cli->binding_handle;
797
798 struct dom_sid sid;
799
800 if (argc != 2 ) {
801 printf("Usage: %s SID\n", argv[0]);
802 return NT_STATUS_OK;
803 }
804
805 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
806 if (!NT_STATUS_IS_OK(status))
807 goto done;
808
809 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
810 SEC_FLAG_MAXIMUM_ALLOWED,
811 &dom_pol);
812
813 if (!NT_STATUS_IS_OK(status))
814 goto done;
815
816 status = dcerpc_lsa_CreateAccount(b, mem_ctx,
817 &dom_pol,
818 &sid,
819 des_access,
820 &user_pol,
821 &result);
822 if (!NT_STATUS_IS_OK(status))
823 goto done;
824 if (!NT_STATUS_IS_OK(result)) {
825 status = result;
826 goto done;
827 }
828
829 printf("Account for SID %s successfully created\n\n", argv[1]);
830 status = NT_STATUS_OK;
831
832 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
833 done:
834 return status;
835 }
836
837
838 /* Enumerate the privileges of an SID */
839
840 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
841 TALLOC_CTX *mem_ctx, int argc,
842 const char **argv)
843 {
844 struct policy_handle dom_pol;
845 struct policy_handle user_pol;
846 NTSTATUS status, result;
847 uint32 access_desired = 0x000f000f;
848 struct dom_sid sid;
849 struct lsa_PrivilegeSet *privs = NULL;
850 int i;
851 struct dcerpc_binding_handle *b = cli->binding_handle;
852
853 if (argc != 2 ) {
854 printf("Usage: %s SID\n", argv[0]);
855 return NT_STATUS_OK;
856 }
857
858 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
859 if (!NT_STATUS_IS_OK(status))
860 goto done;
861
862 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
863 SEC_FLAG_MAXIMUM_ALLOWED,
864 &dom_pol);
865
866 if (!NT_STATUS_IS_OK(status))
867 goto done;
868
869 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
870 &dom_pol,
871 &sid,
872 access_desired,
873 &user_pol,
874 &result);
875 if (!NT_STATUS_IS_OK(status))
876 goto done;
877 if (!NT_STATUS_IS_OK(result)) {
878 status = result;
879 goto done;
880 }
881
882 status = dcerpc_lsa_EnumPrivsAccount(b, mem_ctx,
883 &user_pol,
884 &privs,
885 &result);
886 if (!NT_STATUS_IS_OK(status))
887 goto done;
888 if (!NT_STATUS_IS_OK(result)) {
889 status = result;
890 goto done;
891 }
892
893 /* Print results */
894 printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
895 printf("high\tlow\tattribute\n");
896
897 for (i = 0; i < privs->count; i++) {
898 printf("%u\t%u\t%u\n",
899 privs->set[i].luid.high,
900 privs->set[i].luid.low,
901 privs->set[i].attribute);
902 }
903
904 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
905 done:
906 return status;
907 }
908
909
910 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
911
912 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
913 TALLOC_CTX *mem_ctx, int argc,
914 const char **argv)
915 {
916 struct policy_handle dom_pol;
917 NTSTATUS status, result;
918 struct dom_sid sid;
919 struct lsa_RightSet rights;
920 struct dcerpc_binding_handle *b = cli->binding_handle;
921
922 int i;
923
924 if (argc != 2 ) {
925 printf("Usage: %s SID\n", argv[0]);
926 return NT_STATUS_OK;
927 }
928
929 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
930 if (!NT_STATUS_IS_OK(status))
931 goto done;
932
933 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
934 SEC_FLAG_MAXIMUM_ALLOWED,
935 &dom_pol);
936
937 if (!NT_STATUS_IS_OK(status))
938 goto done;
939
940 status = dcerpc_lsa_EnumAccountRights(b, mem_ctx,
941 &dom_pol,
942 &sid,
943 &rights,
944 &result);
945 if (!NT_STATUS_IS_OK(status))
946 goto done;
947 if (!NT_STATUS_IS_OK(result)) {
948 status = result;
949 goto done;
950 }
951
952 printf("found %d privileges for SID %s\n", rights.count,
953 sid_string_tos(&sid));
954
955 for (i = 0; i < rights.count; i++) {
956 printf("\t%s\n", rights.names[i].string);
957 }
958
959 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
960 done:
961 return status;
962 }
963
964
965 /* add some privileges to a SID via LsaAddAccountRights */
966
967 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
968 TALLOC_CTX *mem_ctx, int argc,
969 const char **argv)
970 {
971 struct policy_handle dom_pol;
972 NTSTATUS status, result;
973 struct lsa_RightSet rights;
974 struct dom_sid sid;
975 int i;
976 struct dcerpc_binding_handle *b = cli->binding_handle;
977
978 if (argc < 3 ) {
979 printf("Usage: %s SID [rights...]\n", argv[0]);
980 return NT_STATUS_OK;
981 }
982
983 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
984 if (!NT_STATUS_IS_OK(status))
985 goto done;
986
987 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
988 SEC_FLAG_MAXIMUM_ALLOWED,
989 &dom_pol);
990
991 if (!NT_STATUS_IS_OK(status))
992 goto done;
993
994 rights.count = argc-2;
995 rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
996 rights.count);
997 if (!rights.names) {
998 return NT_STATUS_NO_MEMORY;
999 }
1000
1001 for (i=0; i<argc-2; i++) {
1002 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1003 }
1004
1005 status = dcerpc_lsa_AddAccountRights(b, mem_ctx,
1006 &dom_pol,
1007 &sid,
1008 &rights,
1009 &result);
1010 if (!NT_STATUS_IS_OK(status))
1011 goto done;
1012 if (!NT_STATUS_IS_OK(result)) {
1013 status = result;
1014 goto done;
1015 }
1016
1017 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1018 done:
1019 return status;
1020 }
1021
1022
1023 /* remove some privileges to a SID via LsaRemoveAccountRights */
1024
1025 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
1026 TALLOC_CTX *mem_ctx, int argc,
1027 const char **argv)
1028 {
1029 struct policy_handle dom_pol;
1030 NTSTATUS status, result;
1031 struct lsa_RightSet rights;
1032 struct dom_sid sid;
1033 int i;
1034 struct dcerpc_binding_handle *b = cli->binding_handle;
1035
1036 if (argc < 3 ) {
1037 printf("Usage: %s SID [rights...]\n", argv[0]);
1038 return NT_STATUS_OK;
1039 }
1040
1041 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1042 if (!NT_STATUS_IS_OK(status))
1043 goto done;
1044
1045 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1046 SEC_FLAG_MAXIMUM_ALLOWED,
1047 &dom_pol);
1048
1049 if (!NT_STATUS_IS_OK(status))
1050 goto done;
1051
1052 rights.count = argc-2;
1053 rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
1054 rights.count);
1055 if (!rights.names) {
1056 return NT_STATUS_NO_MEMORY;
1057 }
1058
1059 for (i=0; i<argc-2; i++) {
1060 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1061 }
1062
1063 status = dcerpc_lsa_RemoveAccountRights(b, mem_ctx,
1064 &dom_pol,
1065 &sid,
1066 false,
1067 &rights,
1068 &result);
1069 if (!NT_STATUS_IS_OK(status))
1070 goto done;
1071 if (!NT_STATUS_IS_OK(result)) {
1072 status = result;
1073 goto done;
1074 }
1075
1076 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1077
1078 done:
1079 return status;
1080 }
1081
1082
1083 /* Get a privilege value given its name */
1084
1085 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
1086 TALLOC_CTX *mem_ctx, int argc,
1087 const char **argv)
1088 {
1089 struct policy_handle pol;
1090 NTSTATUS status, result;
1091 struct lsa_LUID luid;
1092 struct lsa_String name;
1093 struct dcerpc_binding_handle *b = cli->binding_handle;
1094
1095 if (argc != 2 ) {
1096 printf("Usage: %s name\n", argv[0]);
1097 return NT_STATUS_OK;
1098 }
1099
1100 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1101 SEC_FLAG_MAXIMUM_ALLOWED,
1102 &pol);
1103
1104 if (!NT_STATUS_IS_OK(status))
1105 goto done;
1106
1107 init_lsa_String(&name, argv[1]);
1108
1109 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1110 &pol,
1111 &name,
1112 &luid,
1113 &result);
1114 if (!NT_STATUS_IS_OK(status))
1115 goto done;
1116 if (!NT_STATUS_IS_OK(result)) {
1117 status = result;
1118 goto done;
1119 }
1120
1121 /* Print results */
1122
1123 printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1124
1125 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1126 done:
1127 return status;
1128 }
1129
1130 /* Query LSA security object */
1131
1132 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1133 TALLOC_CTX *mem_ctx, int argc,
1134 const char **argv)
1135 {
1136 struct policy_handle pol;
1137 NTSTATUS status, result;
1138 struct sec_desc_buf *sdb;
1139 uint32 sec_info = SECINFO_DACL;
1140 struct dcerpc_binding_handle *b = cli->binding_handle;
1141
1142 if (argc < 1 || argc > 2) {
1143 printf("Usage: %s [sec_info]\n", argv[0]);
1144 return NT_STATUS_OK;
1145 }
1146
1147 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1148 SEC_FLAG_MAXIMUM_ALLOWED,
1149 &pol);
1150
1151 if (argc == 2)
1152 sscanf(argv[1], "%x", &sec_info);
1153
1154 if (!NT_STATUS_IS_OK(status))
1155 goto done;
1156
1157 status = dcerpc_lsa_QuerySecurity(b, mem_ctx,
1158 &pol,
1159 sec_info,
1160 &sdb,
1161 &result);
1162 if (!NT_STATUS_IS_OK(status))
1163 goto done;
1164 if (!NT_STATUS_IS_OK(result)) {
1165 status = result;
1166 goto done;
1167 }
1168
1169 /* Print results */
1170
1171 display_sec_desc(sdb->sd);
1172
1173 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1174 done:
1175 return status;
1176 }
1177
1178 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1179 DATA_BLOB session_key)
1180 {
1181 char *pwd, *pwd_old;
1182
1183 DATA_BLOB data = data_blob_const(p->password->data, p->password->length);
1184 DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1185
1186 pwd = sess_decrypt_string(talloc_tos(), &data, &session_key);
1187 pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key);
1188
1189 d_printf("Password:\t%s\n", pwd);
1190 d_printf("Old Password:\t%s\n", pwd_old);
1191
1192 talloc_free(pwd);
1193 talloc_free(pwd_old);
1194 }
1195
1196 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1197 union lsa_TrustedDomainInfo *info,
1198 enum lsa_TrustDomInfoEnum info_class,
1199 DATA_BLOB session_key)
1200 {
1201 switch (info_class) {
1202 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1203 display_trust_dom_info_4(&info->password, session_key);
1204 break;
1205 default: {
1206 const char *str = NULL;
1207 str = NDR_PRINT_UNION_STRING(mem_ctx,
1208 lsa_TrustedDomainInfo,
1209 info_class, info);
1210 if (str) {
1211 d_printf("%s\n", str);
1212 }
1213 break;
1214 }
1215 }
1216 }
1217
1218 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1219 TALLOC_CTX *mem_ctx, int argc,
1220 const char **argv)
1221 {
1222 struct policy_handle pol;
1223 NTSTATUS status, result;
1224 struct dom_sid dom_sid;
1225 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1226 union lsa_TrustedDomainInfo *info = NULL;
1227 enum lsa_TrustDomInfoEnum info_class = 1;
1228 DATA_BLOB session_key;
1229 struct dcerpc_binding_handle *b = cli->binding_handle;
1230
1231 if (argc > 3 || argc < 2) {
1232 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1233 return NT_STATUS_OK;
1234 }
1235
1236 if (!string_to_sid(&dom_sid, argv[1]))
1237 return NT_STATUS_NO_MEMORY;
1238
1239 if (argc == 3)
1240 info_class = atoi(argv[2]);
1241
1242 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1243
1244 if (!NT_STATUS_IS_OK(status))
1245 goto done;
1246
1247 status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
1248 &pol,
1249 &dom_sid,
1250 info_class,
1251 &info,
1252 &result);
1253 if (!NT_STATUS_IS_OK(status))
1254 goto done;
1255 if (!NT_STATUS_IS_OK(result)) {
1256 status = result;
1257 goto done;
1258 }
1259
1260 status = cli_get_session_key(mem_ctx, cli, &session_key);
1261 if (!NT_STATUS_IS_OK(status)) {
1262 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1263 goto done;
1264 }
1265
1266 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1267
1268 done:
1269 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1270
1271 return status;
1272 }
1273
1274 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1275 TALLOC_CTX *mem_ctx, int argc,
1276 const char **argv)
1277 {
1278 struct policy_handle pol;
1279 NTSTATUS status, result;
1280 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1281 union lsa_TrustedDomainInfo *info = NULL;
1282 enum lsa_TrustDomInfoEnum info_class = 1;
1283 struct lsa_String trusted_domain;
1284 struct dcerpc_binding_handle *b = cli->binding_handle;
1285 DATA_BLOB session_key;
1286
1287 if (argc > 3 || argc < 2) {
1288 printf("Usage: %s [name] [info_class]\n", argv[0]);
1289 return NT_STATUS_OK;
1290 }
1291
1292 if (argc == 3)
1293 info_class = atoi(argv[2]);
1294
1295 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1296
1297 if (!NT_STATUS_IS_OK(status))
1298 goto done;
1299
1300 init_lsa_String(&trusted_domain, argv[1]);
1301
1302 status = dcerpc_lsa_QueryTrustedDomainInfoByName(b, mem_ctx,
1303 &pol,
1304 &trusted_domain,
1305 info_class,
1306 &info,
1307 &result);
1308 if (!NT_STATUS_IS_OK(status))
1309 goto done;
1310 if (!NT_STATUS_IS_OK(result)) {
1311 status = result;
1312 goto done;
1313 }
1314
1315 status = cli_get_session_key(mem_ctx, cli, &session_key);
1316 if (!NT_STATUS_IS_OK(status)) {
1317 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1318 goto done;
1319 }
1320
1321 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1322
1323 done:
1324 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1325
1326 return status;
1327 }
1328
1329 static NTSTATUS cmd_lsa_set_trustdominfo(struct rpc_pipe_client *cli,
1330 TALLOC_CTX *mem_ctx, int argc,
1331 const char **argv)
1332 {
1333 struct policy_handle pol, trustdom_pol;
1334 NTSTATUS status, result;
1335 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1336 union lsa_TrustedDomainInfo info;
1337 struct dom_sid dom_sid;
1338 enum lsa_TrustDomInfoEnum info_class = 1;
1339 struct dcerpc_binding_handle *b = cli->binding_handle;
1340
1341 if (argc > 4 || argc < 3) {
1342 printf("Usage: %s [sid] [info_class] [value]\n", argv[0]);
1343 return NT_STATUS_OK;
1344 }
1345
1346 if (!string_to_sid(&dom_sid, argv[1])) {
1347 return NT_STATUS_NO_MEMORY;
1348 }
1349
1350
1351 info_class = atoi(argv[2]);
1352
1353 switch (info_class) {
1354 case 13: /* LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES */
1355 info.enc_types.enc_types = atoi(argv[3]);
1356 break;
1357 default:
1358 return NT_STATUS_INVALID_PARAMETER;
1359 }
1360
1361 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1362 if (!NT_STATUS_IS_OK(status)) {
1363 goto done;
1364 }
1365
1366 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1367 &pol,
1368 &dom_sid,
1369 access_mask,
1370 &trustdom_pol,
1371 &result);
1372 if (!NT_STATUS_IS_OK(status)) {
1373 goto done;
1374 }
1375 if (!NT_STATUS_IS_OK(result)) {
1376 status = result;
1377 goto done;
1378 }
1379
1380 status = dcerpc_lsa_SetInformationTrustedDomain(b, mem_ctx,
1381 &trustdom_pol,
1382 info_class,
1383 &info,
1384 &result);
1385 if (!NT_STATUS_IS_OK(status)) {
1386 goto done;
1387 }
1388 if (!NT_STATUS_IS_OK(result)) {
1389 status = result;
1390 goto done;
1391 }
1392 done:
1393 dcerpc_lsa_Close(b, mem_ctx, &trustdom_pol, &result);
1394 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1395
1396 return status;
1397 }
1398
1399 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1400 TALLOC_CTX *mem_ctx, int argc,
1401 const char **argv)
1402 {
1403 struct policy_handle pol, trustdom_pol;
1404 NTSTATUS status, result;
1405 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1406 union lsa_TrustedDomainInfo *info = NULL;
1407 struct dom_sid dom_sid;
1408 enum lsa_TrustDomInfoEnum info_class = 1;
1409 DATA_BLOB session_key;
1410 struct dcerpc_binding_handle *b = cli->binding_handle;
1411
1412 if (argc > 3 || argc < 2) {
1413 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1414 return NT_STATUS_OK;
1415 }
1416
1417 if (!string_to_sid(&dom_sid, argv[1]))
1418 return NT_STATUS_NO_MEMORY;
1419
1420
1421 if (argc == 3)
1422 info_class = atoi(argv[2]);
1423
1424 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1425
1426 if (!NT_STATUS_IS_OK(status))
1427 goto done;
1428
1429 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1430 &pol,
1431 &dom_sid,
1432 access_mask,
1433 &trustdom_pol,
1434 &result);
1435 if (!NT_STATUS_IS_OK(status))
1436 goto done;
1437 if (!NT_STATUS_IS_OK(result)) {
1438 status = result;
1439 goto done;
1440 }
1441
1442 status = dcerpc_lsa_QueryTrustedDomainInfo(b, mem_ctx,
1443 &trustdom_pol,
1444 info_class,
1445 &info,
1446 &result);
1447 if (!NT_STATUS_IS_OK(status))
1448 goto done;
1449 if (!NT_STATUS_IS_OK(result)) {
1450 status = result;
1451 goto done;
1452 }
1453
1454 status = cli_get_session_key(mem_ctx, cli, &session_key);
1455 if (!NT_STATUS_IS_OK(status)) {
1456 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1457 goto done;
1458 }
1459
1460 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1461
1462 done:
1463 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1464
1465 return status;
1466 }
1467
1468 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1469 TALLOC_CTX *mem_ctx, int argc,
1470 const char **argv)
1471 {
1472 struct policy_handle pol;
1473 NTSTATUS status, result;
1474 const char *servername = cli->desthost;
1475 struct lsa_String *account_name = NULL;
1476 struct lsa_String *authority_name = NULL;
1477 struct dcerpc_binding_handle *b = cli->binding_handle;
1478
1479 if (argc > 2) {
1480 printf("Usage: %s servername\n", argv[0]);
1481 return NT_STATUS_OK;
1482 }
1483
1484 status = rpccli_lsa_open_policy(cli, mem_ctx, true,
1485 SEC_FLAG_MAXIMUM_ALLOWED,
1486 &pol);
1487
1488 if (!NT_STATUS_IS_OK(status)) {
1489 goto done;
1490 }
1491
1492 status = dcerpc_lsa_GetUserName(b, mem_ctx,
1493 servername,
1494 &account_name,
1495 &authority_name,
1496 &result);
1497 if (!NT_STATUS_IS_OK(status)) {
1498 goto done;
1499 }
1500 if (!NT_STATUS_IS_OK(result)) {
1501 status = result;
1502 goto done;
1503 }
1504
1505 /* Print results */
1506
1507 printf("Account Name: %s, Authority Name: %s\n",
1508 account_name->string, authority_name ? authority_name->string :
1509 "");
1510
1511 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1512 done:
1513 return status;
1514 }
1515
1516 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1517 TALLOC_CTX *mem_ctx, int argc,
1518 const char **argv)
1519 {
1520 struct policy_handle dom_pol, user_pol;
1521 NTSTATUS status, result;
1522 struct lsa_PrivilegeSet privs;
1523 struct lsa_LUIDAttribute *set = NULL;
1524 struct dom_sid sid;
1525 int i;
1526 struct dcerpc_binding_handle *b = cli->binding_handle;
1527
1528 ZERO_STRUCT(privs);
1529
1530 if (argc < 3 ) {
1531 printf("Usage: %s SID [rights...]\n", argv[0]);
1532 return NT_STATUS_OK;
1533 }
1534
1535 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1536 if (!NT_STATUS_IS_OK(status)) {
1537 goto done;
1538 }
1539
1540 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1541 SEC_FLAG_MAXIMUM_ALLOWED,
1542 &dom_pol);
1543
1544 if (!NT_STATUS_IS_OK(status)) {
1545 goto done;
1546 }
1547
1548 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1549 &dom_pol,
1550 &sid,
1551 SEC_FLAG_MAXIMUM_ALLOWED,
1552 &user_pol,
1553 &result);
1554 if (!NT_STATUS_IS_OK(status)) {
1555 goto done;
1556 }
1557 if (!NT_STATUS_IS_OK(result)) {
1558 status = result;
1559 goto done;
1560 }
1561
1562 for (i=2; i<argc; i++) {
1563
1564 struct lsa_String priv_name;
1565 struct lsa_LUID luid;
1566
1567 init_lsa_String(&priv_name, argv[i]);
1568
1569 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1570 &dom_pol,
1571 &priv_name,
1572 &luid,
1573 &result);
1574 if (!NT_STATUS_IS_OK(status)) {
1575 continue;
1576 }
1577 if (!NT_STATUS_IS_OK(result)) {
1578 status = result;
1579 continue;
1580 }
1581
1582 privs.count++;
1583 set = talloc_realloc(mem_ctx, set,
1584 struct lsa_LUIDAttribute,
1585 privs.count);
1586 if (!set) {
1587 return NT_STATUS_NO_MEMORY;
1588 }
1589
1590 set[privs.count-1].luid = luid;
1591 set[privs.count-1].attribute = 0;
1592 }
1593
1594 privs.set = set;
1595
1596 status = dcerpc_lsa_AddPrivilegesToAccount(b, mem_ctx,
1597 &user_pol,
1598 &privs,
1599 &result);
1600 if (!NT_STATUS_IS_OK(status)) {
1601 goto done;
1602 }
1603 if (!NT_STATUS_IS_OK(result)) {
1604 status = result;
1605 goto done;
1606 }
1607
1608 dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1609 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1610 done:
1611 return status;
1612 }
1613
1614 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1615 TALLOC_CTX *mem_ctx, int argc,
1616 const char **argv)
1617 {
1618 struct policy_handle dom_pol, user_pol;
1619 NTSTATUS status, result;
1620 struct lsa_PrivilegeSet privs;
1621 struct lsa_LUIDAttribute *set = NULL;
1622 struct dom_sid sid;
1623 int i;
1624 struct dcerpc_binding_handle *b = cli->binding_handle;
1625
1626 ZERO_STRUCT(privs);
1627
1628 if (argc < 3 ) {
1629 printf("Usage: %s SID [rights...]\n", argv[0]);
1630 return NT_STATUS_OK;
1631 }
1632
1633 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1634 if (!NT_STATUS_IS_OK(status)) {
1635 goto done;
1636 }
1637
1638 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1639 SEC_FLAG_MAXIMUM_ALLOWED,
1640 &dom_pol);
1641
1642 if (!NT_STATUS_IS_OK(status)) {
1643 goto done;
1644 }
1645
1646 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1647 &dom_pol,
1648 &sid,
1649 SEC_FLAG_MAXIMUM_ALLOWED,
1650 &user_pol,
1651 &result);
1652 if (!NT_STATUS_IS_OK(status)) {
1653 goto done;
1654 }
1655 if (!NT_STATUS_IS_OK(result)) {
1656 status = result;
1657 goto done;
1658 }
1659
1660 for (i=2; i<argc; i++) {
1661
1662 struct lsa_String priv_name;
1663 struct lsa_LUID luid;
1664
1665 init_lsa_String(&priv_name, argv[i]);
1666
1667 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1668 &dom_pol,
1669 &priv_name,
1670 &luid,
1671 &result);
1672 if (!NT_STATUS_IS_OK(status)) {
1673 continue;
1674 }
1675 if (!NT_STATUS_IS_OK(result)) {
1676 status = result;
1677 continue;
1678 }
1679
1680 privs.count++;
1681 set = talloc_realloc(mem_ctx, set,
1682 struct lsa_LUIDAttribute,
1683 privs.count);
1684 if (!set) {
1685 return NT_STATUS_NO_MEMORY;
1686 }
1687
1688 set[privs.count-1].luid = luid;
1689 set[privs.count-1].attribute = 0;
1690 }
1691
1692 privs.set = set;
1693
1694
1695 status = dcerpc_lsa_RemovePrivilegesFromAccount(b, mem_ctx,
1696 &user_pol,
1697 false,
1698 &privs,
1699 &result);
1700 if (!NT_STATUS_IS_OK(status)) {
1701 goto done;
1702 }
1703 if (!NT_STATUS_IS_OK(result)) {
1704 status = result;
1705 goto done;
1706 }
1707
1708 dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1709 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1710 done:
1711 return status;
1712 }
1713
1714 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1715 TALLOC_CTX *mem_ctx, int argc,
1716 const char **argv)
1717 {
1718 NTSTATUS status, result;
1719 struct policy_handle handle, sec_handle;
1720 struct lsa_String name;
1721 struct dcerpc_binding_handle *b = cli->binding_handle;
1722
1723 if (argc < 2) {
1724 printf("Usage: %s name\n", argv[0]);
1725 return NT_STATUS_OK;
1726 }
1727
1728 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1729 true,
1730 SEC_FLAG_MAXIMUM_ALLOWED,
1731 &handle);
1732 if (!NT_STATUS_IS_OK(status)) {
1733 return status;
1734 }
1735
1736 init_lsa_String(&name, argv[1]);
1737
1738 status = dcerpc_lsa_CreateSecret(b, mem_ctx,
1739 &handle,
1740 name,
1741 SEC_FLAG_MAXIMUM_ALLOWED,
1742 &sec_handle,
1743 &result);
1744 if (!NT_STATUS_IS_OK(status)) {
1745 goto done;
1746 }
1747 if (!NT_STATUS_IS_OK(result)) {
1748 status = result;
1749 goto done;
1750 }
1751
1752 done:
1753 if (is_valid_policy_hnd(&sec_handle)) {
1754 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1755 }
1756 if (is_valid_policy_hnd(&handle)) {
1757 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1758 }
1759
1760 return status;
1761 }
1762
1763 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1764 TALLOC_CTX *mem_ctx, int argc,
1765 const char **argv)
1766 {
1767 NTSTATUS status, result;
1768 struct policy_handle handle, sec_handle;
1769 struct lsa_String name;
1770 struct dcerpc_binding_handle *b = cli->binding_handle;
1771
1772 if (argc < 2) {
1773 printf("Usage: %s name\n", argv[0]);
1774 return NT_STATUS_OK;
1775 }
1776
1777 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1778 true,
1779 SEC_FLAG_MAXIMUM_ALLOWED,
1780 &handle);
1781 if (!NT_STATUS_IS_OK(status)) {
1782 return status;
1783 }
1784
1785 init_lsa_String(&name, argv[1]);
1786
1787 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1788 &handle,
1789 name,
1790 SEC_FLAG_MAXIMUM_ALLOWED,
1791 &sec_handle,
1792 &result);
1793 if (!NT_STATUS_IS_OK(status)) {
1794 goto done;
1795 }
1796 if (!NT_STATUS_IS_OK(result)) {
1797 status = result;
1798 goto done;
1799 }
1800
1801 status = dcerpc_lsa_DeleteObject(b, mem_ctx,
1802 &sec_handle,
1803 &result);
1804 if (!NT_STATUS_IS_OK(status)) {
1805 goto done;
1806 }
1807 if (!NT_STATUS_IS_OK(result)) {
1808 status = result;
1809 goto done;
1810 }
1811
1812 done:
1813 if (is_valid_policy_hnd(&sec_handle)) {
1814 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1815 }
1816 if (is_valid_policy_hnd(&handle)) {
1817 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1818 }
1819
1820 return status;
1821 }
1822
1823 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1824 TALLOC_CTX *mem_ctx, int argc,
1825 const char **argv)
1826 {
1827 NTSTATUS status, result;
1828 struct policy_handle handle, sec_handle;
1829 struct lsa_String name;
1830 struct lsa_DATA_BUF_PTR new_val;
1831 NTTIME new_mtime = 0;
1832 struct lsa_DATA_BUF_PTR old_val;
1833 NTTIME old_mtime = 0;
1834 DATA_BLOB session_key;
1835 DATA_BLOB new_blob = data_blob_null;
1836 DATA_BLOB old_blob = data_blob_null;
1837 char *new_secret, *old_secret;
1838 struct dcerpc_binding_handle *b = cli->binding_handle;
1839
1840 if (argc < 2) {
1841 printf("Usage: %s name\n", argv[0]);
1842 return NT_STATUS_OK;
1843 }
1844
1845 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1846 true,
1847 SEC_FLAG_MAXIMUM_ALLOWED,
1848 &handle);
1849 if (!NT_STATUS_IS_OK(status)) {
1850 return status;
1851 }
1852
1853 init_lsa_String(&name, argv[1]);
1854
1855 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1856 &handle,
1857 name,
1858 SEC_FLAG_MAXIMUM_ALLOWED,
1859 &sec_handle,
1860 &result);
1861 if (!NT_STATUS_IS_OK(status)) {
1862 goto done;
1863 }
1864 if (!NT_STATUS_IS_OK(result)) {
1865 status = result;
1866 goto done;
1867 }
1868
1869 ZERO_STRUCT(new_val);
1870 ZERO_STRUCT(old_val);
1871
1872 status = dcerpc_lsa_QuerySecret(b, mem_ctx,
1873 &sec_handle,
1874 &new_val,
1875 &new_mtime,
1876 &old_val,
1877 &old_mtime,
1878 &result);
1879 if (!NT_STATUS_IS_OK(status)) {
1880 goto done;
1881 }
1882 if (!NT_STATUS_IS_OK(result)) {
1883 status = result;
1884 goto done;
1885 }
1886
1887 status = cli_get_session_key(mem_ctx, cli, &session_key);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 goto done;
1890 }
1891
1892 if (new_val.buf) {
1893 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1894 }
1895 if (old_val.buf) {
1896 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1897 }
1898
1899 new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1900 old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1901 if (new_secret) {
1902 d_printf("new secret: %s\n", new_secret);
1903 }
1904 if (old_secret) {
1905 d_printf("old secret: %s\n", old_secret);
1906 }
1907
1908 done:
1909 if (is_valid_policy_hnd(&sec_handle)) {
1910 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1911 }
1912 if (is_valid_policy_hnd(&handle)) {
1913 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1914 }
1915
1916 return status;
1917 }
1918
1919 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
1920 TALLOC_CTX *mem_ctx, int argc,
1921 const char **argv)
1922 {
1923 NTSTATUS status, result;
1924 struct policy_handle handle, sec_handle;
1925 struct lsa_String name;
1926 struct lsa_DATA_BUF new_val;
1927 struct lsa_DATA_BUF old_val;
1928 DATA_BLOB enc_key;
1929 DATA_BLOB session_key;
1930 struct dcerpc_binding_handle *b = cli->binding_handle;
1931
1932 if (argc < 3) {
1933 printf("Usage: %s name secret\n", argv[0]);
1934 return NT_STATUS_OK;
1935 }
1936
1937 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1938 true,
1939 SEC_FLAG_MAXIMUM_ALLOWED,
1940 &handle);
1941 if (!NT_STATUS_IS_OK(status)) {
1942 return status;
1943 }
1944
1945 init_lsa_String(&name, argv[1]);
1946
1947 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1948 &handle,
1949 name,
1950 SEC_FLAG_MAXIMUM_ALLOWED,
1951 &sec_handle,
1952 &result);
1953 if (!NT_STATUS_IS_OK(status)) {
1954 goto done;
1955 }
1956 if (!NT_STATUS_IS_OK(result)) {
1957 status = result;
1958 goto done;
1959 }
1960
1961 ZERO_STRUCT(new_val);
1962 ZERO_STRUCT(old_val);
1963
1964 status = cli_get_session_key(mem_ctx, cli, &session_key);
1965 if (!NT_STATUS_IS_OK(status)) {
1966 goto done;
1967 }
1968
1969 enc_key = sess_encrypt_string(argv[2], &session_key);
1970
1971 new_val.length = enc_key.length;
1972 new_val.size = enc_key.length;
1973 new_val.data = enc_key.data;
1974
1975 status = dcerpc_lsa_SetSecret(b, mem_ctx,
1976 &sec_handle,
1977 &new_val,
1978 NULL,
1979 &result);
1980 if (!NT_STATUS_IS_OK(status)) {
1981 goto done;
1982 }
1983 if (!NT_STATUS_IS_OK(result)) {
1984 status = result;
1985 goto done;
1986 }
1987
1988 done:
1989 if (is_valid_policy_hnd(&sec_handle)) {
1990 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1991 }
1992 if (is_valid_policy_hnd(&handle)) {
1993 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1994 }
1995
1996 return status;
1997 }
1998
1999 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
2000 TALLOC_CTX *mem_ctx, int argc,
2001 const char **argv)
2002 {
2003 NTSTATUS status, result;
2004 struct policy_handle handle;
2005 struct lsa_String name;
2006 struct lsa_DATA_BUF *val;
2007 DATA_BLOB session_key;
2008 DATA_BLOB blob = data_blob_null;
2009 char *secret;
2010 struct dcerpc_binding_handle *b = cli->binding_handle;
2011
2012 if (argc < 2) {
2013 printf("Usage: %s name\n", argv[0]);
2014 return NT_STATUS_OK;
2015 }
2016
2017 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2018 true,
2019 SEC_FLAG_MAXIMUM_ALLOWED,
2020 &handle);
2021 if (!NT_STATUS_IS_OK(status)) {
2022 return status;
2023 }
2024
2025 init_lsa_String(&name, argv[1]);
2026
2027 ZERO_STRUCT(val);
2028
2029 status = dcerpc_lsa_RetrievePrivateData(b, mem_ctx,
2030 &handle,
2031 &name,
2032 &val,
2033 &result);
2034 if (!NT_STATUS_IS_OK(status)) {
2035 goto done;
2036 }
2037 if (!NT_STATUS_IS_OK(result)) {
2038 status = result;
2039 goto done;
2040 }
2041
2042 status = cli_get_session_key(mem_ctx, cli, &session_key);
2043 if (!NT_STATUS_IS_OK(status)) {
2044 goto done;
2045 }
2046
2047 if (val) {
2048 blob = data_blob_const(val->data, val->length);
2049 }
2050
2051 secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
2052 if (secret) {
2053 d_printf("secret: %s\n", secret);
2054 }
2055
2056 done:
2057 if (is_valid_policy_hnd(&handle)) {
2058 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2059 }
2060
2061 return status;
2062 }
2063
2064 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
2065 TALLOC_CTX *mem_ctx, int argc,
2066 const char **argv)
2067 {
2068 NTSTATUS status, result;
2069 struct policy_handle handle;
2070 struct lsa_String name;
2071 struct lsa_DATA_BUF val;
2072 DATA_BLOB session_key;
2073 DATA_BLOB enc_key;
2074 struct dcerpc_binding_handle *b = cli->binding_handle;
2075
2076 if (argc < 3) {
2077 printf("Usage: %s name secret\n", argv[0]);
2078 return NT_STATUS_OK;
2079 }
2080
2081 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2082 true,
2083 SEC_FLAG_MAXIMUM_ALLOWED,
2084 &handle);
2085 if (!NT_STATUS_IS_OK(status)) {
2086 return status;
2087 }
2088
2089 init_lsa_String(&name, argv[1]);
2090
2091 ZERO_STRUCT(val);
2092
2093 status = cli_get_session_key(mem_ctx, cli, &session_key);
2094 if (!NT_STATUS_IS_OK(status)) {
2095 goto done;
2096 }
2097
2098 enc_key = sess_encrypt_string(argv[2], &session_key);
2099
2100 val.length = enc_key.length;
2101 val.size = enc_key.length;
2102 val.data = enc_key.data;
2103
2104 status = dcerpc_lsa_StorePrivateData(b, mem_ctx,
2105 &handle,
2106 &name,
2107 &val,
2108 &result);
2109 if (!NT_STATUS_IS_OK(status)) {
2110 goto done;
2111 }
2112 if (!NT_STATUS_IS_OK(result)) {
2113 status = result;
2114 goto done;
2115 }
2116
2117 done:
2118 if (is_valid_policy_hnd(&handle)) {
2119 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2120 }
2121
2122 return status;
2123 }
2124
2125 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
2126 TALLOC_CTX *mem_ctx, int argc,
2127 const char **argv)
2128 {
2129 NTSTATUS status, result;
2130 struct policy_handle handle, trustdom_handle;
2131 struct dom_sid sid;
2132 struct lsa_DomainInfo info;
2133 struct dcerpc_binding_handle *b = cli->binding_handle;
2134
2135 if (argc < 3) {
2136 printf("Usage: %s name sid\n", argv[0]);
2137 return NT_STATUS_OK;
2138 }
2139
2140 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2141 true,
2142 SEC_FLAG_MAXIMUM_ALLOWED,
2143 &handle);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 return status;
2146 }
2147
2148 init_lsa_StringLarge(&info.name, argv[1]);
2149 info.sid = &sid;
2150 string_to_sid(&sid, argv[2]);
2151
2152 status = dcerpc_lsa_CreateTrustedDomain(b, mem_ctx,
2153 &handle,
2154 &info,
2155 SEC_FLAG_MAXIMUM_ALLOWED,
2156 &trustdom_handle,
2157 &result);
2158 if (!NT_STATUS_IS_OK(status)) {
2159 goto done;
2160 }
2161 if (!NT_STATUS_IS_OK(result)) {
2162 status = result;
2163 goto done;
2164 }
2165
2166 done:
2167 if (is_valid_policy_hnd(&trustdom_handle)) {
2168 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2169 }
2170
2171 if (is_valid_policy_hnd(&handle)) {
2172 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2173 }
2174
2175 return status;
2176 }
2177
2178 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
2179 TALLOC_CTX *mem_ctx, int argc,
2180 const char **argv)
2181 {
2182 NTSTATUS status, result;
2183 struct policy_handle handle, trustdom_handle;
2184 struct lsa_String name;
2185 struct dom_sid *sid = NULL;
2186 struct dcerpc_binding_handle *b = cli->binding_handle;
2187
2188 if (argc < 2) {
2189 printf("Usage: %s name\n", argv[0]);
2190 return NT_STATUS_OK;
2191 }
2192
2193 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2194 true,
2195 SEC_FLAG_MAXIMUM_ALLOWED,
2196 &handle);
2197 if (!NT_STATUS_IS_OK(status)) {
2198 return status;
2199 }
2200
2201 init_lsa_String(&name, argv[1]);
2202
2203 status = dcerpc_lsa_OpenTrustedDomainByName(b, mem_ctx,
2204 &handle,
2205 name,
2206 SEC_FLAG_MAXIMUM_ALLOWED,
2207 &trustdom_handle,
2208 &result);
2209 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2210 goto delete_object;
2211 }
2212
2213 {
2214 uint32_t resume_handle = 0;
2215 struct lsa_DomainList domains;
2216 int i;
2217
2218 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
2219 &handle,
2220 &resume_handle,
2221 &domains,
2222 0xffff,
2223 &result);
2224 if (!NT_STATUS_IS_OK(status)) {
2225 goto done;
2226 }
2227 if (!NT_STATUS_IS_OK(result)) {
2228 status = result;
2229 goto done;
2230 }
2231
2232 for (i=0; i < domains.count; i++) {
2233 if (strequal(domains.domains[i].name.string, argv[1])) {
2234 sid = domains.domains[i].sid;
2235 break;
2236 }
2237 }
2238
2239 if (!sid) {
2240 return NT_STATUS_INVALID_SID;
2241 }
2242 }
2243
2244 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
2245 &handle,
2246 sid,
2247 SEC_FLAG_MAXIMUM_ALLOWED,
2248 &trustdom_handle,
2249 &result);
2250 if (!NT_STATUS_IS_OK(status)) {
2251 goto done;
2252 }
2253 if (!NT_STATUS_IS_OK(result)) {
2254 status = result;
2255 goto done;
2256 }
2257
2258 delete_object:
2259 status = dcerpc_lsa_DeleteObject(b, mem_ctx,
2260 &trustdom_handle,
2261 &result);
2262 if (!NT_STATUS_IS_OK(status)) {
2263 goto done;
2264 }
2265 if (!NT_STATUS_IS_OK(result)) {
2266 status = result;
2267 goto done;
2268 }
2269
2270 done:
2271 if (is_valid_policy_hnd(&trustdom_handle)) {
2272 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2273 }
2274
2275 if (is_valid_policy_hnd(&handle)) {
2276 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2277 }
2278
2279 return status;
2280 }
2281
2282
2283 /* List of commands exported by this module */
2284
2285 struct cmd_set lsarpc_commands[] = {
2286
2287 { "LSARPC" },
2288
2289 { "lsaquery", RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy, NULL, &ndr_table_lsarpc, NULL, "Query info policy", "" },
2290 { "lookupsids", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids, NULL, &ndr_table_lsarpc, NULL, "Convert SIDs to names", "" },
2291 { "lookupsids3", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids3, NULL, &ndr_table_lsarpc, NULL, "Convert SIDs to names", "" },
2292 { "lookupnames", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2293 { "lookupnames4", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names4, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2294 { "lookupnames_level", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2295 { "enumtrust", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom, NULL, &ndr_table_lsarpc, NULL, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
2296 { "enumprivs", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege, NULL, &ndr_table_lsarpc, NULL, "Enumerate privileges", "" },
2297 { "getdispname", RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname, NULL, &ndr_table_lsarpc, NULL, "Get the privilege name", "" },
2298 { "lsaenumsid", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids, NULL, &ndr_table_lsarpc, NULL, "Enumerate the LSA SIDS", "" },
2299 { "lsacreateaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_create_account, NULL, &ndr_table_lsarpc, NULL, "Create a new lsa account", "" },
2300 { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc, NULL, "Enumerate the privileges of an SID", "" },
2301 { "lsaenumacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Enumerate the rights of an SID", "" },
2302 { "lsaaddpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv, NULL, &ndr_table_lsarpc, NULL, "Assign a privilege to a SID", "" },
2303 { "lsadelpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv, NULL, &ndr_table_lsarpc, NULL, "Revoke a privilege from a SID", "" },
2304 { "lsaaddacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Add rights to an account", "" },
2305 { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Remove rights from an account", "" },
2306 { "lsalookupprivvalue", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value, NULL, &ndr_table_lsarpc, NULL, "Get a privilege value given its name", "" },
2307 { "lsaquerysecobj", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj, NULL, &ndr_table_lsarpc, NULL, "Query LSA security object", "" },
2308 { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a SID)", "" },
2309 { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2310 { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a SID)", "" },
2311 { "lsasettrustdominfo", RPC_RTYPE_NTSTATUS, cmd_lsa_set_trustdominfo, NULL, &ndr_table_lsarpc, NULL, "Set LSA trusted domain info", "" },
2312 { "getusername", RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc, NULL, "Get username", "" },
2313 { "createsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc, NULL, "Create Secret", "" },
2314 { "deletesecret", RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc, NULL, "Delete Secret", "" },
2315 { "querysecret", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc, NULL, "Query Secret", "" },
2316 { "setsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc, NULL, "Set Secret", "" },
2317 { "retrieveprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc, NULL, "Retrieve Private Data", "" },
2318 { "storeprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc, NULL, "Store Private Data", "" },
2319 { "createtrustdom", RPC_RTYPE_NTSTATUS, cmd_lsa_create_trusted_domain, NULL, &ndr_table_lsarpc, NULL, "Create Trusted Domain", "" },
2320 { "deletetrustdom", RPC_RTYPE_NTSTATUS, cmd_lsa_delete_trusted_domain, NULL, &ndr_table_lsarpc, NULL, "Delete Trusted Domain", "" },
2321
2322 { NULL }
2323 };
2324
Samba GIT mirror