?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tests/krb5: Add assertion to make failures clearer
[Samba.git] / source4 / libnet / libnet_passwd.c
blob868f9442cd0b288237acdb63c91b36c467783430
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23 #include "libcli/auth/libcli_auth.h"
24 #include "librpc/gen_ndr/ndr_samr_c.h"
25 #include "source4/librpc/rpc/dcerpc.h"
26
27 #include "lib/crypto/gnutls_helpers.h"
28 #include <gnutls/gnutls.h>
29 #include <gnutls/crypto.h>
30
31 /*
32 * do a password change using DCERPC/SAMR calls
33 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
34 * 2. try samr_ChangePasswordUser3
35 * 3. try samr_ChangePasswordUser2
36 * 4. try samr_OemChangePasswordUser2
37 * (not yet: 5. try samr_ChangePasswordUser)
38 */
39 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
40 {
41 NTSTATUS status;
42 struct libnet_RpcConnect c;
43 #if 0
44 struct policy_handle user_handle;
45 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
46 struct samr_ChangePasswordUser pw;
47 #endif
48 struct samr_OemChangePasswordUser2 oe2;
49 struct samr_ChangePasswordUser2 pw2;
50 struct samr_ChangePasswordUser3 pw3;
51 struct lsa_String server, account;
52 struct lsa_AsciiString a_server, a_account;
53 struct samr_CryptPassword nt_pass, lm_pass;
54 struct samr_Password nt_verifier, lm_verifier;
55 uint8_t old_nt_hash[16], new_nt_hash[16];
56 uint8_t old_lm_hash[16], new_lm_hash[16];
57 struct samr_DomInfo1 *dominfo = NULL;
58 struct userPwdChangeFailureInformation *reject = NULL;
59 gnutls_cipher_hd_t cipher_hnd = NULL;
60 gnutls_datum_t nt_session_key = {
61 .data = old_nt_hash,
62 .size = sizeof(old_nt_hash),
63 };
64 gnutls_datum_t lm_session_key = {
65 .data = old_lm_hash,
66 .size = sizeof(old_lm_hash),
67 };
68 int rc;
69
70 ZERO_STRUCT(c);
71
72 /* prepare connect to the SAMR pipe of the users domain PDC */
73 c.level = LIBNET_RPC_CONNECT_PDC;
74 c.in.name = r->samr.in.domain_name;
75 c.in.dcerpc_iface = &ndr_table_samr;
76 c.in.dcerpc_flags = DCERPC_ANON_FALLBACK;
77
78 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
79 status = libnet_RpcConnect(ctx, mem_ctx, &c);
80 if (!NT_STATUS_IS_OK(status)) {
81 r->samr.out.error_string = talloc_asprintf(mem_ctx,
82 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
83 r->samr.in.domain_name, nt_errstr(status));
84 return status;
85 }
86
87 /* prepare password change for account */
88 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
89 account.string = r->samr.in.account_name;
90
91 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
92 E_md4hash(r->samr.in.newpassword, new_nt_hash);
93
94 E_deshash(r->samr.in.oldpassword, old_lm_hash);
95 E_deshash(r->samr.in.newpassword, new_lm_hash);
96
97 /* prepare samr_ChangePasswordUser3 */
98 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
99
100 rc = gnutls_cipher_init(&cipher_hnd,
101 GNUTLS_CIPHER_ARCFOUR_128,
102 &nt_session_key,
103 NULL);
104 if (rc < 0) {
105 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
106 goto disconnect;
107 }
108
109 rc = gnutls_cipher_encrypt(cipher_hnd,
110 lm_pass.data,
111 516);
112 gnutls_cipher_deinit(cipher_hnd);
113 if (rc < 0) {
114 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
115 goto disconnect;
116 }
117
118 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
119 if (rc != 0) {
120 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
121 goto disconnect;
122 }
123
124 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
125
126 rc = gnutls_cipher_init(&cipher_hnd,
127 GNUTLS_CIPHER_ARCFOUR_128,
128 &nt_session_key,
129 NULL);
130 if (rc < 0) {
131 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
132 goto disconnect;
133 }
134
135 rc = gnutls_cipher_encrypt(cipher_hnd,
136 nt_pass.data,
137 516);
138 gnutls_cipher_deinit(cipher_hnd);
139 if (rc < 0) {
140 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
141 goto disconnect;
142 }
143
144 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
145 if (rc != 0) {
146 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
147 goto disconnect;
148 }
149
150 pw3.in.server = &server;
151 pw3.in.account = &account;
152 pw3.in.nt_password = &nt_pass;
153 pw3.in.nt_verifier = &nt_verifier;
154 pw3.in.lm_change = 1;
155 pw3.in.lm_password = &lm_pass;
156 pw3.in.lm_verifier = &lm_verifier;
157 pw3.in.password3 = NULL;
158 pw3.out.dominfo = &dominfo;
159 pw3.out.reject = &reject;
160
161 /* 2. try samr_ChangePasswordUser3 */
162 status = dcerpc_samr_ChangePasswordUser3_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw3);
163 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
164 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw3.out.result)) {
165 status = pw3.out.result;
166 }
167 if (!NT_STATUS_IS_OK(status)) {
168 r->samr.out.error_string = talloc_asprintf(mem_ctx,
169 "samr_ChangePasswordUser3 failed: %s",
170 nt_errstr(status));
171 r->samr.out.error_string = talloc_asprintf(mem_ctx,
172 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s",
173 r->samr.in.domain_name, r->samr.in.account_name,
174 nt_errstr(status));
175 }
176 goto disconnect;
177 }
178
179 /* prepare samr_ChangePasswordUser2 */
180 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
181
182 rc = gnutls_cipher_init(&cipher_hnd,
183 GNUTLS_CIPHER_ARCFOUR_128,
184 &lm_session_key,
185 NULL);
186 if (rc < 0) {
187 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
188 goto disconnect;
189 }
190
191 rc = gnutls_cipher_encrypt(cipher_hnd,
192 lm_pass.data,
193 516);
194 gnutls_cipher_deinit(cipher_hnd);
195 if (rc < 0) {
196 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
197 goto disconnect;
198 }
199
200 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
201 if (rc != 0) {
202 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
203 goto disconnect;
204 }
205
206 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
207
208 rc = gnutls_cipher_init(&cipher_hnd,
209 GNUTLS_CIPHER_ARCFOUR_128,
210 &nt_session_key,
211 NULL);
212 if (rc < 0) {
213 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
214 goto disconnect;
215 }
216 rc = gnutls_cipher_encrypt(cipher_hnd,
217 nt_pass.data,
218 516);
219 gnutls_cipher_deinit(cipher_hnd);
220 if (rc < 0) {
221 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
222 goto disconnect;
223 }
224
225 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
226 if (rc != 0) {
227 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
228 goto disconnect;
229 }
230
231 pw2.in.server = &server;
232 pw2.in.account = &account;
233 pw2.in.nt_password = &nt_pass;
234 pw2.in.nt_verifier = &nt_verifier;
235 pw2.in.lm_change = 1;
236 pw2.in.lm_password = &lm_pass;
237 pw2.in.lm_verifier = &lm_verifier;
238
239 /* 3. try samr_ChangePasswordUser2 */
240 status = dcerpc_samr_ChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw2);
241 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
242 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw2.out.result)) {
243 status = pw2.out.result;
244 }
245 if (!NT_STATUS_IS_OK(status)) {
246 r->samr.out.error_string = talloc_asprintf(mem_ctx,
247 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s",
248 r->samr.in.domain_name, r->samr.in.account_name,
249 nt_errstr(status));
250 }
251 goto disconnect;
252 }
253
254
255 /* prepare samr_OemChangePasswordUser2 */
256 a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
257 a_account.string = r->samr.in.account_name;
258
259 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
260
261 rc = gnutls_cipher_init(&cipher_hnd,
262 GNUTLS_CIPHER_ARCFOUR_128,
263 &lm_session_key,
264 NULL);
265 if (rc < 0) {
266 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
267 goto disconnect;
268 }
269
270 rc = gnutls_cipher_encrypt(cipher_hnd,
271 lm_pass.data,
272 516);
273 gnutls_cipher_deinit(cipher_hnd);
274 if (rc < 0) {
275 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
276 goto disconnect;
277 }
278
279 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
280 if (rc != 0) {
281 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
282 goto disconnect;
283 }
284
285 oe2.in.server = &a_server;
286 oe2.in.account = &a_account;
287 oe2.in.password = &lm_pass;
288 oe2.in.hash = &lm_verifier;
289
290 /* 4. try samr_OemChangePasswordUser2 */
291 status = dcerpc_samr_OemChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &oe2);
292 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
293 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(oe2.out.result)) {
294 status = oe2.out.result;
295 }
296 if (!NT_STATUS_IS_OK(oe2.out.result)) {
297 r->samr.out.error_string = talloc_asprintf(mem_ctx,
298 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s",
299 r->samr.in.domain_name, r->samr.in.account_name,
300 nt_errstr(status));
301 }
302 goto disconnect;
303 }
304
305 #if 0
306 /* prepare samr_ChangePasswordUser */
307 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
308 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
309 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
310 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
311 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
312 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
313
314 /* TODO: ask for a user_handle */
315 pw.in.handle = &user_handle;
316 pw.in.lm_present = 1;
317 pw.in.old_lm_crypted = &hash1;
318 pw.in.new_lm_crypted = &hash2;
319 pw.in.nt_present = 1;
320 pw.in.old_nt_crypted = &hash3;
321 pw.in.new_nt_crypted = &hash4;
322 pw.in.cross1_present = 1;
323 pw.in.nt_cross = &hash5;
324 pw.in.cross2_present = 1;
325 pw.in.lm_cross = &hash6;
326
327 /* 5. try samr_ChangePasswordUser */
328 status = dcerpc_samr_ChangePasswordUser_r(c.pdc.out.dcerpc_pipe->binding_handle, mem_ctx, &pw);
329 if (!NT_STATUS_IS_OK(status)) {
330 r->samr.out.error_string = talloc_asprintf(mem_ctx,
331 "samr_ChangePasswordUser failed: %s",
332 nt_errstr(status));
333 goto disconnect;
334 }
335
336 /* check result of samr_ChangePasswordUser */
337 if (!NT_STATUS_IS_OK(pw.out.result)) {
338 r->samr.out.error_string = talloc_asprintf(mem_ctx,
339 "samr_ChangePasswordUser for '%s\\%s' failed: %s",
340 r->samr.in.domain_name, r->samr.in.account_name,
341 nt_errstr(pw.out.result));
342 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
343 status = pw.out.result;
344 goto disconnect;
345 }
346 goto disconnect;
347 }
348 #endif
349 disconnect:
350 /* close connection */
351 talloc_unlink(ctx, c.out.dcerpc_pipe);
352
353 return status;
354 }
355
356 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
357 {
358 NTSTATUS status;
359 union libnet_ChangePassword r2;
360
361 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
362 r2.samr.in.account_name = r->generic.in.account_name;
363 r2.samr.in.domain_name = r->generic.in.domain_name;
364 r2.samr.in.oldpassword = r->generic.in.oldpassword;
365 r2.samr.in.newpassword = r->generic.in.newpassword;
366
367 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
368
369 r->generic.out.error_string = r2.samr.out.error_string;
370
371 return status;
372 }
373
374 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
375 {
376 switch (r->generic.level) {
377 case LIBNET_CHANGE_PASSWORD_GENERIC:
378 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
379 case LIBNET_CHANGE_PASSWORD_SAMR:
380 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
381 case LIBNET_CHANGE_PASSWORD_KRB5:
382 return NT_STATUS_NOT_IMPLEMENTED;
383 case LIBNET_CHANGE_PASSWORD_LDAP:
384 return NT_STATUS_NOT_IMPLEMENTED;
385 case LIBNET_CHANGE_PASSWORD_RAP:
386 return NT_STATUS_NOT_IMPLEMENTED;
387 }
388
389 return NT_STATUS_INVALID_LEVEL;
390 }
391
392 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
393 {
394 NTSTATUS status;
395 struct samr_SetUserInfo2 sui;
396 union samr_UserInfo u_info;
397 DATA_BLOB session_key;
398
399 if (r->samr_handle.in.info21) {
400 return NT_STATUS_INVALID_PARAMETER_MIX;
401 }
402
403 /* prepare samr_SetUserInfo2 level 26 */
404 ZERO_STRUCT(u_info);
405 u_info.info26.password_expired = 0;
406
407 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
408 if (!NT_STATUS_IS_OK(status)) {
409 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
410 "dcerpc_fetch_session_key failed: %s",
411 nt_errstr(status));
412 return status;
413 }
414
415 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
416 &session_key,
417 &u_info.info26.password);
418 if (!NT_STATUS_IS_OK(status)) {
419 r->samr_handle.out.error_string =
420 talloc_asprintf(mem_ctx,
421 "encode_rc4_passwd_buffer failed: %s",
422 nt_errstr(status));
423 return status;
424 }
425
426 sui.in.user_handle = r->samr_handle.in.user_handle;
427 sui.in.info = &u_info;
428 sui.in.level = 26;
429
430 /* 7. try samr_SetUserInfo2 level 26 to set the password */
431 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
432 /* check result of samr_SetUserInfo2 level 26 */
433 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
434 status = sui.out.result;
435 }
436 if (!NT_STATUS_IS_OK(status)) {
437 r->samr_handle.out.error_string
438 = talloc_asprintf(mem_ctx,
439 "SetUserInfo2 level 26 for [%s] failed: %s",
440 r->samr_handle.in.account_name, nt_errstr(status));
441 }
442
443 return status;
444 }
445
446 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
447 {
448 NTSTATUS status;
449 struct samr_SetUserInfo2 sui;
450 union samr_UserInfo u_info;
451 DATA_BLOB session_key;
452
453 if (!r->samr_handle.in.info21) {
454 return NT_STATUS_INVALID_PARAMETER_MIX;
455 }
456
457 /* prepare samr_SetUserInfo2 level 25 */
458 ZERO_STRUCT(u_info);
459 u_info.info25.info = *r->samr_handle.in.info21;
460 u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
461
462 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
463 if (!NT_STATUS_IS_OK(status)) {
464 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
465 "dcerpc_fetch_session_key failed: %s",
466 nt_errstr(status));
467 return status;
468 }
469
470 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
471 &session_key,
472 &u_info.info25.password);
473 if (!NT_STATUS_IS_OK(status)) {
474 r->samr_handle.out.error_string =
475 talloc_asprintf(mem_ctx,
476 "encode_rc4_passwd_buffer failed: %s",
477 nt_errstr(status));
478 return status;
479 }
480
481
482 sui.in.user_handle = r->samr_handle.in.user_handle;
483 sui.in.info = &u_info;
484 sui.in.level = 25;
485
486 /* 8. try samr_SetUserInfo2 level 25 to set the password */
487 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
488 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
489 status = sui.out.result;
490 }
491 if (!NT_STATUS_IS_OK(status)) {
492 r->samr_handle.out.error_string
493 = talloc_asprintf(mem_ctx,
494 "SetUserInfo2 level 25 for [%s] failed: %s",
495 r->samr_handle.in.account_name, nt_errstr(status));
496 }
497
498 return status;
499 }
500
501 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
502 {
503 NTSTATUS status;
504 struct samr_SetUserInfo2 sui;
505 union samr_UserInfo u_info;
506 DATA_BLOB session_key;
507 gnutls_cipher_hd_t cipher_hnd = NULL;
508 gnutls_datum_t enc_session_key;
509 int rc;
510
511 if (r->samr_handle.in.info21) {
512 return NT_STATUS_INVALID_PARAMETER_MIX;
513 }
514
515 /* prepare samr_SetUserInfo2 level 24 */
516 ZERO_STRUCT(u_info);
517 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
518 u_info.info24.password_expired = 0;
519
520 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
521 if (!NT_STATUS_IS_OK(status)) {
522 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
523 "dcerpc_fetch_session_key failed: %s",
524 nt_errstr(status));
525 return status;
526 }
527
528 enc_session_key = (gnutls_datum_t) {
529 .data = session_key.data,
530 .size = session_key.length,
531 };
532
533 rc = gnutls_cipher_init(&cipher_hnd,
534 GNUTLS_CIPHER_ARCFOUR_128,
535 &enc_session_key,
536 NULL);
537 if (rc < 0) {
538 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
539 goto out;
540 }
541
542 rc = gnutls_cipher_encrypt(cipher_hnd,
543 u_info.info24.password.data,
544 516);
545 gnutls_cipher_deinit(cipher_hnd);
546 if (rc < 0) {
547 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
548 goto out;
549 }
550
551 sui.in.user_handle = r->samr_handle.in.user_handle;
552 sui.in.info = &u_info;
553 sui.in.level = 24;
554
555 /* 9. try samr_SetUserInfo2 level 24 to set the password */
556 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
557 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
558 status = sui.out.result;
559 }
560 if (!NT_STATUS_IS_OK(status)) {
561 r->samr_handle.out.error_string
562 = talloc_asprintf(mem_ctx,
563 "SetUserInfo2 level 24 for [%s] failed: %s",
564 r->samr_handle.in.account_name, nt_errstr(status));
565 }
566
567 out:
568 data_blob_clear(&session_key);
569 return status;
570 }
571
572 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
573 {
574 NTSTATUS status;
575 struct samr_SetUserInfo2 sui;
576 union samr_UserInfo u_info;
577 DATA_BLOB session_key;
578 gnutls_cipher_hd_t cipher_hnd = NULL;
579 gnutls_datum_t _session_key;
580 int rc;
581
582 if (!r->samr_handle.in.info21) {
583 return NT_STATUS_INVALID_PARAMETER_MIX;
584 }
585
586 /* prepare samr_SetUserInfo2 level 23 */
587 ZERO_STRUCT(u_info);
588 u_info.info23.info = *r->samr_handle.in.info21;
589 u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
590 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
591
592 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
593 if (!NT_STATUS_IS_OK(status)) {
594 r->samr_handle.out.error_string
595 = talloc_asprintf(mem_ctx,
596 "dcerpc_fetch_session_key failed: %s",
597 nt_errstr(status));
598 return status;
599 }
600
601 _session_key = (gnutls_datum_t) {
602 .data = session_key.data,
603 .size = session_key.length,
604 };
605
606 rc = gnutls_cipher_init(&cipher_hnd,
607 GNUTLS_CIPHER_ARCFOUR_128,
608 &_session_key,
609 NULL);
610 if (rc < 0) {
611 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
612 goto out;
613 }
614
615 rc = gnutls_cipher_encrypt(cipher_hnd,
616 u_info.info23.password.data,
617 516);
618 data_blob_clear_free(&session_key);
619 gnutls_cipher_deinit(cipher_hnd);
620 if (rc < 0) {
621 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
622 goto out;
623 }
624
625 sui.in.user_handle = r->samr_handle.in.user_handle;
626 sui.in.info = &u_info;
627 sui.in.level = 23;
628
629 /* 10. try samr_SetUserInfo2 level 23 to set the password */
630 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
631 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
632 status = sui.out.result;
633 }
634 if (!NT_STATUS_IS_OK(status)) {
635 r->samr_handle.out.error_string
636 = talloc_asprintf(mem_ctx,
637 "SetUserInfo2 level 23 for [%s] failed: %s",
638 r->samr_handle.in.account_name, nt_errstr(status));
639 }
640
641 out:
642 return status;
643 }
644
645 /*
646 * 1. try samr_SetUserInfo2 level 26 to set the password
647 * 2. try samr_SetUserInfo2 level 25 to set the password
648 * 3. try samr_SetUserInfo2 level 24 to set the password
649 * 4. try samr_SetUserInfo2 level 23 to set the password
650 */
651 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
652 {
653
654 NTSTATUS status;
655 enum libnet_SetPassword_level levels[] = {
656 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
657 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
658 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
659 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
660 };
661 unsigned int i;
662
663 for (i=0; i < ARRAY_SIZE(levels); i++) {
664 r->generic.level = levels[i];
665 status = libnet_SetPassword(ctx, mem_ctx, r);
666 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
667 || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
668 || NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
669 /* Try another password set mechanism */
670 continue;
671 }
672 break;
673 }
674
675 return status;
676 }
677 /*
678 * set a password with DCERPC/SAMR calls
679 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
680 * is it correct to contact the the pdc of the domain of the user who's password should be set?
681 * 2. do a samr_Connect to get a policy handle
682 * 3. do a samr_LookupDomain to get the domain sid
683 * 4. do a samr_OpenDomain to get a domain handle
684 * 5. do a samr_LookupNames to get the users rid
685 * 6. do a samr_OpenUser to get a user handle
686 * 7 call libnet_SetPassword_samr_handle to set the password
687 */
688 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
689 {
690 NTSTATUS status;
691 struct libnet_RpcConnect c;
692 struct samr_Connect sc;
693 struct policy_handle p_handle;
694 struct samr_LookupDomain ld;
695 struct dom_sid2 *sid = NULL;
696 struct lsa_String d_name;
697 struct samr_OpenDomain od;
698 struct policy_handle d_handle;
699 struct samr_LookupNames ln;
700 struct samr_Ids rids, types;
701 struct samr_OpenUser ou;
702 struct policy_handle u_handle;
703 union libnet_SetPassword r2;
704
705 ZERO_STRUCT(c);
706 /* prepare connect to the SAMR pipe of users domain PDC */
707 c.level = LIBNET_RPC_CONNECT_PDC;
708 c.in.name = r->samr.in.domain_name;
709 c.in.dcerpc_iface = &ndr_table_samr;
710
711 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
712 status = libnet_RpcConnect(ctx, mem_ctx, &c);
713 if (!NT_STATUS_IS_OK(status)) {
714 r->samr.out.error_string = talloc_asprintf(mem_ctx,
715 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
716 r->samr.in.domain_name, nt_errstr(status));
717 return status;
718 }
719
720 /* prepare samr_Connect */
721 ZERO_STRUCT(p_handle);
722 sc.in.system_name = NULL;
723 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
724 sc.out.connect_handle = &p_handle;
725
726 /* 2. do a samr_Connect to get a policy handle */
727 status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc);
728 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) {
729 status = sc.out.result;
730 }
731 if (!NT_STATUS_IS_OK(status)) {
732 r->samr.out.error_string = talloc_asprintf(mem_ctx,
733 "samr_Connect failed: %s",
734 nt_errstr(status));
735 goto disconnect;
736 }
737
738 /* prepare samr_LookupDomain */
739 d_name.string = r->samr.in.domain_name;
740 ld.in.connect_handle = &p_handle;
741 ld.in.domain_name = &d_name;
742 ld.out.sid = &sid;
743
744 /* 3. do a samr_LookupDomain to get the domain sid */
745 status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld);
746 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ld.out.result)) {
747 status = ld.out.result;
748 }
749 if (!NT_STATUS_IS_OK(status)) {
750 r->samr.out.error_string = talloc_asprintf(mem_ctx,
751 "samr_LookupDomain for [%s] failed: %s",
752 r->samr.in.domain_name, nt_errstr(status));
753 goto disconnect;
754 }
755
756 /* prepare samr_OpenDomain */
757 ZERO_STRUCT(d_handle);
758 od.in.connect_handle = &p_handle;
759 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
760 od.in.sid = *ld.out.sid;
761 od.out.domain_handle = &d_handle;
762
763 /* 4. do a samr_OpenDomain to get a domain handle */
764 status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od);
765 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) {
766 status = od.out.result;
767 }
768 if (!NT_STATUS_IS_OK(status)) {
769 r->samr.out.error_string = talloc_asprintf(mem_ctx,
770 "samr_OpenDomain for [%s] failed: %s",
771 r->samr.in.domain_name, nt_errstr(status));
772 goto disconnect;
773 }
774
775 /* prepare samr_LookupNames */
776 ln.in.domain_handle = &d_handle;
777 ln.in.num_names = 1;
778 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
779 ln.out.rids = &rids;
780 ln.out.types = &types;
781 if (!ln.in.names) {
782 r->samr.out.error_string = "Out of Memory";
783 return NT_STATUS_NO_MEMORY;
784 }
785 ln.in.names[0].string = r->samr.in.account_name;
786
787 /* 5. do a samr_LookupNames to get the users rid */
788 status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln);
789 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) {
790 status = ln.out.result;
791 }
792 if (!NT_STATUS_IS_OK(status)) {
793 r->samr.out.error_string = talloc_asprintf(mem_ctx,
794 "samr_LookupNames for [%s] failed: %s",
795 r->samr.in.account_name, nt_errstr(status));
796 goto disconnect;
797 }
798
799 /* check if we got one RID for the user */
800 if (ln.out.rids->count != 1) {
801 r->samr.out.error_string = talloc_asprintf(mem_ctx,
802 "samr_LookupNames for [%s] returns %d RIDs",
803 r->samr.in.account_name, ln.out.rids->count);
804 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
805 goto disconnect;
806 }
807
808 if (ln.out.types->count != 1) {
809 r->samr.out.error_string = talloc_asprintf(mem_ctx,
810 "samr_LookupNames for [%s] returns %d RID TYPEs",
811 r->samr.in.account_name, ln.out.types->count);
812 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
813 goto disconnect;
814 }
815
816 /* prepare samr_OpenUser */
817 ZERO_STRUCT(u_handle);
818 ou.in.domain_handle = &d_handle;
819 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
820 ou.in.rid = ln.out.rids->ids[0];
821 ou.out.user_handle = &u_handle;
822
823 /* 6. do a samr_OpenUser to get a user handle */
824 status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou);
825 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) {
826 status = ou.out.result;
827 }
828 if (!NT_STATUS_IS_OK(status)) {
829 r->samr.out.error_string = talloc_asprintf(mem_ctx,
830 "samr_OpenUser for [%s] failed: %s",
831 r->samr.in.account_name, nt_errstr(status));
832 goto disconnect;
833 }
834
835 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
836 r2.samr_handle.in.account_name = r->samr.in.account_name;
837 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
838 r2.samr_handle.in.user_handle = &u_handle;
839 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
840 r2.samr_handle.in.info21 = NULL;
841
842 status = libnet_SetPassword(ctx, mem_ctx, &r2);
843
844 r->generic.out.error_string = r2.samr_handle.out.error_string;
845
846 disconnect:
847 /* close connection */
848 talloc_unlink(ctx, c.out.dcerpc_pipe);
849
850 return status;
851 }
852
853 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
854 {
855 NTSTATUS status;
856 union libnet_SetPassword r2;
857
858 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
859 r2.samr.in.account_name = r->generic.in.account_name;
860 r2.samr.in.domain_name = r->generic.in.domain_name;
861 r2.samr.in.newpassword = r->generic.in.newpassword;
862
863 r->generic.out.error_string = "Unknown Error";
864 status = libnet_SetPassword(ctx, mem_ctx, &r2);
865
866 r->generic.out.error_string = r2.samr.out.error_string;
867
868 return status;
869 }
870
871 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
872 {
873 switch (r->generic.level) {
874 case LIBNET_SET_PASSWORD_GENERIC:
875 return libnet_SetPassword_generic(ctx, mem_ctx, r);
876 case LIBNET_SET_PASSWORD_SAMR:
877 return libnet_SetPassword_samr(ctx, mem_ctx, r);
878 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
879 return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
880 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
881 return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
882 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
883 return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
884 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
885 return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
886 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
887 return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
888 case LIBNET_SET_PASSWORD_KRB5:
889 return NT_STATUS_NOT_IMPLEMENTED;
890 case LIBNET_SET_PASSWORD_LDAP:
891 return NT_STATUS_NOT_IMPLEMENTED;
892 case LIBNET_SET_PASSWORD_RAP:
893 return NT_STATUS_NOT_IMPLEMENTED;
894 }
895
896 return NT_STATUS_INVALID_LEVEL;
897 }
Samba GIT mirror