source/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    NT Domain Authentication SMB / MSRPC client
   5    Copyright (C) Andrew Tridgell 1994-1999
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-1999
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23
  24 #ifdef SYSLOG
  25 #undef SYSLOG
  26 #endif
  27
  28 #include "includes.h"
  29 #include "nterr.h"
  30
  31 extern int DEBUGLEVEL;
  32
  33 #define DEBUG_TESTING
  34
  35 extern FILE* out_hnd;
  36
  37 /****************************************************************************
  38 nt enumerate trusted domains
  39 ****************************************************************************/
  40 void cmd_lsa_enum_trust_dom(struct client_info *info, int argc, char *argv[])
  41 {
  42         fstring srv_name;
  43         uint32 num_doms = 0;
  44         char **domains = NULL;
  45         DOM_SID **sids = NULL;
  46         uint32 enum_ctx = 0;
  47         POLICY_HND lsa_pol;
  48
  49         BOOL res = True;
  50
  51         fstrcpy(srv_name, "\\\\");
  52         fstrcat(srv_name, info->dest_host);
  53         strupper(srv_name);
  54
  55         DEBUG(4,("cmd_lsa_enum_trust_dom: server:%s\n", srv_name));
  56
  57         /* lookup domain controller; receive a policy handle */
  58         res = res ? lsa_open_policy( srv_name,
  59                                 &lsa_pol, False, 0x02000000) : False;
  60
  61         do
  62         {
  63                 /* send enum trusted domains query */
  64                 res = res ? lsa_enum_trust_dom( &lsa_pol,
  65                                           &enum_ctx,
  66                                           &num_doms, &domains, &sids) : False;
  67
  68         } while (res && enum_ctx != 0);
  69
  70         res = res ? lsa_close(&lsa_pol) : False;
  71
  72         if (res)
  73         {
  74                 uint32 i;
  75                 DEBUG(5,("cmd_lsa_enum_trust_dom: query succeeded\n"));
  76
  77                 report(out_hnd, "LSA Enumerate Trusted Domains\n");
  78                 for (i = 0; i < num_doms; i++)
  79                 {
  80                         fstring sid;
  81                         sid_to_string(sid, sids[i]);
  82                         report(out_hnd, "Domain:\t%s\tSID:\t%s\n",
  83                               domains[i], sid);
  84                 }
  85         }
  86         else
  87         {
  88                 DEBUG(5,("cmd_lsa_enum_trust_dom: query failed\n"));
  89         }
  90
  91         free_char_array(num_doms, domains);
  92         free_sid_array(num_doms, sids);
  93 }
  94
  95 /****************************************************************************
  96 nt lsa query
  97 ****************************************************************************/
  98 void cmd_lsa_query_info(struct client_info *info, int argc, char *argv[])
  99 {
 100         fstring srv_name;
 101         POLICY_HND lsa_pol;
 102
 103         BOOL res = True;
 104
 105         fstrcpy(info->dom.level3_dom, "");
 106         fstrcpy(info->dom.level5_dom, "");
 107         ZERO_STRUCT(info->dom.level3_sid);
 108         ZERO_STRUCT(info->dom.level5_sid);
 109
 110         fstrcpy(srv_name, "\\\\");
 111         fstrcat(srv_name, info->dest_host);
 112         strupper(srv_name);
 113
 114         DEBUG(4,("cmd_lsa_query_info: server:%s\n", srv_name));
 115
 116         /* lookup domain controller; receive a policy handle */
 117         res = res ? lsa_open_policy( srv_name,
 118                                 &lsa_pol, False, 0x02000000) : False;
 119
 120         /* send client info query, level 3.  receive domain name and sid */
 121         res = res ? lsa_query_info_pol( &lsa_pol, 0x03,
 122                                           info->dom.level3_dom,
 123                                           &info->dom.level3_sid) : False;
 124
 125         /* send client info query, level 5.  receive domain name and sid */
 126         res = res ? lsa_query_info_pol( &lsa_pol, 0x05,
 127                                 info->dom.level5_dom,
 128                                 &info->dom.level5_sid) : False;
 129
 130         res = res ? lsa_close(&lsa_pol) : False;
 131
 132         if (res)
 133         {
 134                 BOOL domain_something = False;
 135                 fstring sid;
 136                 DEBUG(5,("cmd_lsa_query_info: query succeeded\n"));
 137
 138                 report(out_hnd, "LSA Query Info Policy\n");
 139
 140                 if (info->dom.level3_dom[0] != 0)
 141                 {
 142                         sid_to_string(sid, &info->dom.level3_sid);
 143                         report(out_hnd, "Domain Member     - Domain: %s SID: %s\n",
 144                                 info->dom.level3_dom, sid);
 145                         domain_something = True;
 146                 }
 147                 if (info->dom.level5_dom[0] != 0)
 148                 {
 149                         sid_to_string(sid, &info->dom.level5_sid);
 150                         report(out_hnd, "Domain Controller - Domain: %s SID: %s\n",
 151                                 info->dom.level5_dom, sid);
 152                         domain_something = True;
 153                 }
 154                 if (!domain_something)
 155                 {
 156                         report(out_hnd, "%s is not a Domain Member or Controller\n",
 157                             info->dest_host);
 158                 }
 159         }
 160         else
 161         {
 162                 DEBUG(5,("cmd_lsa_query_info: query failed\n"));
 163         }
 164 }
 165
 166 /****************************************************************************
 167 lookup names
 168 ****************************************************************************/
 169 void cmd_lsa_lookup_names(struct client_info *info, int argc, char *argv[])
 170 {
 171         fstring srv_name;
 172         int num_names = 0;
 173         char **names;
 174         uint32 *types = NULL;
 175         DOM_SID *sids = NULL;
 176         int num_sids = 0;
 177         uint32 ret;
 178
 179         fstrcpy(srv_name, "\\\\");
 180         fstrcat(srv_name, info->dest_host);
 181         strupper(srv_name);
 182
 183         DEBUG(4,("cmd_lsa_lookup_names: server: %s\n", srv_name));
 184
 185         argc--;
 186         argv++;
 187
 188         num_names = argc;
 189         names = argv;
 190
 191         if (num_names <= 0)
 192         {
 193                 report(out_hnd, "lookupnames <name> [<name> ...]\n");
 194                 return;
 195         }
 196
 197         ret = lookup_lsa_names(srv_name,
 198                                num_names, names,
 199                                &num_sids, &sids, &types);
 200
 201         if (ret != 0x0)
 202         {
 203                 report(out_hnd, "cmd_lsa_lookup_names: FAILED: %s\n",
 204                        get_nt_error_msg(ret));
 205         }
 206
 207         if (sids != NULL)
 208         {
 209                 int i;
 210                 fstring temp;
 211
 212                 report(out_hnd, "Lookup Names:\n");
 213                 for (i = 0; i < num_sids; i++)
 214                 {
 215                         sid_to_string(temp, &sids[i]);
 216                         report(out_hnd, "SID: %s -> %s (%d: %s)\n",
 217                                names[i], temp, types[i],
 218                                get_sid_name_use_str(types[i]));
 219 #if 0
 220                         if (sids[i] != NULL)
 221                         {
 222                                 free(sids[i]);
 223                         }
 224 #endif
 225                 }
 226                 free(sids);
 227         }
 228         safe_free(types);
 229 }
 230
 231 /****************************************************************************
 232 lookup sids
 233 ****************************************************************************/
 234 void cmd_lsa_lookup_sids(struct client_info *info, int argc, char *argv[])
 235 {
 236         POLICY_HND lsa_pol;
 237         int i;
 238         pstring sid_name;
 239         fstring srv_name;
 240         DOM_SID **sids = NULL;
 241         uint32 num_sids = 0;
 242         char **names = NULL;
 243         uint32 *types = NULL;
 244         int num_names = 0;
 245
 246         BOOL res = True;
 247
 248         fstrcpy(srv_name, "\\\\");
 249         fstrcat(srv_name, info->dest_host);
 250         strupper(srv_name);
 251
 252         DEBUG(4,("cmd_lsa_lookup_sids: server: %s\n", srv_name));
 253
 254         argv++;
 255         argc--;
 256
 257         while (argc > 0)
 258         {
 259                 DOM_SID sid;
 260                 if (strnequal("S-", argv[0], 2))
 261                 {
 262                         fstrcpy(sid_name, argv[0]);
 263                 }
 264                 else
 265                 {
 266                         sid_to_string(sid_name, &info->dom.level5_sid);
 267
 268                         if (sid_name[0] == 0)
 269                         {
 270                                 report(out_hnd, "please use lsaquery first or specify a complete SID\n");
 271                                 return;
 272                         }
 273
 274                         fstrcat(sid_name, "-");
 275                         fstrcat(sid_name, argv[0]);
 276                 }
 277                 string_to_sid(&sid, sid_name);
 278
 279                 add_sid_to_array(&num_sids, &sids, &sid);
 280
 281                 argc--;
 282                 argv++;
 283         }
 284
 285         if (num_sids == 0)
 286         {
 287                 report(out_hnd, "lookupsid RID or SID\n");
 288                 return;
 289         }
 290
 291         /* lookup domain controller; receive a policy handle */
 292         res = res ? lsa_open_policy( srv_name,
 293                                 &lsa_pol, True, 0x02000000) : False;
 294
 295         /* send lsa lookup sids call */
 296         res = res ? lsa_lookup_sids( &lsa_pol,
 297                                        num_sids, sids,
 298                                        &names, &types, &num_names) : False;
 299
 300         res = res ? lsa_close(&lsa_pol) : False;
 301
 302         if (res)
 303         {
 304                 DEBUG(5,("cmd_lsa_lookup_sids: query succeeded\n"));
 305         }
 306         else
 307         {
 308                 DEBUG(5,("cmd_lsa_lookup_sids: query failed\n"));
 309         }
 310         if (names != NULL)
 311         {
 312                 report(out_hnd, "Lookup SIDS:\n");
 313                 for (i = 0; i < num_names; i++)
 314                 {
 315                         fstring temp;
 316                         sid_to_string(temp, sids[i]);
 317                         report(out_hnd, "SID: %s -> %s (%d: %s)\n",
 318                                temp, names[i], types[i],
 319                                get_sid_name_use_str(types[i]));
 320                         if (names[i] != NULL)
 321                         {
 322                                 free(names[i]);
 323                         }
 324                 }
 325                 free(names);
 326         }
 327
 328         if (types)
 329         {
 330                 free(types);
 331         }
 332
 333         free_sid_array(num_sids, sids);
 334 }
 335
 336 /****************************************************************************
 337 nt lsa query
 338 ****************************************************************************/
 339 void cmd_lsa_set_secret(struct client_info *info, int argc, char *argv[])
 340 {
 341         char *secret_name;
 342         fstring srv_name;
 343         char *data;
 344         int len;
 345         UNISTR2 uni_data;
 346
 347         fstrcpy(srv_name, "\\\\");
 348         fstrcat(srv_name, info->dest_host);
 349         strupper(srv_name);
 350
 351         if (argc != 3)
 352         {
 353                 report(out_hnd, "setsecret <secret name> <secret value>\n");
 354                 return;
 355         }
 356
 357         secret_name = argv[1];
 358         data = argv[2];
 359         len = strlen(argv[2]);
 360
 361         make_unistr2(&uni_data, data, len);
 362
 363         if (msrpc_lsa_set_secret(srv_name, secret_name,
 364             (const char*)uni_data.buffer, uni_data.uni_str_len * 2))
 365         {
 366                 report(out_hnd, "LSA Set Secret: OK\n");
 367         }
 368         else
 369         {
 370                 report(out_hnd, "LSA Set Secret: failed\n");
 371         }
 372 }
 373
 374 /****************************************************************************
 375 nt lsa query
 376 ****************************************************************************/
 377 void cmd_lsa_create_secret(struct client_info *info, int argc, char *argv[])
 378 {
 379         char *secret_name;
 380         fstring srv_name;
 381
 382         fstrcpy(srv_name, "\\\\");
 383         fstrcat(srv_name, info->dest_host);
 384         strupper(srv_name);
 385
 386         if (argc > 2)
 387         {
 388                 report(out_hnd, "createsecret <secret name>\n");
 389                 return;
 390         }
 391
 392         secret_name = argv[1];
 393
 394         if (msrpc_lsa_create_secret(srv_name, secret_name, 0x020003))
 395         {
 396                 report(out_hnd, "LSA Create Secret: OK\n");
 397         }
 398         else
 399         {
 400                 report(out_hnd, "LSA Query Secret: failed\n");
 401         }
 402 }
 403
 404 /****************************************************************************
 405 nt lsa query
 406 ****************************************************************************/
 407 void cmd_lsa_query_secret_secobj(struct client_info *info, int argc, char *argv[])
 408 {
 409         char *secret_name;
 410         fstring srv_name;
 411
 412         BOOL res = True;
 413         BOOL res1;
 414         BOOL res2;
 415
 416         POLICY_HND pol_sec;
 417         POLICY_HND lsa_pol;
 418         SEC_DESC_BUF buf;
 419
 420         fstrcpy(srv_name, "\\\\");
 421         fstrcat(srv_name, info->dest_host);
 422         strupper(srv_name);
 423
 424         ZERO_STRUCT(buf);
 425
 426         if (argc > 2)
 427         {
 428                 report(out_hnd, "querysecretsecdes <secret name>\n");
 429                 return;
 430         }
 431
 432         secret_name = argv[1];
 433
 434         /* lookup domain controller; receive a policy handle */
 435         res = res ? lsa_open_policy(srv_name,
 436                                      &lsa_pol, False, 0x02000000) : False;
 437
 438         /* lookup domain controller; receive a policy handle */
 439         res1 = res ? lsa_open_secret(&lsa_pol,
 440                                      secret_name, 0x02000000,
 441                                      &pol_sec) : False;
 442
 443         res2 = res1 ? lsa_query_sec_obj(&pol_sec, 0x07, &buf) : False;
 444
 445         if (buf.sec != NULL)
 446         {
 447                 display_sec_desc(out_hnd, ACTION_HEADER   , buf.sec);
 448                 display_sec_desc(out_hnd, ACTION_ENUMERATE, buf.sec);
 449                 display_sec_desc(out_hnd, ACTION_FOOTER   , buf.sec);
 450         }
 451         else
 452         {
 453                 report(out_hnd, "LSA Query Secret: failed\n");
 454         }
 455
 456         free_sec_desc_buf(&buf);
 457
 458         res1 = res1 ? lsa_close(&pol_sec) : False;
 459         res = res ? lsa_close(&lsa_pol) : False;
 460
 461
 462 }
 463
 464 /****************************************************************************
 465 nt lsa query
 466 ****************************************************************************/
 467 void cmd_lsa_query_secret(struct client_info *info, int argc, char *argv[])
 468 {
 469         char *secret_name;
 470         STRING2 secret;
 471         NTTIME last_update;
 472         fstring srv_name;
 473
 474         fstrcpy(srv_name, "\\\\");
 475         fstrcat(srv_name, info->dest_host);
 476         strupper(srv_name);
 477
 478         ZERO_STRUCT(secret);
 479
 480         if (argc > 2)
 481         {
 482                 report(out_hnd, "querysecret <secret name>\n");
 483                 return;
 484         }
 485
 486         secret_name = argv[1];
 487
 488         if (msrpc_lsa_query_secret(srv_name, secret_name, &secret,
 489                                    &last_update))
 490         {
 491                 int i;
 492                 report(out_hnd, "\tValue       : ");
 493                 for (i = 0; i < secret.str_str_len; i++)
 494                 {
 495                         report(out_hnd, "%02X", secret.buffer[i]);
 496                 }
 497
 498                 report(out_hnd, "\n\tLast Updated: %s\n\n",
 499                         http_timestring(nt_time_to_unix(&last_update)));
 500         }
 501         else
 502         {
 503                 report(out_hnd, "LSA Query Secret: failed\n");
 504         }
 505 }
 506