?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tdb: Purge dead records whenever we block the freelist
[Samba.git] / source3 / rpcclient / cmd_lsarpc.c
blob462ed06e0078eb83d777ceb5f331e9e49621c468
1 /*
2 Unix SMB/CIFS implementation.
3 RPC pipe client
4
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
7 Copyright (C) Guenther Deschner 2008
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpcclient.h"
25 #include "../libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_lsa.h"
27 #include "../librpc/gen_ndr/ndr_lsa_c.h"
28 #include "rpc_client/cli_lsarpc.h"
29 #include "rpc_client/init_lsa.h"
30 #include "../libcli/security/security.h"
31
32 /* useful function to allow entering a name instead of a SID and
33 * looking it up automatically */
34 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
35 TALLOC_CTX *mem_ctx,
36 struct dom_sid *sid, const char *name)
37 {
38 struct policy_handle pol;
39 enum lsa_SidType *sid_types;
40 NTSTATUS status, result;
41 struct dom_sid *sids;
42 struct dcerpc_binding_handle *b = cli->binding_handle;
43
44 /* maybe its a raw SID */
45 if (strncmp(name, "S-", 2) == 0 &&
46 string_to_sid(sid, name)) {
47 return NT_STATUS_OK;
48 }
49
50 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
51 SEC_FLAG_MAXIMUM_ALLOWED,
52 &pol);
53 if (!NT_STATUS_IS_OK(status))
54 goto done;
55
56 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
57 if (!NT_STATUS_IS_OK(status))
58 goto done;
59
60 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
61
62 *sid = sids[0];
63
64 done:
65 return status;
66 }
67
68 static void display_query_info_1(struct lsa_AuditLogInfo *r)
69 {
70 d_printf("percent_full:\t%d\n", r->percent_full);
71 d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
72 d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
73 d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
74 d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
75 d_printf("next_audit_record:\t%d\n", r->next_audit_record);
76 }
77
78 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
79 {
80 int i;
81 d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
82 d_printf("Auditing categories:\t%d\n", r->count);
83 d_printf("Auditsettings:\n");
84 for (i=0; i<r->count; i++) {
85 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
86 const char *policy = audit_description_str(i);
87 d_printf("%s:\t%s\n", policy, val);
88 }
89 }
90
91 static void display_query_info_3(struct lsa_DomainInfo *r)
92 {
93 d_printf("Domain Name: %s\n", r->name.string);
94 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
95 }
96
97 static void display_query_info_5(struct lsa_DomainInfo *r)
98 {
99 d_printf("Domain Name: %s\n", r->name.string);
100 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
101 }
102
103 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
104 {
105 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
106 }
107
108 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
109 {
110 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
111 d_printf("Log is full: %d\n", r->log_is_full);
112 }
113
114 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
115 {
116 d_printf("Domain NetBios Name: %s\n", r->name.string);
117 d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
118 d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
119 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
120 d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
121 &r->domain_guid));
122 }
123
124 static void display_lsa_query_info(union lsa_PolicyInformation *info,
125 enum lsa_PolicyInfo level)
126 {
127 switch (level) {
128 case 1:
129 display_query_info_1(&info->audit_log);
130 break;
131 case 2:
132 display_query_info_2(&info->audit_events);
133 break;
134 case 3:
135 display_query_info_3(&info->domain);
136 break;
137 case 5:
138 display_query_info_5(&info->account_domain);
139 break;
140 case 10:
141 display_query_info_10(&info->auditfullset);
142 break;
143 case 11:
144 display_query_info_11(&info->auditfullquery);
145 break;
146 case 12:
147 display_query_info_12(&info->dns);
148 break;
149 default:
150 printf("can't display info level: %d\n", level);
151 break;
152 }
153 }
154
155 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
156 TALLOC_CTX *mem_ctx, int argc,
157 const char **argv)
158 {
159 struct policy_handle pol;
160 NTSTATUS status, result;
161 union lsa_PolicyInformation *info = NULL;
162 struct dcerpc_binding_handle *b = cli->binding_handle;
163
164 uint32_t info_class = 3;
165
166 if (argc > 2) {
167 printf("Usage: %s [info_class]\n", argv[0]);
168 return NT_STATUS_OK;
169 }
170
171 if (argc == 2)
172 info_class = atoi(argv[1]);
173
174 switch (info_class) {
175 case 12:
176 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
177 SEC_FLAG_MAXIMUM_ALLOWED,
178 &pol);
179
180 if (!NT_STATUS_IS_OK(status))
181 goto done;
182
183 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
184 &pol,
185 info_class,
186 &info,
187 &result);
188 break;
189 default:
190 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
191 SEC_FLAG_MAXIMUM_ALLOWED,
192 &pol);
193
194 if (!NT_STATUS_IS_OK(status))
195 goto done;
196
197 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
198 &pol,
199 info_class,
200 &info,
201 &result);
202 }
203
204 if (!NT_STATUS_IS_OK(status)) {
205 goto done;
206 }
207 status = result;
208 if (NT_STATUS_IS_OK(result)) {
209 display_lsa_query_info(info, info_class);
210 }
211
212 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
213
214 done:
215 return status;
216 }
217
218 /* Resolve a list of names to a list of sids */
219
220 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
221 TALLOC_CTX *mem_ctx, int argc,
222 const char **argv)
223 {
224 struct policy_handle pol;
225 NTSTATUS status, result;
226 struct dom_sid *sids;
227 enum lsa_SidType *types;
228 int i;
229 struct dcerpc_binding_handle *b = cli->binding_handle;
230
231 if (argc == 1) {
232 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
233 return NT_STATUS_OK;
234 }
235
236 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
237 SEC_FLAG_MAXIMUM_ALLOWED,
238 &pol);
239
240 if (!NT_STATUS_IS_OK(status))
241 goto done;
242
243 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
244 (const char**)(argv + 1), NULL, 1, &sids, &types);
245
246 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
247 NT_STATUS_V(STATUS_SOME_UNMAPPED))
248 goto done;
249
250 status = NT_STATUS_OK;
251
252 /* Print results */
253
254 for (i = 0; i < (argc - 1); i++) {
255 fstring sid_str;
256 sid_to_fstring(sid_str, &sids[i]);
257 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
258 sid_type_lookup(types[i]), types[i]);
259 }
260
261 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
262
263 done:
264 return status;
265 }
266
267 /* Resolve a list of names to a list of sids */
268
269 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
270 TALLOC_CTX *mem_ctx, int argc,
271 const char **argv)
272 {
273 struct policy_handle pol;
274 NTSTATUS status, result;
275 struct dom_sid *sids = NULL;
276 enum lsa_SidType *types = NULL;
277 int i, level;
278 struct dcerpc_binding_handle *b = cli->binding_handle;
279
280 if (argc < 3) {
281 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
282 return NT_STATUS_OK;
283 }
284
285 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
286 SEC_FLAG_MAXIMUM_ALLOWED,
287 &pol);
288 if (!NT_STATUS_IS_OK(status)) {
289 goto done;
290 }
291
292 level = atoi(argv[1]);
293
294 status = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
295 (const char**)(argv + 2), NULL, level, &sids, &types);
296
297 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
298 NT_STATUS_V(STATUS_SOME_UNMAPPED))
299 {
300 goto done;
301 }
302
303 status = NT_STATUS_OK;
304
305 /* Print results */
306
307 for (i = 0; i < (argc - 2); i++) {
308 fstring sid_str;
309 sid_to_fstring(sid_str, &sids[i]);
310 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
311 sid_type_lookup(types[i]), types[i]);
312 }
313
314 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
315
316 done:
317 return status;
318 }
319
320 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
321 TALLOC_CTX *mem_ctx, int argc,
322 const char **argv)
323 {
324 NTSTATUS status, result;
325
326 uint32_t num_names;
327 struct lsa_String *names;
328 struct lsa_RefDomainList *domains = NULL;
329 struct lsa_TransSidArray3 sids;
330 uint32_t count = 0;
331 int i;
332 struct dcerpc_binding_handle *b = cli->binding_handle;
333
334 if (argc == 1) {
335 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
336 return NT_STATUS_OK;
337 }
338
339 ZERO_STRUCT(sids);
340
341 num_names = argc-1;
342 names = talloc_array(mem_ctx, struct lsa_String, num_names);
343 NT_STATUS_HAVE_NO_MEMORY(names);
344
345 for (i=0; i < num_names; i++) {
346 init_lsa_String(&names[i], argv[i+1]);
347 }
348
349 status = dcerpc_lsa_LookupNames4(b, mem_ctx,
350 num_names,
351 names,
352 &domains,
353 &sids,
354 1,
355 &count,
356 0,
357 0,
358 &result);
359 if (!NT_STATUS_IS_OK(status)) {
360 return status;
361 }
362 if (!NT_STATUS_IS_OK(result)) {
363 return result;
364 }
365
366 if (sids.count != num_names) {
367 return NT_STATUS_INVALID_NETWORK_RESPONSE;
368 }
369
370 for (i = 0; i < sids.count; i++) {
371 fstring sid_str;
372 sid_to_fstring(sid_str, sids.sids[i].sid);
373 printf("%s %s (%s: %d)\n", argv[i+1], sid_str,
374 sid_type_lookup(sids.sids[i].sid_type),
375 sids.sids[i].sid_type);
376 }
377
378 return status;
379 }
380
381 /* Resolve a list of SIDs to a list of names */
382
383 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
384 int argc, const char **argv)
385 {
386 struct policy_handle pol;
387 NTSTATUS status, result;
388 struct dom_sid *sids;
389 char **domains;
390 char **names;
391 enum lsa_SidType *types;
392 int i;
393 struct dcerpc_binding_handle *b = cli->binding_handle;
394
395 if (argc == 1) {
396 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
397 return NT_STATUS_OK;
398 }
399
400 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
401 SEC_FLAG_MAXIMUM_ALLOWED,
402 &pol);
403
404 if (!NT_STATUS_IS_OK(status))
405 goto done;
406
407 /* Convert arguments to sids */
408
409 sids = talloc_array(mem_ctx, struct dom_sid, argc - 1);
410
411 if (!sids) {
412 printf("could not allocate memory for %d sids\n", argc - 1);
413 goto done;
414 }
415
416 for (i = 0; i < argc - 1; i++)
417 if (!string_to_sid(&sids[i], argv[i + 1])) {
418 status = NT_STATUS_INVALID_SID;
419 goto done;
420 }
421
422 /* Lookup the SIDs */
423
424 status = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
425 &domains, &names, &types);
426
427 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
428 NT_STATUS_V(STATUS_SOME_UNMAPPED))
429 goto done;
430
431 status = NT_STATUS_OK;
432
433 /* Print results */
434
435 for (i = 0; i < (argc - 1); i++) {
436 fstring sid_str;
437
438 sid_to_fstring(sid_str, &sids[i]);
439 if (types[i] == SID_NAME_DOMAIN) {
440 printf("%s %s (%d)\n", sid_str,
441 domains[i] ? domains[i] : "*unknown*",
442 types[i]);
443 } else {
444 printf("%s %s\\%s (%d)\n", sid_str,
445 domains[i] ? domains[i] : "*unknown*",
446 names[i] ? names[i] : "*unknown*",
447 types[i]);
448 }
449 }
450
451 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
452
453 done:
454 return status;
455 }
456
457 static NTSTATUS cmd_lsa_lookup_sids_level(struct rpc_pipe_client *cli,
458 TALLOC_CTX *mem_ctx, int argc,
459 const char **argv)
460 {
461 struct policy_handle pol;
462 NTSTATUS status, result;
463 struct dom_sid *sids = NULL;
464 char **domains = NULL;
465 char **names = NULL;
466 enum lsa_SidType *types = NULL;
467 int i, level;
468 struct dcerpc_binding_handle *b = cli->binding_handle;
469
470 if (argc < 3) {
471 printf("Usage: %s [level] [sid1 [sid2 [...]]]\n", argv[0]);
472 return NT_STATUS_OK;
473 }
474
475 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
476 SEC_FLAG_MAXIMUM_ALLOWED,
477 &pol);
478 if (!NT_STATUS_IS_OK(status)) {
479 goto done;
480 }
481
482 level = atoi(argv[1]);
483
484 /* Convert arguments to sids */
485
486 sids = talloc_array(mem_ctx, struct dom_sid, argc - 2);
487 if (sids == NULL) {
488 printf("could not allocate memory for %d sids\n", argc - 2);
489 goto done;
490 }
491
492 for (i = 0; i < argc - 2; i++) {
493 if (!string_to_sid(&sids[i], argv[i + 2])) {
494 status = NT_STATUS_INVALID_SID;
495 goto done;
496 }
497 }
498
499 /* Lookup the SIDs */
500
501 status = dcerpc_lsa_lookup_sids_generic(cli->binding_handle,
502 mem_ctx,
503 &pol,
504 argc - 2,
505 sids,
506 level,
507 &domains,
508 &names,
509 &types,
510 false,
511 &result);
512 if (!NT_STATUS_IS_OK(status)) {
513 goto done;
514 }
515 status = result;
516
517 if (!NT_STATUS_IS_OK(status) && NT_STATUS_V(status) !=
518 NT_STATUS_V(STATUS_SOME_UNMAPPED))
519 {
520 goto done;
521 }
522
523 status = NT_STATUS_OK;
524
525 /* Print results */
526
527 for (i = 0; i < (argc - 2); i++) {
528 fstring sid_str;
529
530 sid_to_fstring(sid_str, &sids[i]);
531 if (types[i] == SID_NAME_DOMAIN) {
532 printf("%s %s (%d)\n", sid_str,
533 domains[i] ? domains[i] : "*unknown*",
534 types[i]);
535 } else {
536 printf("%s %s\\%s (%d)\n", sid_str,
537 domains[i] ? domains[i] : "*unknown*",
538 names[i] ? names[i] : "*unknown*",
539 types[i]);
540 }
541 }
542
543 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
544
545 done:
546 return status;
547 }
548
549 /* Resolve a list of SIDs to a list of names */
550
551 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
552 TALLOC_CTX *mem_ctx,
553 int argc, const char **argv)
554 {
555 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
556 int i;
557 struct lsa_SidArray sids;
558 struct lsa_RefDomainList *domains = NULL;
559 struct lsa_TransNameArray2 names;
560 uint32_t count = 0;
561 struct dcerpc_binding_handle *b = cli->binding_handle;
562
563 if (argc == 1) {
564 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
565 return NT_STATUS_OK;
566 }
567
568 ZERO_STRUCT(names);
569
570 /* Convert arguments to sids */
571
572 sids.num_sids = argc-1;
573 sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
574 if (!sids.sids) {
575 printf("could not allocate memory for %d sids\n", sids.num_sids);
576 goto done;
577 }
578
579 for (i = 0; i < sids.num_sids; i++) {
580 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
581 if (sids.sids[i].sid == NULL) {
582 status = NT_STATUS_NO_MEMORY;
583 goto done;
584 }
585 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
586 status = NT_STATUS_INVALID_SID;
587 goto done;
588 }
589 }
590
591 /* Lookup the SIDs */
592 status = dcerpc_lsa_LookupSids3(b, mem_ctx,
593 &sids,
594 &domains,
595 &names,
596 1,
597 &count,
598 0,
599 0,
600 &result);
601 if (!NT_STATUS_IS_OK(status)) {
602 goto done;
603 }
604 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
605 NT_STATUS_V(STATUS_SOME_UNMAPPED)) {
606 status = result;
607 goto done;
608 }
609
610 status = NT_STATUS_OK;
611
612 /* Print results */
613
614 for (i = 0; i < names.count; i++) {
615 fstring sid_str;
616
617 if (i >= sids.num_sids) {
618 break;
619 }
620 sid_to_fstring(sid_str, sids.sids[i].sid);
621 printf("%s %s (%d)\n", sid_str,
622 names.names[i].name.string,
623 names.names[i].sid_type);
624 }
625
626 done:
627 return status;
628 }
629
630
631 /* Enumerate list of trusted domains */
632
633 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
634 TALLOC_CTX *mem_ctx, int argc,
635 const char **argv)
636 {
637 struct policy_handle pol;
638 NTSTATUS status, result;
639 struct lsa_DomainList domain_list;
640 struct dcerpc_binding_handle *b = cli->binding_handle;
641
642 /* defaults, but may be changed using params */
643 uint32_t enum_ctx = 0;
644 int i;
645 uint32_t max_size = (uint32_t)-1;
646
647 if (argc > 2) {
648 printf("Usage: %s [enum context (0)]\n", argv[0]);
649 return NT_STATUS_OK;
650 }
651
652 if (argc == 2 && argv[1]) {
653 enum_ctx = atoi(argv[2]);
654 }
655
656 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
657 LSA_POLICY_VIEW_LOCAL_INFORMATION,
658 &pol);
659
660 if (!NT_STATUS_IS_OK(status))
661 goto done;
662
663 status = STATUS_MORE_ENTRIES;
664
665 while (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
666
667 /* Lookup list of trusted domains */
668
669 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
670 &pol,
671 &enum_ctx,
672 &domain_list,
673 max_size,
674 &result);
675 if (!NT_STATUS_IS_OK(status)) {
676 goto done;
677 }
678 if (!NT_STATUS_IS_OK(result) &&
679 !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
680 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
681 status = result;
682 goto done;
683 }
684
685 /* Print results: list of names and sids returned in this
686 * response. */
687 for (i = 0; i < domain_list.count; i++) {
688 fstring sid_str;
689
690 sid_to_fstring(sid_str, domain_list.domains[i].sid);
691 printf("%s %s\n",
692 domain_list.domains[i].name.string ?
693 domain_list.domains[i].name.string : "*unknown*",
694 sid_str);
695 }
696 }
697
698 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
699 done:
700 return status;
701 }
702
703 /* Enumerates privileges */
704
705 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
706 TALLOC_CTX *mem_ctx, int argc,
707 const char **argv)
708 {
709 struct policy_handle pol;
710 NTSTATUS status, result;
711 struct lsa_PrivArray priv_array;
712 struct dcerpc_binding_handle *b = cli->binding_handle;
713
714 uint32_t enum_context=0;
715 uint32_t pref_max_length=0x1000;
716 int i;
717
718 if (argc > 3) {
719 printf("Usage: %s [enum context] [max length]\n", argv[0]);
720 return NT_STATUS_OK;
721 }
722
723 if (argc>=2)
724 enum_context=atoi(argv[1]);
725
726 if (argc==3)
727 pref_max_length=atoi(argv[2]);
728
729 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
730 SEC_FLAG_MAXIMUM_ALLOWED,
731 &pol);
732
733 if (!NT_STATUS_IS_OK(status))
734 goto done;
735
736 status = dcerpc_lsa_EnumPrivs(b, mem_ctx,
737 &pol,
738 &enum_context,
739 &priv_array,
740 pref_max_length,
741 &result);
742 if (!NT_STATUS_IS_OK(status))
743 goto done;
744 if (!NT_STATUS_IS_OK(result)) {
745 status = result;
746 goto done;
747 }
748
749 /* Print results */
750 printf("found %d privileges\n\n", priv_array.count);
751
752 for (i = 0; i < priv_array.count; i++) {
753 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
754 priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
755 priv_array.privs[i].luid.high,
756 priv_array.privs[i].luid.low,
757 priv_array.privs[i].luid.high,
758 priv_array.privs[i].luid.low);
759 }
760
761 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
762 done:
763 return status;
764 }
765
766 /* Get privilege name */
767
768 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
769 TALLOC_CTX *mem_ctx, int argc,
770 const char **argv)
771 {
772 struct policy_handle pol;
773 NTSTATUS status, result;
774 struct dcerpc_binding_handle *b = cli->binding_handle;
775
776 uint16_t lang_id=0;
777 uint16_t lang_id_sys=0;
778 uint16_t lang_id_desc;
779 struct lsa_String lsa_name;
780 struct lsa_StringLarge *description = NULL;
781
782 if (argc != 2) {
783 printf("Usage: %s privilege name\n", argv[0]);
784 return NT_STATUS_OK;
785 }
786
787 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
788 SEC_FLAG_MAXIMUM_ALLOWED,
789 &pol);
790
791 if (!NT_STATUS_IS_OK(status))
792 goto done;
793
794 init_lsa_String(&lsa_name, argv[1]);
795
796 status = dcerpc_lsa_LookupPrivDisplayName(b, mem_ctx,
797 &pol,
798 &lsa_name,
799 lang_id,
800 lang_id_sys,
801 &description,
802 &lang_id_desc,
803 &result);
804 if (!NT_STATUS_IS_OK(status))
805 goto done;
806 if (!NT_STATUS_IS_OK(result)) {
807 status = result;
808 goto done;
809 }
810
811 /* Print results */
812 printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
813
814 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
815 done:
816 return status;
817 }
818
819 /* Enumerate the LSA SIDS */
820
821 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
822 TALLOC_CTX *mem_ctx, int argc,
823 const char **argv)
824 {
825 struct policy_handle pol;
826 NTSTATUS status, result;
827 struct dcerpc_binding_handle *b = cli->binding_handle;
828
829 uint32_t enum_context=0;
830 uint32_t pref_max_length=0x1000;
831 struct lsa_SidArray sid_array;
832 int i;
833
834 if (argc > 3) {
835 printf("Usage: %s [enum context] [max length]\n", argv[0]);
836 return NT_STATUS_OK;
837 }
838
839 if (argc>=2)
840 enum_context=atoi(argv[1]);
841
842 if (argc==3)
843 pref_max_length=atoi(argv[2]);
844
845 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
846 SEC_FLAG_MAXIMUM_ALLOWED,
847 &pol);
848
849 if (!NT_STATUS_IS_OK(status))
850 goto done;
851
852 status = dcerpc_lsa_EnumAccounts(b, mem_ctx,
853 &pol,
854 &enum_context,
855 &sid_array,
856 pref_max_length,
857 &result);
858 if (!NT_STATUS_IS_OK(status))
859 goto done;
860 if (!NT_STATUS_IS_OK(result)) {
861 status = result;
862 goto done;
863 }
864
865 /* Print results */
866 printf("found %d SIDs\n\n", sid_array.num_sids);
867
868 for (i = 0; i < sid_array.num_sids; i++) {
869 fstring sid_str;
870
871 sid_to_fstring(sid_str, sid_array.sids[i].sid);
872 printf("%s\n", sid_str);
873 }
874
875 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
876 done:
877 return status;
878 }
879
880 /* Create a new account */
881
882 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
883 TALLOC_CTX *mem_ctx, int argc,
884 const char **argv)
885 {
886 struct policy_handle dom_pol;
887 struct policy_handle user_pol;
888 NTSTATUS status, result;
889 uint32_t des_access = 0x000f000f;
890 struct dcerpc_binding_handle *b = cli->binding_handle;
891
892 struct dom_sid sid;
893
894 if (argc != 2 ) {
895 printf("Usage: %s SID\n", argv[0]);
896 return NT_STATUS_OK;
897 }
898
899 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
900 if (!NT_STATUS_IS_OK(status))
901 goto done;
902
903 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
904 SEC_FLAG_MAXIMUM_ALLOWED,
905 &dom_pol);
906
907 if (!NT_STATUS_IS_OK(status))
908 goto done;
909
910 status = dcerpc_lsa_CreateAccount(b, mem_ctx,
911 &dom_pol,
912 &sid,
913 des_access,
914 &user_pol,
915 &result);
916 if (!NT_STATUS_IS_OK(status))
917 goto done;
918 if (!NT_STATUS_IS_OK(result)) {
919 status = result;
920 goto done;
921 }
922
923 printf("Account for SID %s successfully created\n\n", argv[1]);
924 status = NT_STATUS_OK;
925
926 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
927 done:
928 return status;
929 }
930
931
932 /* Enumerate the privileges of an SID */
933
934 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
935 TALLOC_CTX *mem_ctx, int argc,
936 const char **argv)
937 {
938 struct policy_handle dom_pol;
939 struct policy_handle user_pol;
940 NTSTATUS status, result;
941 uint32_t access_desired = 0x000f000f;
942 struct dom_sid sid;
943 struct lsa_PrivilegeSet *privs = NULL;
944 int i;
945 struct dcerpc_binding_handle *b = cli->binding_handle;
946
947 if (argc != 2 ) {
948 printf("Usage: %s SID\n", argv[0]);
949 return NT_STATUS_OK;
950 }
951
952 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
953 if (!NT_STATUS_IS_OK(status))
954 goto done;
955
956 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
957 SEC_FLAG_MAXIMUM_ALLOWED,
958 &dom_pol);
959
960 if (!NT_STATUS_IS_OK(status))
961 goto done;
962
963 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
964 &dom_pol,
965 &sid,
966 access_desired,
967 &user_pol,
968 &result);
969 if (!NT_STATUS_IS_OK(status))
970 goto done;
971 if (!NT_STATUS_IS_OK(result)) {
972 status = result;
973 goto done;
974 }
975
976 status = dcerpc_lsa_EnumPrivsAccount(b, mem_ctx,
977 &user_pol,
978 &privs,
979 &result);
980 if (!NT_STATUS_IS_OK(status))
981 goto done;
982 if (!NT_STATUS_IS_OK(result)) {
983 status = result;
984 goto done;
985 }
986
987 /* Print results */
988 printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
989 printf("high\tlow\tattribute\n");
990
991 for (i = 0; i < privs->count; i++) {
992 printf("%u\t%u\t%u\n",
993 privs->set[i].luid.high,
994 privs->set[i].luid.low,
995 privs->set[i].attribute);
996 }
997
998 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
999 done:
1000 return status;
1001 }
1002
1003
1004 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
1005
1006 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
1007 TALLOC_CTX *mem_ctx, int argc,
1008 const char **argv)
1009 {
1010 struct policy_handle dom_pol;
1011 NTSTATUS status, result;
1012 struct dom_sid sid;
1013 struct lsa_RightSet rights;
1014 struct dcerpc_binding_handle *b = cli->binding_handle;
1015
1016 int i;
1017
1018 if (argc != 2 ) {
1019 printf("Usage: %s SID\n", argv[0]);
1020 return NT_STATUS_OK;
1021 }
1022
1023 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1024 if (!NT_STATUS_IS_OK(status))
1025 goto done;
1026
1027 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1028 SEC_FLAG_MAXIMUM_ALLOWED,
1029 &dom_pol);
1030
1031 if (!NT_STATUS_IS_OK(status))
1032 goto done;
1033
1034 status = dcerpc_lsa_EnumAccountRights(b, mem_ctx,
1035 &dom_pol,
1036 &sid,
1037 &rights,
1038 &result);
1039 if (!NT_STATUS_IS_OK(status))
1040 goto done;
1041 if (!NT_STATUS_IS_OK(result)) {
1042 status = result;
1043 goto done;
1044 }
1045
1046 printf("found %d privileges for SID %s\n", rights.count,
1047 sid_string_tos(&sid));
1048
1049 for (i = 0; i < rights.count; i++) {
1050 printf("\t%s\n", rights.names[i].string);
1051 }
1052
1053 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1054 done:
1055 return status;
1056 }
1057
1058
1059 /* add some privileges to a SID via LsaAddAccountRights */
1060
1061 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
1062 TALLOC_CTX *mem_ctx, int argc,
1063 const char **argv)
1064 {
1065 struct policy_handle dom_pol;
1066 NTSTATUS status, result;
1067 struct lsa_RightSet rights;
1068 struct dom_sid sid;
1069 int i;
1070 struct dcerpc_binding_handle *b = cli->binding_handle;
1071
1072 if (argc < 3 ) {
1073 printf("Usage: %s SID [rights...]\n", argv[0]);
1074 return NT_STATUS_OK;
1075 }
1076
1077 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1078 if (!NT_STATUS_IS_OK(status))
1079 goto done;
1080
1081 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1082 SEC_FLAG_MAXIMUM_ALLOWED,
1083 &dom_pol);
1084
1085 if (!NT_STATUS_IS_OK(status))
1086 goto done;
1087
1088 rights.count = argc-2;
1089 rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
1090 rights.count);
1091 if (!rights.names) {
1092 return NT_STATUS_NO_MEMORY;
1093 }
1094
1095 for (i=0; i<argc-2; i++) {
1096 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1097 }
1098
1099 status = dcerpc_lsa_AddAccountRights(b, mem_ctx,
1100 &dom_pol,
1101 &sid,
1102 &rights,
1103 &result);
1104 if (!NT_STATUS_IS_OK(status))
1105 goto done;
1106 if (!NT_STATUS_IS_OK(result)) {
1107 status = result;
1108 goto done;
1109 }
1110
1111 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1112 done:
1113 return status;
1114 }
1115
1116
1117 /* remove some privileges to a SID via LsaRemoveAccountRights */
1118
1119 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
1120 TALLOC_CTX *mem_ctx, int argc,
1121 const char **argv)
1122 {
1123 struct policy_handle dom_pol;
1124 NTSTATUS status, result;
1125 struct lsa_RightSet rights;
1126 struct dom_sid sid;
1127 int i;
1128 struct dcerpc_binding_handle *b = cli->binding_handle;
1129
1130 if (argc < 3 ) {
1131 printf("Usage: %s SID [rights...]\n", argv[0]);
1132 return NT_STATUS_OK;
1133 }
1134
1135 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1136 if (!NT_STATUS_IS_OK(status))
1137 goto done;
1138
1139 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1140 SEC_FLAG_MAXIMUM_ALLOWED,
1141 &dom_pol);
1142
1143 if (!NT_STATUS_IS_OK(status))
1144 goto done;
1145
1146 rights.count = argc-2;
1147 rights.names = talloc_array(mem_ctx, struct lsa_StringLarge,
1148 rights.count);
1149 if (!rights.names) {
1150 return NT_STATUS_NO_MEMORY;
1151 }
1152
1153 for (i=0; i<argc-2; i++) {
1154 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
1155 }
1156
1157 status = dcerpc_lsa_RemoveAccountRights(b, mem_ctx,
1158 &dom_pol,
1159 &sid,
1160 false,
1161 &rights,
1162 &result);
1163 if (!NT_STATUS_IS_OK(status))
1164 goto done;
1165 if (!NT_STATUS_IS_OK(result)) {
1166 status = result;
1167 goto done;
1168 }
1169
1170 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1171
1172 done:
1173 return status;
1174 }
1175
1176
1177 /* Get a privilege value given its name */
1178
1179 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
1180 TALLOC_CTX *mem_ctx, int argc,
1181 const char **argv)
1182 {
1183 struct policy_handle pol;
1184 NTSTATUS status, result;
1185 struct lsa_LUID luid;
1186 struct lsa_String name;
1187 struct dcerpc_binding_handle *b = cli->binding_handle;
1188
1189 if (argc != 2 ) {
1190 printf("Usage: %s name\n", argv[0]);
1191 return NT_STATUS_OK;
1192 }
1193
1194 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1195 SEC_FLAG_MAXIMUM_ALLOWED,
1196 &pol);
1197
1198 if (!NT_STATUS_IS_OK(status))
1199 goto done;
1200
1201 init_lsa_String(&name, argv[1]);
1202
1203 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1204 &pol,
1205 &name,
1206 &luid,
1207 &result);
1208 if (!NT_STATUS_IS_OK(status))
1209 goto done;
1210 if (!NT_STATUS_IS_OK(result)) {
1211 status = result;
1212 goto done;
1213 }
1214
1215 /* Print results */
1216
1217 printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1218
1219 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1220 done:
1221 return status;
1222 }
1223
1224 /* Query LSA security object */
1225
1226 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1227 TALLOC_CTX *mem_ctx, int argc,
1228 const char **argv)
1229 {
1230 struct policy_handle pol;
1231 NTSTATUS status, result;
1232 struct sec_desc_buf *sdb;
1233 uint32_t sec_info = SECINFO_DACL;
1234 struct dcerpc_binding_handle *b = cli->binding_handle;
1235
1236 if (argc < 1 || argc > 2) {
1237 printf("Usage: %s [sec_info]\n", argv[0]);
1238 return NT_STATUS_OK;
1239 }
1240
1241 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1242 SEC_FLAG_MAXIMUM_ALLOWED,
1243 &pol);
1244
1245 if (argc == 2)
1246 sscanf(argv[1], "%x", &sec_info);
1247
1248 if (!NT_STATUS_IS_OK(status))
1249 goto done;
1250
1251 status = dcerpc_lsa_QuerySecurity(b, mem_ctx,
1252 &pol,
1253 sec_info,
1254 &sdb,
1255 &result);
1256 if (!NT_STATUS_IS_OK(status))
1257 goto done;
1258 if (!NT_STATUS_IS_OK(result)) {
1259 status = result;
1260 goto done;
1261 }
1262
1263 /* Print results */
1264
1265 display_sec_desc(sdb->sd);
1266
1267 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1268 done:
1269 return status;
1270 }
1271
1272 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1273 DATA_BLOB session_key)
1274 {
1275 char *pwd, *pwd_old;
1276
1277 DATA_BLOB data = data_blob_const(p->password->data, p->password->length);
1278 DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1279
1280 pwd = sess_decrypt_string(talloc_tos(), &data, &session_key);
1281 pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key);
1282
1283 d_printf("Password:\t%s\n", pwd);
1284 d_printf("Old Password:\t%s\n", pwd_old);
1285
1286 talloc_free(pwd);
1287 talloc_free(pwd_old);
1288 }
1289
1290 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1291 union lsa_TrustedDomainInfo *info,
1292 enum lsa_TrustDomInfoEnum info_class,
1293 DATA_BLOB session_key)
1294 {
1295 switch (info_class) {
1296 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1297 display_trust_dom_info_4(&info->password, session_key);
1298 break;
1299 default: {
1300 const char *str = NULL;
1301 str = NDR_PRINT_UNION_STRING(mem_ctx,
1302 lsa_TrustedDomainInfo,
1303 info_class, info);
1304 if (str) {
1305 d_printf("%s\n", str);
1306 }
1307 break;
1308 }
1309 }
1310 }
1311
1312 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1313 TALLOC_CTX *mem_ctx, int argc,
1314 const char **argv)
1315 {
1316 struct policy_handle pol;
1317 NTSTATUS status, result;
1318 struct dom_sid dom_sid;
1319 uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1320 union lsa_TrustedDomainInfo *info = NULL;
1321 enum lsa_TrustDomInfoEnum info_class = 1;
1322 DATA_BLOB session_key;
1323 struct dcerpc_binding_handle *b = cli->binding_handle;
1324
1325 if (argc > 3 || argc < 2) {
1326 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1327 return NT_STATUS_OK;
1328 }
1329
1330 if (!string_to_sid(&dom_sid, argv[1]))
1331 return NT_STATUS_NO_MEMORY;
1332
1333 if (argc == 3)
1334 info_class = atoi(argv[2]);
1335
1336 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1337
1338 if (!NT_STATUS_IS_OK(status))
1339 goto done;
1340
1341 status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
1342 &pol,
1343 &dom_sid,
1344 info_class,
1345 &info,
1346 &result);
1347 if (!NT_STATUS_IS_OK(status))
1348 goto done;
1349 if (!NT_STATUS_IS_OK(result)) {
1350 status = result;
1351 goto done;
1352 }
1353
1354 status = cli_get_session_key(mem_ctx, cli, &session_key);
1355 if (!NT_STATUS_IS_OK(status)) {
1356 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1357 goto done;
1358 }
1359
1360 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1361
1362 done:
1363 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1364
1365 return status;
1366 }
1367
1368 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1369 TALLOC_CTX *mem_ctx, int argc,
1370 const char **argv)
1371 {
1372 struct policy_handle pol;
1373 NTSTATUS status, result;
1374 uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1375 union lsa_TrustedDomainInfo *info = NULL;
1376 enum lsa_TrustDomInfoEnum info_class = 1;
1377 struct lsa_String trusted_domain;
1378 struct dcerpc_binding_handle *b = cli->binding_handle;
1379 DATA_BLOB session_key;
1380
1381 if (argc > 3 || argc < 2) {
1382 printf("Usage: %s [name] [info_class]\n", argv[0]);
1383 return NT_STATUS_OK;
1384 }
1385
1386 if (argc == 3)
1387 info_class = atoi(argv[2]);
1388
1389 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1390
1391 if (!NT_STATUS_IS_OK(status))
1392 goto done;
1393
1394 init_lsa_String(&trusted_domain, argv[1]);
1395
1396 status = dcerpc_lsa_QueryTrustedDomainInfoByName(b, mem_ctx,
1397 &pol,
1398 &trusted_domain,
1399 info_class,
1400 &info,
1401 &result);
1402 if (!NT_STATUS_IS_OK(status))
1403 goto done;
1404 if (!NT_STATUS_IS_OK(result)) {
1405 status = result;
1406 goto done;
1407 }
1408
1409 status = cli_get_session_key(mem_ctx, cli, &session_key);
1410 if (!NT_STATUS_IS_OK(status)) {
1411 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1412 goto done;
1413 }
1414
1415 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1416
1417 done:
1418 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1419
1420 return status;
1421 }
1422
1423 static NTSTATUS cmd_lsa_set_trustdominfo(struct rpc_pipe_client *cli,
1424 TALLOC_CTX *mem_ctx, int argc,
1425 const char **argv)
1426 {
1427 struct policy_handle pol, trustdom_pol;
1428 NTSTATUS status, result;
1429 uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1430 union lsa_TrustedDomainInfo info;
1431 struct dom_sid dom_sid;
1432 enum lsa_TrustDomInfoEnum info_class = 1;
1433 struct dcerpc_binding_handle *b = cli->binding_handle;
1434
1435 if (argc > 4 || argc < 3) {
1436 printf("Usage: %s [sid] [info_class] [value]\n", argv[0]);
1437 return NT_STATUS_OK;
1438 }
1439
1440 if (!string_to_sid(&dom_sid, argv[1])) {
1441 return NT_STATUS_NO_MEMORY;
1442 }
1443
1444
1445 info_class = atoi(argv[2]);
1446
1447 switch (info_class) {
1448 case 13: /* LSA_TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES */
1449 info.enc_types.enc_types = atoi(argv[3]);
1450 break;
1451 default:
1452 return NT_STATUS_INVALID_PARAMETER;
1453 }
1454
1455 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1456 if (!NT_STATUS_IS_OK(status)) {
1457 goto done;
1458 }
1459
1460 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1461 &pol,
1462 &dom_sid,
1463 access_mask,
1464 &trustdom_pol,
1465 &result);
1466 if (!NT_STATUS_IS_OK(status)) {
1467 goto done;
1468 }
1469 if (!NT_STATUS_IS_OK(result)) {
1470 status = result;
1471 goto done;
1472 }
1473
1474 status = dcerpc_lsa_SetInformationTrustedDomain(b, mem_ctx,
1475 &trustdom_pol,
1476 info_class,
1477 &info,
1478 &result);
1479 if (!NT_STATUS_IS_OK(status)) {
1480 goto done;
1481 }
1482 if (!NT_STATUS_IS_OK(result)) {
1483 status = result;
1484 goto done;
1485 }
1486 done:
1487 dcerpc_lsa_Close(b, mem_ctx, &trustdom_pol, &result);
1488 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1489
1490 return status;
1491 }
1492
1493 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1494 TALLOC_CTX *mem_ctx, int argc,
1495 const char **argv)
1496 {
1497 struct policy_handle pol, trustdom_pol;
1498 NTSTATUS status, result;
1499 uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1500 union lsa_TrustedDomainInfo *info = NULL;
1501 struct dom_sid dom_sid;
1502 enum lsa_TrustDomInfoEnum info_class = 1;
1503 DATA_BLOB session_key;
1504 struct dcerpc_binding_handle *b = cli->binding_handle;
1505
1506 if (argc > 3 || argc < 2) {
1507 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1508 return NT_STATUS_OK;
1509 }
1510
1511 if (!string_to_sid(&dom_sid, argv[1]))
1512 return NT_STATUS_NO_MEMORY;
1513
1514
1515 if (argc == 3)
1516 info_class = atoi(argv[2]);
1517
1518 status = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1519
1520 if (!NT_STATUS_IS_OK(status))
1521 goto done;
1522
1523 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
1524 &pol,
1525 &dom_sid,
1526 access_mask,
1527 &trustdom_pol,
1528 &result);
1529 if (!NT_STATUS_IS_OK(status))
1530 goto done;
1531 if (!NT_STATUS_IS_OK(result)) {
1532 status = result;
1533 goto done;
1534 }
1535
1536 status = dcerpc_lsa_QueryTrustedDomainInfo(b, mem_ctx,
1537 &trustdom_pol,
1538 info_class,
1539 &info,
1540 &result);
1541 if (!NT_STATUS_IS_OK(status))
1542 goto done;
1543 if (!NT_STATUS_IS_OK(result)) {
1544 status = result;
1545 goto done;
1546 }
1547
1548 status = cli_get_session_key(mem_ctx, cli, &session_key);
1549 if (!NT_STATUS_IS_OK(status)) {
1550 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(status)));
1551 goto done;
1552 }
1553
1554 display_trust_dom_info(mem_ctx, info, info_class, session_key);
1555
1556 done:
1557 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
1558
1559 return status;
1560 }
1561
1562 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1563 TALLOC_CTX *mem_ctx, int argc,
1564 const char **argv)
1565 {
1566 NTSTATUS status, result;
1567 const char *servername = cli->desthost;
1568 struct lsa_String *account_name = NULL;
1569 struct lsa_String *authority_name = NULL;
1570 struct dcerpc_binding_handle *b = cli->binding_handle;
1571
1572 if (argc > 2) {
1573 printf("Usage: %s servername\n", argv[0]);
1574 return NT_STATUS_OK;
1575 }
1576
1577 status = dcerpc_lsa_GetUserName(b, mem_ctx,
1578 servername,
1579 &account_name,
1580 &authority_name,
1581 &result);
1582 if (!NT_STATUS_IS_OK(status)) {
1583 goto done;
1584 }
1585 if (!NT_STATUS_IS_OK(result)) {
1586 status = result;
1587 goto done;
1588 }
1589
1590 /* Print results */
1591
1592 printf("Account Name: %s, Authority Name: %s\n",
1593 account_name->string, authority_name ? authority_name->string :
1594 "");
1595
1596 done:
1597 return status;
1598 }
1599
1600 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1601 TALLOC_CTX *mem_ctx, int argc,
1602 const char **argv)
1603 {
1604 struct policy_handle dom_pol, user_pol;
1605 NTSTATUS status, result;
1606 struct lsa_PrivilegeSet privs;
1607 struct lsa_LUIDAttribute *set = NULL;
1608 struct dom_sid sid;
1609 int i;
1610 struct dcerpc_binding_handle *b = cli->binding_handle;
1611
1612 ZERO_STRUCT(privs);
1613
1614 if (argc < 3 ) {
1615 printf("Usage: %s SID [rights...]\n", argv[0]);
1616 return NT_STATUS_OK;
1617 }
1618
1619 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1620 if (!NT_STATUS_IS_OK(status)) {
1621 goto done;
1622 }
1623
1624 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1625 SEC_FLAG_MAXIMUM_ALLOWED,
1626 &dom_pol);
1627
1628 if (!NT_STATUS_IS_OK(status)) {
1629 goto done;
1630 }
1631
1632 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1633 &dom_pol,
1634 &sid,
1635 SEC_FLAG_MAXIMUM_ALLOWED,
1636 &user_pol,
1637 &result);
1638 if (!NT_STATUS_IS_OK(status)) {
1639 goto done;
1640 }
1641 if (!NT_STATUS_IS_OK(result)) {
1642 status = result;
1643 goto done;
1644 }
1645
1646 for (i=2; i<argc; i++) {
1647
1648 struct lsa_String priv_name;
1649 struct lsa_LUID luid;
1650
1651 init_lsa_String(&priv_name, argv[i]);
1652
1653 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1654 &dom_pol,
1655 &priv_name,
1656 &luid,
1657 &result);
1658 if (!NT_STATUS_IS_OK(status)) {
1659 continue;
1660 }
1661 if (!NT_STATUS_IS_OK(result)) {
1662 status = result;
1663 continue;
1664 }
1665
1666 privs.count++;
1667 set = talloc_realloc(mem_ctx, set,
1668 struct lsa_LUIDAttribute,
1669 privs.count);
1670 if (!set) {
1671 return NT_STATUS_NO_MEMORY;
1672 }
1673
1674 set[privs.count-1].luid = luid;
1675 set[privs.count-1].attribute = 0;
1676 }
1677
1678 privs.set = set;
1679
1680 status = dcerpc_lsa_AddPrivilegesToAccount(b, mem_ctx,
1681 &user_pol,
1682 &privs,
1683 &result);
1684 if (!NT_STATUS_IS_OK(status)) {
1685 goto done;
1686 }
1687 if (!NT_STATUS_IS_OK(result)) {
1688 status = result;
1689 goto done;
1690 }
1691
1692 dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1693 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1694 done:
1695 return status;
1696 }
1697
1698 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1699 TALLOC_CTX *mem_ctx, int argc,
1700 const char **argv)
1701 {
1702 struct policy_handle dom_pol, user_pol;
1703 NTSTATUS status, result;
1704 struct lsa_PrivilegeSet privs;
1705 struct lsa_LUIDAttribute *set = NULL;
1706 struct dom_sid sid;
1707 int i;
1708 struct dcerpc_binding_handle *b = cli->binding_handle;
1709
1710 ZERO_STRUCT(privs);
1711
1712 if (argc < 3 ) {
1713 printf("Usage: %s SID [rights...]\n", argv[0]);
1714 return NT_STATUS_OK;
1715 }
1716
1717 status = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1718 if (!NT_STATUS_IS_OK(status)) {
1719 goto done;
1720 }
1721
1722 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1723 SEC_FLAG_MAXIMUM_ALLOWED,
1724 &dom_pol);
1725
1726 if (!NT_STATUS_IS_OK(status)) {
1727 goto done;
1728 }
1729
1730 status = dcerpc_lsa_OpenAccount(b, mem_ctx,
1731 &dom_pol,
1732 &sid,
1733 SEC_FLAG_MAXIMUM_ALLOWED,
1734 &user_pol,
1735 &result);
1736 if (!NT_STATUS_IS_OK(status)) {
1737 goto done;
1738 }
1739 if (!NT_STATUS_IS_OK(result)) {
1740 status = result;
1741 goto done;
1742 }
1743
1744 for (i=2; i<argc; i++) {
1745
1746 struct lsa_String priv_name;
1747 struct lsa_LUID luid;
1748
1749 init_lsa_String(&priv_name, argv[i]);
1750
1751 status = dcerpc_lsa_LookupPrivValue(b, mem_ctx,
1752 &dom_pol,
1753 &priv_name,
1754 &luid,
1755 &result);
1756 if (!NT_STATUS_IS_OK(status)) {
1757 continue;
1758 }
1759 if (!NT_STATUS_IS_OK(result)) {
1760 status = result;
1761 continue;
1762 }
1763
1764 privs.count++;
1765 set = talloc_realloc(mem_ctx, set,
1766 struct lsa_LUIDAttribute,
1767 privs.count);
1768 if (!set) {
1769 return NT_STATUS_NO_MEMORY;
1770 }
1771
1772 set[privs.count-1].luid = luid;
1773 set[privs.count-1].attribute = 0;
1774 }
1775
1776 privs.set = set;
1777
1778
1779 status = dcerpc_lsa_RemovePrivilegesFromAccount(b, mem_ctx,
1780 &user_pol,
1781 false,
1782 &privs,
1783 &result);
1784 if (!NT_STATUS_IS_OK(status)) {
1785 goto done;
1786 }
1787 if (!NT_STATUS_IS_OK(result)) {
1788 status = result;
1789 goto done;
1790 }
1791
1792 dcerpc_lsa_Close(b, mem_ctx, &user_pol, &result);
1793 dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
1794 done:
1795 return status;
1796 }
1797
1798 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1799 TALLOC_CTX *mem_ctx, int argc,
1800 const char **argv)
1801 {
1802 NTSTATUS status, result;
1803 struct policy_handle handle, sec_handle;
1804 struct lsa_String name;
1805 struct dcerpc_binding_handle *b = cli->binding_handle;
1806
1807 if (argc < 2) {
1808 printf("Usage: %s name\n", argv[0]);
1809 return NT_STATUS_OK;
1810 }
1811
1812 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1813 true,
1814 SEC_FLAG_MAXIMUM_ALLOWED,
1815 &handle);
1816 if (!NT_STATUS_IS_OK(status)) {
1817 return status;
1818 }
1819
1820 init_lsa_String(&name, argv[1]);
1821
1822 status = dcerpc_lsa_CreateSecret(b, mem_ctx,
1823 &handle,
1824 name,
1825 SEC_FLAG_MAXIMUM_ALLOWED,
1826 &sec_handle,
1827 &result);
1828 if (!NT_STATUS_IS_OK(status)) {
1829 goto done;
1830 }
1831 if (!NT_STATUS_IS_OK(result)) {
1832 status = result;
1833 goto done;
1834 }
1835
1836 done:
1837 if (is_valid_policy_hnd(&sec_handle)) {
1838 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1839 }
1840 if (is_valid_policy_hnd(&handle)) {
1841 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1842 }
1843
1844 return status;
1845 }
1846
1847 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1848 TALLOC_CTX *mem_ctx, int argc,
1849 const char **argv)
1850 {
1851 NTSTATUS status, result;
1852 struct policy_handle handle, sec_handle;
1853 struct lsa_String name;
1854 struct dcerpc_binding_handle *b = cli->binding_handle;
1855
1856 if (argc < 2) {
1857 printf("Usage: %s name\n", argv[0]);
1858 return NT_STATUS_OK;
1859 }
1860
1861 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1862 true,
1863 SEC_FLAG_MAXIMUM_ALLOWED,
1864 &handle);
1865 if (!NT_STATUS_IS_OK(status)) {
1866 return status;
1867 }
1868
1869 init_lsa_String(&name, argv[1]);
1870
1871 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1872 &handle,
1873 name,
1874 SEC_FLAG_MAXIMUM_ALLOWED,
1875 &sec_handle,
1876 &result);
1877 if (!NT_STATUS_IS_OK(status)) {
1878 goto done;
1879 }
1880 if (!NT_STATUS_IS_OK(result)) {
1881 status = result;
1882 goto done;
1883 }
1884
1885 status = dcerpc_lsa_DeleteObject(b, mem_ctx,
1886 &sec_handle,
1887 &result);
1888 if (!NT_STATUS_IS_OK(status)) {
1889 goto done;
1890 }
1891 if (!NT_STATUS_IS_OK(result)) {
1892 status = result;
1893 goto done;
1894 }
1895
1896 done:
1897 if (is_valid_policy_hnd(&sec_handle)) {
1898 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1899 }
1900 if (is_valid_policy_hnd(&handle)) {
1901 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1902 }
1903
1904 return status;
1905 }
1906
1907 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1908 TALLOC_CTX *mem_ctx, int argc,
1909 const char **argv)
1910 {
1911 NTSTATUS status, result;
1912 struct policy_handle handle, sec_handle;
1913 struct lsa_String name;
1914 struct lsa_DATA_BUF_PTR new_val;
1915 NTTIME new_mtime = 0;
1916 struct lsa_DATA_BUF_PTR old_val;
1917 NTTIME old_mtime = 0;
1918 DATA_BLOB session_key;
1919 DATA_BLOB new_blob = data_blob_null;
1920 DATA_BLOB old_blob = data_blob_null;
1921 char *new_secret, *old_secret;
1922 struct dcerpc_binding_handle *b = cli->binding_handle;
1923
1924 if (argc < 2) {
1925 printf("Usage: %s name\n", argv[0]);
1926 return NT_STATUS_OK;
1927 }
1928
1929 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1930 true,
1931 SEC_FLAG_MAXIMUM_ALLOWED,
1932 &handle);
1933 if (!NT_STATUS_IS_OK(status)) {
1934 return status;
1935 }
1936
1937 init_lsa_String(&name, argv[1]);
1938
1939 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
1940 &handle,
1941 name,
1942 SEC_FLAG_MAXIMUM_ALLOWED,
1943 &sec_handle,
1944 &result);
1945 if (!NT_STATUS_IS_OK(status)) {
1946 goto done;
1947 }
1948 if (!NT_STATUS_IS_OK(result)) {
1949 status = result;
1950 goto done;
1951 }
1952
1953 ZERO_STRUCT(new_val);
1954 ZERO_STRUCT(old_val);
1955
1956 status = dcerpc_lsa_QuerySecret(b, mem_ctx,
1957 &sec_handle,
1958 &new_val,
1959 &new_mtime,
1960 &old_val,
1961 &old_mtime,
1962 &result);
1963 if (!NT_STATUS_IS_OK(status)) {
1964 goto done;
1965 }
1966 if (!NT_STATUS_IS_OK(result)) {
1967 status = result;
1968 goto done;
1969 }
1970
1971 status = cli_get_session_key(mem_ctx, cli, &session_key);
1972 if (!NT_STATUS_IS_OK(status)) {
1973 goto done;
1974 }
1975
1976 if (new_val.buf) {
1977 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1978 }
1979 if (old_val.buf) {
1980 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1981 }
1982
1983 new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1984 old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1985 if (new_secret) {
1986 d_printf("new secret: %s\n", new_secret);
1987 }
1988 if (old_secret) {
1989 d_printf("old secret: %s\n", old_secret);
1990 }
1991
1992 done:
1993 if (is_valid_policy_hnd(&sec_handle)) {
1994 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
1995 }
1996 if (is_valid_policy_hnd(&handle)) {
1997 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
1998 }
1999
2000 return status;
2001 }
2002
2003 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
2004 TALLOC_CTX *mem_ctx, int argc,
2005 const char **argv)
2006 {
2007 NTSTATUS status, result;
2008 struct policy_handle handle, sec_handle;
2009 struct lsa_String name;
2010 struct lsa_DATA_BUF new_val;
2011 struct lsa_DATA_BUF old_val;
2012 DATA_BLOB enc_key;
2013 DATA_BLOB session_key;
2014 struct dcerpc_binding_handle *b = cli->binding_handle;
2015
2016 if (argc < 3) {
2017 printf("Usage: %s name secret\n", argv[0]);
2018 return NT_STATUS_OK;
2019 }
2020
2021 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2022 true,
2023 SEC_FLAG_MAXIMUM_ALLOWED,
2024 &handle);
2025 if (!NT_STATUS_IS_OK(status)) {
2026 return status;
2027 }
2028
2029 init_lsa_String(&name, argv[1]);
2030
2031 status = dcerpc_lsa_OpenSecret(b, mem_ctx,
2032 &handle,
2033 name,
2034 SEC_FLAG_MAXIMUM_ALLOWED,
2035 &sec_handle,
2036 &result);
2037 if (!NT_STATUS_IS_OK(status)) {
2038 goto done;
2039 }
2040 if (!NT_STATUS_IS_OK(result)) {
2041 status = result;
2042 goto done;
2043 }
2044
2045 ZERO_STRUCT(new_val);
2046 ZERO_STRUCT(old_val);
2047
2048 status = cli_get_session_key(mem_ctx, cli, &session_key);
2049 if (!NT_STATUS_IS_OK(status)) {
2050 goto done;
2051 }
2052
2053 enc_key = sess_encrypt_string(argv[2], &session_key);
2054
2055 new_val.length = enc_key.length;
2056 new_val.size = enc_key.length;
2057 new_val.data = enc_key.data;
2058
2059 status = dcerpc_lsa_SetSecret(b, mem_ctx,
2060 &sec_handle,
2061 &new_val,
2062 NULL,
2063 &result);
2064 if (!NT_STATUS_IS_OK(status)) {
2065 goto done;
2066 }
2067 if (!NT_STATUS_IS_OK(result)) {
2068 status = result;
2069 goto done;
2070 }
2071
2072 done:
2073 if (is_valid_policy_hnd(&sec_handle)) {
2074 dcerpc_lsa_Close(b, mem_ctx, &sec_handle, &result);
2075 }
2076 if (is_valid_policy_hnd(&handle)) {
2077 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2078 }
2079
2080 return status;
2081 }
2082
2083 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
2084 TALLOC_CTX *mem_ctx, int argc,
2085 const char **argv)
2086 {
2087 NTSTATUS status, result;
2088 struct policy_handle handle;
2089 struct lsa_String name;
2090 struct lsa_DATA_BUF *val;
2091 DATA_BLOB session_key;
2092 DATA_BLOB blob = data_blob_null;
2093 char *secret;
2094 struct dcerpc_binding_handle *b = cli->binding_handle;
2095
2096 if (argc < 2) {
2097 printf("Usage: %s name\n", argv[0]);
2098 return NT_STATUS_OK;
2099 }
2100
2101 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2102 true,
2103 SEC_FLAG_MAXIMUM_ALLOWED,
2104 &handle);
2105 if (!NT_STATUS_IS_OK(status)) {
2106 return status;
2107 }
2108
2109 init_lsa_String(&name, argv[1]);
2110
2111 ZERO_STRUCT(val);
2112
2113 status = dcerpc_lsa_RetrievePrivateData(b, mem_ctx,
2114 &handle,
2115 &name,
2116 &val,
2117 &result);
2118 if (!NT_STATUS_IS_OK(status)) {
2119 goto done;
2120 }
2121 if (!NT_STATUS_IS_OK(result)) {
2122 status = result;
2123 goto done;
2124 }
2125
2126 status = cli_get_session_key(mem_ctx, cli, &session_key);
2127 if (!NT_STATUS_IS_OK(status)) {
2128 goto done;
2129 }
2130
2131 if (val) {
2132 blob = data_blob_const(val->data, val->length);
2133 }
2134
2135 secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
2136 if (secret) {
2137 d_printf("secret: %s\n", secret);
2138 }
2139
2140 done:
2141 if (is_valid_policy_hnd(&handle)) {
2142 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2143 }
2144
2145 return status;
2146 }
2147
2148 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
2149 TALLOC_CTX *mem_ctx, int argc,
2150 const char **argv)
2151 {
2152 NTSTATUS status, result;
2153 struct policy_handle handle;
2154 struct lsa_String name;
2155 struct lsa_DATA_BUF val;
2156 DATA_BLOB session_key;
2157 DATA_BLOB enc_key;
2158 struct dcerpc_binding_handle *b = cli->binding_handle;
2159
2160 if (argc < 3) {
2161 printf("Usage: %s name secret\n", argv[0]);
2162 return NT_STATUS_OK;
2163 }
2164
2165 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2166 true,
2167 SEC_FLAG_MAXIMUM_ALLOWED,
2168 &handle);
2169 if (!NT_STATUS_IS_OK(status)) {
2170 return status;
2171 }
2172
2173 init_lsa_String(&name, argv[1]);
2174
2175 ZERO_STRUCT(val);
2176
2177 status = cli_get_session_key(mem_ctx, cli, &session_key);
2178 if (!NT_STATUS_IS_OK(status)) {
2179 goto done;
2180 }
2181
2182 enc_key = sess_encrypt_string(argv[2], &session_key);
2183
2184 val.length = enc_key.length;
2185 val.size = enc_key.length;
2186 val.data = enc_key.data;
2187
2188 status = dcerpc_lsa_StorePrivateData(b, mem_ctx,
2189 &handle,
2190 &name,
2191 &val,
2192 &result);
2193 if (!NT_STATUS_IS_OK(status)) {
2194 goto done;
2195 }
2196 if (!NT_STATUS_IS_OK(result)) {
2197 status = result;
2198 goto done;
2199 }
2200
2201 done:
2202 if (is_valid_policy_hnd(&handle)) {
2203 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2204 }
2205
2206 return status;
2207 }
2208
2209 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
2210 TALLOC_CTX *mem_ctx, int argc,
2211 const char **argv)
2212 {
2213 NTSTATUS status, result;
2214 struct policy_handle handle, trustdom_handle;
2215 struct dom_sid sid;
2216 struct lsa_DomainInfo info;
2217 struct dcerpc_binding_handle *b = cli->binding_handle;
2218
2219 if (argc < 3) {
2220 printf("Usage: %s name sid\n", argv[0]);
2221 return NT_STATUS_OK;
2222 }
2223
2224 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2225 true,
2226 SEC_FLAG_MAXIMUM_ALLOWED,
2227 &handle);
2228 if (!NT_STATUS_IS_OK(status)) {
2229 return status;
2230 }
2231
2232 init_lsa_StringLarge(&info.name, argv[1]);
2233 info.sid = &sid;
2234 string_to_sid(&sid, argv[2]);
2235
2236 status = dcerpc_lsa_CreateTrustedDomain(b, mem_ctx,
2237 &handle,
2238 &info,
2239 SEC_FLAG_MAXIMUM_ALLOWED,
2240 &trustdom_handle,
2241 &result);
2242 if (!NT_STATUS_IS_OK(status)) {
2243 goto done;
2244 }
2245 if (!NT_STATUS_IS_OK(result)) {
2246 status = result;
2247 goto done;
2248 }
2249
2250 done:
2251 if (is_valid_policy_hnd(&trustdom_handle)) {
2252 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2253 }
2254
2255 if (is_valid_policy_hnd(&handle)) {
2256 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2257 }
2258
2259 return status;
2260 }
2261
2262 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
2263 TALLOC_CTX *mem_ctx, int argc,
2264 const char **argv)
2265 {
2266 NTSTATUS status, result;
2267 struct policy_handle handle, trustdom_handle;
2268 struct lsa_String name;
2269 struct dom_sid *sid = NULL;
2270 struct dcerpc_binding_handle *b = cli->binding_handle;
2271
2272 if (argc < 2) {
2273 printf("Usage: %s name\n", argv[0]);
2274 return NT_STATUS_OK;
2275 }
2276
2277 status = rpccli_lsa_open_policy2(cli, mem_ctx,
2278 true,
2279 SEC_FLAG_MAXIMUM_ALLOWED,
2280 &handle);
2281 if (!NT_STATUS_IS_OK(status)) {
2282 return status;
2283 }
2284
2285 init_lsa_String(&name, argv[1]);
2286
2287 status = dcerpc_lsa_OpenTrustedDomainByName(b, mem_ctx,
2288 &handle,
2289 name,
2290 SEC_FLAG_MAXIMUM_ALLOWED,
2291 &trustdom_handle,
2292 &result);
2293 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2294 goto delete_object;
2295 }
2296
2297 {
2298 uint32_t resume_handle = 0;
2299 struct lsa_DomainList domains;
2300 int i;
2301
2302 status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
2303 &handle,
2304 &resume_handle,
2305 &domains,
2306 0xffff,
2307 &result);
2308 if (!NT_STATUS_IS_OK(status)) {
2309 goto done;
2310 }
2311 if (!NT_STATUS_IS_OK(result)) {
2312 status = result;
2313 goto done;
2314 }
2315
2316 for (i=0; i < domains.count; i++) {
2317 if (strequal(domains.domains[i].name.string, argv[1])) {
2318 sid = domains.domains[i].sid;
2319 break;
2320 }
2321 }
2322
2323 if (!sid) {
2324 return NT_STATUS_INVALID_SID;
2325 }
2326 }
2327
2328 status = dcerpc_lsa_OpenTrustedDomain(b, mem_ctx,
2329 &handle,
2330 sid,
2331 SEC_FLAG_MAXIMUM_ALLOWED,
2332 &trustdom_handle,
2333 &result);
2334 if (!NT_STATUS_IS_OK(status)) {
2335 goto done;
2336 }
2337 if (!NT_STATUS_IS_OK(result)) {
2338 status = result;
2339 goto done;
2340 }
2341
2342 delete_object:
2343 status = dcerpc_lsa_DeleteObject(b, mem_ctx,
2344 &trustdom_handle,
2345 &result);
2346 if (!NT_STATUS_IS_OK(status)) {
2347 goto done;
2348 }
2349 if (!NT_STATUS_IS_OK(result)) {
2350 status = result;
2351 goto done;
2352 }
2353
2354 done:
2355 if (is_valid_policy_hnd(&trustdom_handle)) {
2356 dcerpc_lsa_Close(b, mem_ctx, &trustdom_handle, &result);
2357 }
2358
2359 if (is_valid_policy_hnd(&handle)) {
2360 dcerpc_lsa_Close(b, mem_ctx, &handle, &result);
2361 }
2362
2363 return status;
2364 }
2365
2366
2367 /* List of commands exported by this module */
2368
2369 struct cmd_set lsarpc_commands[] = {
2370
2371 { "LSARPC" },
2372
2373 { "lsaquery", RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy, NULL, &ndr_table_lsarpc, NULL, "Query info policy", "" },
2374 { "lookupsids", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids, NULL, &ndr_table_lsarpc, NULL, "Convert SIDs to names", "" },
2375 { "lookupsids3", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids3, NULL, &ndr_table_lsarpc, NULL, "Convert SIDs to names", "" },
2376 { "lookupsids_level", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids_level, NULL, &ndr_table_lsarpc, NULL, "Convert SIDs to names", "" },
2377 { "lookupnames", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2378 { "lookupnames4", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names4, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2379 { "lookupnames_level", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc, NULL, "Convert names to SIDs", "" },
2380 { "enumtrust", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom, NULL, &ndr_table_lsarpc, NULL, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
2381 { "enumprivs", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege, NULL, &ndr_table_lsarpc, NULL, "Enumerate privileges", "" },
2382 { "getdispname", RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname, NULL, &ndr_table_lsarpc, NULL, "Get the privilege name", "" },
2383 { "lsaenumsid", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids, NULL, &ndr_table_lsarpc, NULL, "Enumerate the LSA SIDS", "" },
2384 { "lsacreateaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_create_account, NULL, &ndr_table_lsarpc, NULL, "Create a new lsa account", "" },
2385 { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc, NULL, "Enumerate the privileges of an SID", "" },
2386 { "lsaenumacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Enumerate the rights of an SID", "" },
2387 { "lsaaddpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv, NULL, &ndr_table_lsarpc, NULL, "Assign a privilege to a SID", "" },
2388 { "lsadelpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv, NULL, &ndr_table_lsarpc, NULL, "Revoke a privilege from a SID", "" },
2389 { "lsaaddacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Add rights to an account", "" },
2390 { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc, NULL, "Remove rights from an account", "" },
2391 { "lsalookupprivvalue", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value, NULL, &ndr_table_lsarpc, NULL, "Get a privilege value given its name", "" },
2392 { "lsaquerysecobj", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj, NULL, &ndr_table_lsarpc, NULL, "Query LSA security object", "" },
2393 { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a SID)", "" },
2394 { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2395 { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc, NULL, "Query LSA trusted domains info (given a SID)", "" },
2396 { "lsasettrustdominfo", RPC_RTYPE_NTSTATUS, cmd_lsa_set_trustdominfo, NULL, &ndr_table_lsarpc, NULL, "Set LSA trusted domain info", "" },
2397 { "getusername", RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc, NULL, "Get username", "" },
2398 { "createsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc, NULL, "Create Secret", "" },
2399 { "deletesecret", RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc, NULL, "Delete Secret", "" },
2400 { "querysecret", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc, NULL, "Query Secret", "" },
2401 { "setsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc, NULL, "Set Secret", "" },
2402 { "retrieveprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc, NULL, "Retrieve Private Data", "" },
2403 { "storeprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc, NULL, "Store Private Data", "" },
2404 { "createtrustdom", RPC_RTYPE_NTSTATUS, cmd_lsa_create_trusted_domain, NULL, &ndr_table_lsarpc, NULL, "Create Trusted Domain", "" },
2405 { "deletetrustdom", RPC_RTYPE_NTSTATUS, cmd_lsa_delete_trusted_domain, NULL, &ndr_table_lsarpc, NULL, "Delete Trusted Domain", "" },
2406
2407 { NULL }
2408 };
2409
Samba GIT mirror