2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000-2001,
5 Copyright (C) Andrew Tridgell 1992-1997,2000,
6 Copyright (C) Rafal Szczesniak 2002.
7 Copyright (C) Jeremy Allison 2005.
8 Copyright (C) Guenther Deschner 2008.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/cli_samr.h"
27 #include "rpc_client/cli_samr.h"
28 #include "../lib/crypto/arcfour.h"
30 /* User change password */
32 NTSTATUS
rpccli_samr_chgpasswd_user(struct rpc_pipe_client
*cli
,
34 struct policy_handle
*user_handle
,
35 const char *newpassword
,
36 const char *oldpassword
)
38 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
39 struct samr_Password hash1
, hash2
, hash3
, hash4
, hash5
, hash6
;
41 uchar old_nt_hash
[16];
42 uchar old_lm_hash
[16];
43 uchar new_nt_hash
[16];
44 uchar new_lm_hash
[16];
46 ZERO_STRUCT(old_nt_hash
);
47 ZERO_STRUCT(old_lm_hash
);
48 ZERO_STRUCT(new_nt_hash
);
49 ZERO_STRUCT(new_lm_hash
);
51 DEBUG(10,("rpccli_samr_chgpasswd_user\n"));
53 E_md4hash(oldpassword
, old_nt_hash
);
54 E_md4hash(newpassword
, new_nt_hash
);
56 E_deshash(oldpassword
, old_lm_hash
);
57 E_deshash(newpassword
, new_lm_hash
);
59 E_old_pw_hash(new_lm_hash
, old_lm_hash
, hash1
.hash
);
60 E_old_pw_hash(old_lm_hash
, new_lm_hash
, hash2
.hash
);
61 E_old_pw_hash(new_nt_hash
, old_nt_hash
, hash3
.hash
);
62 E_old_pw_hash(old_nt_hash
, new_nt_hash
, hash4
.hash
);
63 E_old_pw_hash(old_lm_hash
, new_nt_hash
, hash5
.hash
);
64 E_old_pw_hash(old_nt_hash
, new_lm_hash
, hash6
.hash
);
66 result
= rpccli_samr_ChangePasswordUser(cli
, mem_ctx
,
83 /* User change password */
85 NTSTATUS
rpccli_samr_chgpasswd_user2(struct rpc_pipe_client
*cli
,
88 const char *newpassword
,
89 const char *oldpassword
)
91 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
92 struct samr_CryptPassword new_nt_password
;
93 struct samr_CryptPassword new_lm_password
;
94 struct samr_Password old_nt_hash_enc
;
95 struct samr_Password old_lanman_hash_enc
;
97 uchar old_nt_hash
[16];
98 uchar old_lanman_hash
[16];
99 uchar new_nt_hash
[16];
100 uchar new_lanman_hash
[16];
101 struct lsa_String server
, account
;
103 DEBUG(10,("rpccli_samr_chgpasswd_user2\n"));
105 init_lsa_String(&server
, cli
->srv_name_slash
);
106 init_lsa_String(&account
, username
);
108 /* Calculate the MD4 hash (NT compatible) of the password */
109 E_md4hash(oldpassword
, old_nt_hash
);
110 E_md4hash(newpassword
, new_nt_hash
);
112 if (lp_client_lanman_auth() &&
113 E_deshash(newpassword
, new_lanman_hash
) &&
114 E_deshash(oldpassword
, old_lanman_hash
)) {
115 /* E_deshash returns false for 'long' passwords (> 14
116 DOS chars). This allows us to match Win2k, which
117 does not store a LM hash for these passwords (which
118 would reduce the effective password length to 14) */
120 encode_pw_buffer(new_lm_password
.data
, newpassword
, STR_UNICODE
);
122 arcfour_crypt(new_lm_password
.data
, old_nt_hash
, 516);
123 E_old_pw_hash(new_nt_hash
, old_lanman_hash
, old_lanman_hash_enc
.hash
);
125 ZERO_STRUCT(new_lm_password
);
126 ZERO_STRUCT(old_lanman_hash_enc
);
129 encode_pw_buffer(new_nt_password
.data
, newpassword
, STR_UNICODE
);
131 arcfour_crypt(new_nt_password
.data
, old_nt_hash
, 516);
132 E_old_pw_hash(new_nt_hash
, old_nt_hash
, old_nt_hash_enc
.hash
);
134 result
= rpccli_samr_ChangePasswordUser2(cli
, mem_ctx
,
141 &old_lanman_hash_enc
);
146 /* User change password given blobs */
148 NTSTATUS
rpccli_samr_chng_pswd_auth_crap(struct rpc_pipe_client
*cli
,
150 const char *username
,
151 DATA_BLOB new_nt_password_blob
,
152 DATA_BLOB old_nt_hash_enc_blob
,
153 DATA_BLOB new_lm_password_blob
,
154 DATA_BLOB old_lm_hash_enc_blob
)
156 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
157 struct samr_CryptPassword new_nt_password
;
158 struct samr_CryptPassword new_lm_password
;
159 struct samr_Password old_nt_hash_enc
;
160 struct samr_Password old_lm_hash_enc
;
161 struct lsa_String server
, account
;
163 DEBUG(10,("rpccli_samr_chng_pswd_auth_crap\n"));
165 init_lsa_String(&server
, cli
->srv_name_slash
);
166 init_lsa_String(&account
, username
);
168 memcpy(&new_nt_password
.data
, new_nt_password_blob
.data
, 516);
169 memcpy(&new_lm_password
.data
, new_lm_password_blob
.data
, 516);
170 memcpy(&old_nt_hash_enc
.hash
, old_nt_hash_enc_blob
.data
, 16);
171 memcpy(&old_lm_hash_enc
.hash
, old_lm_hash_enc_blob
.data
, 16);
173 result
= rpccli_samr_ChangePasswordUser2(cli
, mem_ctx
,
185 /* change password 3 */
187 NTSTATUS
rpccli_samr_chgpasswd_user3(struct rpc_pipe_client
*cli
,
189 const char *username
,
190 const char *newpassword
,
191 const char *oldpassword
,
192 struct samr_DomInfo1
**dominfo1
,
193 struct userPwdChangeFailureInformation
**reject
)
197 struct samr_CryptPassword new_nt_password
;
198 struct samr_CryptPassword new_lm_password
;
199 struct samr_Password old_nt_hash_enc
;
200 struct samr_Password old_lanman_hash_enc
;
202 uchar old_nt_hash
[16];
203 uchar old_lanman_hash
[16];
204 uchar new_nt_hash
[16];
205 uchar new_lanman_hash
[16];
207 struct lsa_String server
, account
;
209 DEBUG(10,("rpccli_samr_chgpasswd_user3\n"));
211 init_lsa_String(&server
, cli
->srv_name_slash
);
212 init_lsa_String(&account
, username
);
214 /* Calculate the MD4 hash (NT compatible) of the password */
215 E_md4hash(oldpassword
, old_nt_hash
);
216 E_md4hash(newpassword
, new_nt_hash
);
218 if (lp_client_lanman_auth() &&
219 E_deshash(newpassword
, new_lanman_hash
) &&
220 E_deshash(oldpassword
, old_lanman_hash
)) {
221 /* E_deshash returns false for 'long' passwords (> 14
222 DOS chars). This allows us to match Win2k, which
223 does not store a LM hash for these passwords (which
224 would reduce the effective password length to 14) */
226 encode_pw_buffer(new_lm_password
.data
, newpassword
, STR_UNICODE
);
228 arcfour_crypt(new_lm_password
.data
, old_nt_hash
, 516);
229 E_old_pw_hash(new_nt_hash
, old_lanman_hash
, old_lanman_hash_enc
.hash
);
231 ZERO_STRUCT(new_lm_password
);
232 ZERO_STRUCT(old_lanman_hash_enc
);
235 encode_pw_buffer(new_nt_password
.data
, newpassword
, STR_UNICODE
);
237 arcfour_crypt(new_nt_password
.data
, old_nt_hash
, 516);
238 E_old_pw_hash(new_nt_hash
, old_nt_hash
, old_nt_hash_enc
.hash
);
240 status
= rpccli_samr_ChangePasswordUser3(cli
, mem_ctx
,
247 &old_lanman_hash_enc
,
254 /* This function returns the bizzare set of (max_entries, max_size) required
255 for the QueryDisplayInfo RPC to actually work against a domain controller
256 with large (10k and higher) numbers of users. These values were
257 obtained by inspection using ethereal and NT4 running User Manager. */
259 void get_query_dispinfo_params(int loop_count
, uint32
*max_entries
,
279 default: /* loop_count >= 4 */
286 NTSTATUS
rpccli_try_samr_connects(struct rpc_pipe_client
*cli
,
288 uint32_t access_mask
,
289 struct policy_handle
*connect_pol
)
292 union samr_ConnectInfo info_in
, info_out
;
293 struct samr_ConnectInfo1 info1
;
294 uint32_t lvl_out
= 0;
298 info1
.client_version
= SAMR_CONNECT_W2K
;
299 info_in
.info1
= info1
;
301 status
= rpccli_samr_Connect5(cli
, mem_ctx
,
309 if (NT_STATUS_IS_OK(status
)) {
313 status
= rpccli_samr_Connect4(cli
, mem_ctx
,
318 if (NT_STATUS_IS_OK(status
)) {
322 status
= rpccli_samr_Connect2(cli
, mem_ctx
,