?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4/ldb: expose the ldb flags with ldb_get_flags()
[Samba/aatanasov.git] / source3 / rpcclient / cmd_lsarpc.c
blobd7f8041779309c1b0cfe1158c9418d06a2a15921
1 /*
2 Unix SMB/CIFS implementation.
3 RPC pipe client
4
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
7 Copyright (C) Guenther Deschner 2008
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpcclient.h"
25 #include "../libcli/auth/libcli_auth.h"
26
27 /* useful function to allow entering a name instead of a SID and
28 * looking it up automatically */
29 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
30 TALLOC_CTX *mem_ctx,
31 DOM_SID *sid, const char *name)
32 {
33 struct policy_handle pol;
34 enum lsa_SidType *sid_types;
35 NTSTATUS result;
36 DOM_SID *sids;
37
38 /* maybe its a raw SID */
39 if (strncmp(name, "S-", 2) == 0 &&
40 string_to_sid(sid, name)) {
41 return NT_STATUS_OK;
42 }
43
44 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
45 SEC_FLAG_MAXIMUM_ALLOWED,
46 &pol);
47 if (!NT_STATUS_IS_OK(result))
48 goto done;
49
50 result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
51 if (!NT_STATUS_IS_OK(result))
52 goto done;
53
54 rpccli_lsa_Close(cli, mem_ctx, &pol);
55
56 *sid = sids[0];
57
58 done:
59 return result;
60 }
61
62 static void display_query_info_1(struct lsa_AuditLogInfo *r)
63 {
64 d_printf("percent_full:\t%d\n", r->percent_full);
65 d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
66 d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
67 d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
68 d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
69 d_printf("next_audit_record:\t%d\n", r->next_audit_record);
70 }
71
72 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
73 {
74 int i;
75 d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
76 d_printf("Auditing categories:\t%d\n", r->count);
77 d_printf("Auditsettings:\n");
78 for (i=0; i<r->count; i++) {
79 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
80 const char *policy = audit_description_str(i);
81 d_printf("%s:\t%s\n", policy, val);
82 }
83 }
84
85 static void display_query_info_3(struct lsa_DomainInfo *r)
86 {
87 d_printf("Domain Name: %s\n", r->name.string);
88 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
89 }
90
91 static void display_query_info_5(struct lsa_DomainInfo *r)
92 {
93 d_printf("Domain Name: %s\n", r->name.string);
94 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
95 }
96
97 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
98 {
99 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
100 }
101
102 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
103 {
104 d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
105 d_printf("Log is full: %d\n", r->log_is_full);
106 }
107
108 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
109 {
110 d_printf("Domain NetBios Name: %s\n", r->name.string);
111 d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
112 d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
113 d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
114 d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
115 &r->domain_guid));
116 }
117
118 static void display_lsa_query_info(union lsa_PolicyInformation *info,
119 enum lsa_PolicyInfo level)
120 {
121 switch (level) {
122 case 1:
123 display_query_info_1(&info->audit_log);
124 break;
125 case 2:
126 display_query_info_2(&info->audit_events);
127 break;
128 case 3:
129 display_query_info_3(&info->domain);
130 break;
131 case 5:
132 display_query_info_5(&info->account_domain);
133 break;
134 case 10:
135 display_query_info_10(&info->auditfullset);
136 break;
137 case 11:
138 display_query_info_11(&info->auditfullquery);
139 break;
140 case 12:
141 display_query_info_12(&info->dns);
142 break;
143 default:
144 printf("can't display info level: %d\n", level);
145 break;
146 }
147 }
148
149 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
150 TALLOC_CTX *mem_ctx, int argc,
151 const char **argv)
152 {
153 struct policy_handle pol;
154 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
155 union lsa_PolicyInformation *info = NULL;
156
157 uint32 info_class = 3;
158
159 if (argc > 2) {
160 printf("Usage: %s [info_class]\n", argv[0]);
161 return NT_STATUS_OK;
162 }
163
164 if (argc == 2)
165 info_class = atoi(argv[1]);
166
167 switch (info_class) {
168 case 12:
169 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
170 SEC_FLAG_MAXIMUM_ALLOWED,
171 &pol);
172
173 if (!NT_STATUS_IS_OK(result))
174 goto done;
175
176 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
177 &pol,
178 info_class,
179 &info);
180 break;
181 default:
182 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
183 SEC_FLAG_MAXIMUM_ALLOWED,
184 &pol);
185
186 if (!NT_STATUS_IS_OK(result))
187 goto done;
188
189 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
190 &pol,
191 info_class,
192 &info);
193 }
194
195 if (NT_STATUS_IS_OK(result)) {
196 display_lsa_query_info(info, info_class);
197 }
198
199 rpccli_lsa_Close(cli, mem_ctx, &pol);
200
201 done:
202 return result;
203 }
204
205 /* Resolve a list of names to a list of sids */
206
207 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
208 TALLOC_CTX *mem_ctx, int argc,
209 const char **argv)
210 {
211 struct policy_handle pol;
212 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
213 DOM_SID *sids;
214 enum lsa_SidType *types;
215 int i;
216
217 if (argc == 1) {
218 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
219 return NT_STATUS_OK;
220 }
221
222 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
223 SEC_FLAG_MAXIMUM_ALLOWED,
224 &pol);
225
226 if (!NT_STATUS_IS_OK(result))
227 goto done;
228
229 result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
230 (const char**)(argv + 1), NULL, 1, &sids, &types);
231
232 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
233 NT_STATUS_V(STATUS_SOME_UNMAPPED))
234 goto done;
235
236 result = NT_STATUS_OK;
237
238 /* Print results */
239
240 for (i = 0; i < (argc - 1); i++) {
241 fstring sid_str;
242 sid_to_fstring(sid_str, &sids[i]);
243 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
244 sid_type_lookup(types[i]), types[i]);
245 }
246
247 rpccli_lsa_Close(cli, mem_ctx, &pol);
248
249 done:
250 return result;
251 }
252
253 /* Resolve a list of names to a list of sids */
254
255 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
256 TALLOC_CTX *mem_ctx, int argc,
257 const char **argv)
258 {
259 struct policy_handle pol;
260 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
261 DOM_SID *sids;
262 enum lsa_SidType *types;
263 int i, level;
264
265 if (argc < 3) {
266 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
267 return NT_STATUS_OK;
268 }
269
270 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
271 SEC_FLAG_MAXIMUM_ALLOWED,
272 &pol);
273
274 if (!NT_STATUS_IS_OK(result))
275 goto done;
276
277 level = atoi(argv[1]);
278
279 result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
280 (const char**)(argv + 2), NULL, level, &sids, &types);
281
282 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
283 NT_STATUS_V(STATUS_SOME_UNMAPPED))
284 goto done;
285
286 result = NT_STATUS_OK;
287
288 /* Print results */
289
290 for (i = 0; i < (argc - 2); i++) {
291 fstring sid_str;
292 sid_to_fstring(sid_str, &sids[i]);
293 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
294 sid_type_lookup(types[i]), types[i]);
295 }
296
297 rpccli_lsa_Close(cli, mem_ctx, &pol);
298
299 done:
300 return result;
301 }
302
303
304 /* Resolve a list of SIDs to a list of names */
305
306 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
307 int argc, const char **argv)
308 {
309 struct policy_handle pol;
310 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
311 DOM_SID *sids;
312 char **domains;
313 char **names;
314 enum lsa_SidType *types;
315 int i;
316
317 if (argc == 1) {
318 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
319 return NT_STATUS_OK;
320 }
321
322 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
323 SEC_FLAG_MAXIMUM_ALLOWED,
324 &pol);
325
326 if (!NT_STATUS_IS_OK(result))
327 goto done;
328
329 /* Convert arguments to sids */
330
331 sids = TALLOC_ARRAY(mem_ctx, DOM_SID, argc - 1);
332
333 if (!sids) {
334 printf("could not allocate memory for %d sids\n", argc - 1);
335 goto done;
336 }
337
338 for (i = 0; i < argc - 1; i++)
339 if (!string_to_sid(&sids[i], argv[i + 1])) {
340 result = NT_STATUS_INVALID_SID;
341 goto done;
342 }
343
344 /* Lookup the SIDs */
345
346 result = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
347 &domains, &names, &types);
348
349 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
350 NT_STATUS_V(STATUS_SOME_UNMAPPED))
351 goto done;
352
353 result = NT_STATUS_OK;
354
355 /* Print results */
356
357 for (i = 0; i < (argc - 1); i++) {
358 fstring sid_str;
359
360 sid_to_fstring(sid_str, &sids[i]);
361 printf("%s %s\\%s (%d)\n", sid_str,
362 domains[i] ? domains[i] : "*unknown*",
363 names[i] ? names[i] : "*unknown*", types[i]);
364 }
365
366 rpccli_lsa_Close(cli, mem_ctx, &pol);
367
368 done:
369 return result;
370 }
371
372 /* Enumerate list of trusted domains */
373
374 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
375 TALLOC_CTX *mem_ctx, int argc,
376 const char **argv)
377 {
378 struct policy_handle pol;
379 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
380 struct lsa_DomainList domain_list;
381
382 /* defaults, but may be changed using params */
383 uint32 enum_ctx = 0;
384 int i;
385 uint32_t max_size = (uint32_t)-1;
386
387 if (argc > 2) {
388 printf("Usage: %s [enum context (0)]\n", argv[0]);
389 return NT_STATUS_OK;
390 }
391
392 if (argc == 2 && argv[1]) {
393 enum_ctx = atoi(argv[2]);
394 }
395
396 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
397 LSA_POLICY_VIEW_LOCAL_INFORMATION,
398 &pol);
399
400 if (!NT_STATUS_IS_OK(result))
401 goto done;
402
403 result = STATUS_MORE_ENTRIES;
404
405 while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
406
407 /* Lookup list of trusted domains */
408
409 result = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
410 &pol,
411 &enum_ctx,
412 &domain_list,
413 max_size);
414 if (!NT_STATUS_IS_OK(result) &&
415 !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
416 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
417 goto done;
418
419 /* Print results: list of names and sids returned in this
420 * response. */
421 for (i = 0; i < domain_list.count; i++) {
422 fstring sid_str;
423
424 sid_to_fstring(sid_str, domain_list.domains[i].sid);
425 printf("%s %s\n",
426 domain_list.domains[i].name.string ?
427 domain_list.domains[i].name.string : "*unknown*",
428 sid_str);
429 }
430 }
431
432 rpccli_lsa_Close(cli, mem_ctx, &pol);
433 done:
434 return result;
435 }
436
437 /* Enumerates privileges */
438
439 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
440 TALLOC_CTX *mem_ctx, int argc,
441 const char **argv)
442 {
443 struct policy_handle pol;
444 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
445 struct lsa_PrivArray priv_array;
446
447 uint32 enum_context=0;
448 uint32 pref_max_length=0x1000;
449 int i;
450
451 if (argc > 3) {
452 printf("Usage: %s [enum context] [max length]\n", argv[0]);
453 return NT_STATUS_OK;
454 }
455
456 if (argc>=2)
457 enum_context=atoi(argv[1]);
458
459 if (argc==3)
460 pref_max_length=atoi(argv[2]);
461
462 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
463 SEC_FLAG_MAXIMUM_ALLOWED,
464 &pol);
465
466 if (!NT_STATUS_IS_OK(result))
467 goto done;
468
469 result = rpccli_lsa_EnumPrivs(cli, mem_ctx,
470 &pol,
471 &enum_context,
472 &priv_array,
473 pref_max_length);
474 if (!NT_STATUS_IS_OK(result))
475 goto done;
476
477 /* Print results */
478 printf("found %d privileges\n\n", priv_array.count);
479
480 for (i = 0; i < priv_array.count; i++) {
481 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
482 priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
483 priv_array.privs[i].luid.high,
484 priv_array.privs[i].luid.low,
485 priv_array.privs[i].luid.high,
486 priv_array.privs[i].luid.low);
487 }
488
489 rpccli_lsa_Close(cli, mem_ctx, &pol);
490 done:
491 return result;
492 }
493
494 /* Get privilege name */
495
496 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
497 TALLOC_CTX *mem_ctx, int argc,
498 const char **argv)
499 {
500 struct policy_handle pol;
501 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
502
503 uint16 lang_id=0;
504 uint16 lang_id_sys=0;
505 uint16 lang_id_desc;
506 struct lsa_String lsa_name;
507 struct lsa_StringLarge *description = NULL;
508
509 if (argc != 2) {
510 printf("Usage: %s privilege name\n", argv[0]);
511 return NT_STATUS_OK;
512 }
513
514 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
515 SEC_FLAG_MAXIMUM_ALLOWED,
516 &pol);
517
518 if (!NT_STATUS_IS_OK(result))
519 goto done;
520
521 init_lsa_String(&lsa_name, argv[1]);
522
523 result = rpccli_lsa_LookupPrivDisplayName(cli, mem_ctx,
524 &pol,
525 &lsa_name,
526 lang_id,
527 lang_id_sys,
528 &description,
529 &lang_id_desc);
530
531 if (!NT_STATUS_IS_OK(result))
532 goto done;
533
534 /* Print results */
535 printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
536
537 rpccli_lsa_Close(cli, mem_ctx, &pol);
538 done:
539 return result;
540 }
541
542 /* Enumerate the LSA SIDS */
543
544 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
545 TALLOC_CTX *mem_ctx, int argc,
546 const char **argv)
547 {
548 struct policy_handle pol;
549 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
550
551 uint32 enum_context=0;
552 uint32 pref_max_length=0x1000;
553 struct lsa_SidArray sid_array;
554 int i;
555
556 if (argc > 3) {
557 printf("Usage: %s [enum context] [max length]\n", argv[0]);
558 return NT_STATUS_OK;
559 }
560
561 if (argc>=2)
562 enum_context=atoi(argv[1]);
563
564 if (argc==3)
565 pref_max_length=atoi(argv[2]);
566
567 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
568 SEC_FLAG_MAXIMUM_ALLOWED,
569 &pol);
570
571 if (!NT_STATUS_IS_OK(result))
572 goto done;
573
574 result = rpccli_lsa_EnumAccounts(cli, mem_ctx,
575 &pol,
576 &enum_context,
577 &sid_array,
578 pref_max_length);
579
580 if (!NT_STATUS_IS_OK(result))
581 goto done;
582
583 /* Print results */
584 printf("found %d SIDs\n\n", sid_array.num_sids);
585
586 for (i = 0; i < sid_array.num_sids; i++) {
587 fstring sid_str;
588
589 sid_to_fstring(sid_str, sid_array.sids[i].sid);
590 printf("%s\n", sid_str);
591 }
592
593 rpccli_lsa_Close(cli, mem_ctx, &pol);
594 done:
595 return result;
596 }
597
598 /* Create a new account */
599
600 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
601 TALLOC_CTX *mem_ctx, int argc,
602 const char **argv)
603 {
604 struct policy_handle dom_pol;
605 struct policy_handle user_pol;
606 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
607 uint32 des_access = 0x000f000f;
608
609 DOM_SID sid;
610
611 if (argc != 2 ) {
612 printf("Usage: %s SID\n", argv[0]);
613 return NT_STATUS_OK;
614 }
615
616 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
617 if (!NT_STATUS_IS_OK(result))
618 goto done;
619
620 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
621 SEC_FLAG_MAXIMUM_ALLOWED,
622 &dom_pol);
623
624 if (!NT_STATUS_IS_OK(result))
625 goto done;
626
627 result = rpccli_lsa_CreateAccount(cli, mem_ctx,
628 &dom_pol,
629 &sid,
630 des_access,
631 &user_pol);
632
633 if (!NT_STATUS_IS_OK(result))
634 goto done;
635
636 printf("Account for SID %s successfully created\n\n", argv[1]);
637 result = NT_STATUS_OK;
638
639 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
640 done:
641 return result;
642 }
643
644
645 /* Enumerate the privileges of an SID */
646
647 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
648 TALLOC_CTX *mem_ctx, int argc,
649 const char **argv)
650 {
651 struct policy_handle dom_pol;
652 struct policy_handle user_pol;
653 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
654 uint32 access_desired = 0x000f000f;
655 DOM_SID sid;
656 struct lsa_PrivilegeSet *privs = NULL;
657 int i;
658
659 if (argc != 2 ) {
660 printf("Usage: %s SID\n", argv[0]);
661 return NT_STATUS_OK;
662 }
663
664 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
665 if (!NT_STATUS_IS_OK(result))
666 goto done;
667
668 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
669 SEC_FLAG_MAXIMUM_ALLOWED,
670 &dom_pol);
671
672 if (!NT_STATUS_IS_OK(result))
673 goto done;
674
675 result = rpccli_lsa_OpenAccount(cli, mem_ctx,
676 &dom_pol,
677 &sid,
678 access_desired,
679 &user_pol);
680
681 if (!NT_STATUS_IS_OK(result))
682 goto done;
683
684 result = rpccli_lsa_EnumPrivsAccount(cli, mem_ctx,
685 &user_pol,
686 &privs);
687
688 if (!NT_STATUS_IS_OK(result))
689 goto done;
690
691 /* Print results */
692 printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
693 printf("high\tlow\tattribute\n");
694
695 for (i = 0; i < privs->count; i++) {
696 printf("%u\t%u\t%u\n",
697 privs->set[i].luid.high,
698 privs->set[i].luid.low,
699 privs->set[i].attribute);
700 }
701
702 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
703 done:
704 return result;
705 }
706
707
708 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
709
710 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
711 TALLOC_CTX *mem_ctx, int argc,
712 const char **argv)
713 {
714 struct policy_handle dom_pol;
715 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
716 DOM_SID sid;
717 struct lsa_RightSet rights;
718
719 int i;
720
721 if (argc != 2 ) {
722 printf("Usage: %s SID\n", argv[0]);
723 return NT_STATUS_OK;
724 }
725
726 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
727 if (!NT_STATUS_IS_OK(result))
728 goto done;
729
730 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
731 SEC_FLAG_MAXIMUM_ALLOWED,
732 &dom_pol);
733
734 if (!NT_STATUS_IS_OK(result))
735 goto done;
736
737 result = rpccli_lsa_EnumAccountRights(cli, mem_ctx,
738 &dom_pol,
739 &sid,
740 &rights);
741
742 if (!NT_STATUS_IS_OK(result))
743 goto done;
744
745 printf("found %d privileges for SID %s\n", rights.count,
746 sid_string_tos(&sid));
747
748 for (i = 0; i < rights.count; i++) {
749 printf("\t%s\n", rights.names[i].string);
750 }
751
752 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
753 done:
754 return result;
755 }
756
757
758 /* add some privileges to a SID via LsaAddAccountRights */
759
760 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
761 TALLOC_CTX *mem_ctx, int argc,
762 const char **argv)
763 {
764 struct policy_handle dom_pol;
765 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
766 struct lsa_RightSet rights;
767 DOM_SID sid;
768 int i;
769
770 if (argc < 3 ) {
771 printf("Usage: %s SID [rights...]\n", argv[0]);
772 return NT_STATUS_OK;
773 }
774
775 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
776 if (!NT_STATUS_IS_OK(result))
777 goto done;
778
779 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
780 SEC_FLAG_MAXIMUM_ALLOWED,
781 &dom_pol);
782
783 if (!NT_STATUS_IS_OK(result))
784 goto done;
785
786 rights.count = argc-2;
787 rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
788 rights.count);
789 if (!rights.names) {
790 return NT_STATUS_NO_MEMORY;
791 }
792
793 for (i=0; i<argc-2; i++) {
794 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
795 }
796
797 result = rpccli_lsa_AddAccountRights(cli, mem_ctx,
798 &dom_pol,
799 &sid,
800 &rights);
801
802 if (!NT_STATUS_IS_OK(result))
803 goto done;
804
805 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
806 done:
807 return result;
808 }
809
810
811 /* remove some privileges to a SID via LsaRemoveAccountRights */
812
813 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
814 TALLOC_CTX *mem_ctx, int argc,
815 const char **argv)
816 {
817 struct policy_handle dom_pol;
818 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
819 struct lsa_RightSet rights;
820 DOM_SID sid;
821 int i;
822
823 if (argc < 3 ) {
824 printf("Usage: %s SID [rights...]\n", argv[0]);
825 return NT_STATUS_OK;
826 }
827
828 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
829 if (!NT_STATUS_IS_OK(result))
830 goto done;
831
832 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
833 SEC_FLAG_MAXIMUM_ALLOWED,
834 &dom_pol);
835
836 if (!NT_STATUS_IS_OK(result))
837 goto done;
838
839 rights.count = argc-2;
840 rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
841 rights.count);
842 if (!rights.names) {
843 return NT_STATUS_NO_MEMORY;
844 }
845
846 for (i=0; i<argc-2; i++) {
847 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
848 }
849
850 result = rpccli_lsa_RemoveAccountRights(cli, mem_ctx,
851 &dom_pol,
852 &sid,
853 false,
854 &rights);
855
856 if (!NT_STATUS_IS_OK(result))
857 goto done;
858
859 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
860
861 done:
862 return result;
863 }
864
865
866 /* Get a privilege value given its name */
867
868 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
869 TALLOC_CTX *mem_ctx, int argc,
870 const char **argv)
871 {
872 struct policy_handle pol;
873 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
874 struct lsa_LUID luid;
875 struct lsa_String name;
876
877 if (argc != 2 ) {
878 printf("Usage: %s name\n", argv[0]);
879 return NT_STATUS_OK;
880 }
881
882 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
883 SEC_FLAG_MAXIMUM_ALLOWED,
884 &pol);
885
886 if (!NT_STATUS_IS_OK(result))
887 goto done;
888
889 init_lsa_String(&name, argv[1]);
890
891 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
892 &pol,
893 &name,
894 &luid);
895
896 if (!NT_STATUS_IS_OK(result))
897 goto done;
898
899 /* Print results */
900
901 printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
902
903 rpccli_lsa_Close(cli, mem_ctx, &pol);
904 done:
905 return result;
906 }
907
908 /* Query LSA security object */
909
910 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
911 TALLOC_CTX *mem_ctx, int argc,
912 const char **argv)
913 {
914 struct policy_handle pol;
915 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
916 SEC_DESC_BUF *sdb;
917 uint32 sec_info = DACL_SECURITY_INFORMATION;
918
919 if (argc < 1 || argc > 2) {
920 printf("Usage: %s [sec_info]\n", argv[0]);
921 return NT_STATUS_OK;
922 }
923
924 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
925 SEC_FLAG_MAXIMUM_ALLOWED,
926 &pol);
927
928 if (argc == 2)
929 sscanf(argv[1], "%x", &sec_info);
930
931 if (!NT_STATUS_IS_OK(result))
932 goto done;
933
934 result = rpccli_lsa_QuerySecurity(cli, mem_ctx,
935 &pol,
936 sec_info,
937 &sdb);
938 if (!NT_STATUS_IS_OK(result))
939 goto done;
940
941 /* Print results */
942
943 display_sec_desc(sdb->sd);
944
945 rpccli_lsa_Close(cli, mem_ctx, &pol);
946 done:
947 return result;
948 }
949
950 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
951 uint8_t session_key[16])
952 {
953 char *pwd, *pwd_old;
954
955 DATA_BLOB data = data_blob_const(p->password->data, p->password->length);
956 DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
957 DATA_BLOB session_key_blob = data_blob_const(session_key, sizeof(session_key));
958
959 pwd = sess_decrypt_string(talloc_tos(), &data, &session_key_blob);
960 pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key_blob);
961
962 d_printf("Password:\t%s\n", pwd);
963 d_printf("Old Password:\t%s\n", pwd_old);
964
965 talloc_free(pwd);
966 talloc_free(pwd_old);
967 }
968
969 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
970 union lsa_TrustedDomainInfo *info,
971 enum lsa_TrustDomInfoEnum info_class,
972 uint8_t nt_hash[16])
973 {
974 switch (info_class) {
975 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
976 display_trust_dom_info_4(&info->password, nt_hash);
977 break;
978 default: {
979 const char *str = NULL;
980 str = NDR_PRINT_UNION_STRING(mem_ctx,
981 lsa_TrustedDomainInfo,
982 info_class, info);
983 if (str) {
984 d_printf("%s\n", str);
985 }
986 break;
987 }
988 }
989 }
990
991 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
992 TALLOC_CTX *mem_ctx, int argc,
993 const char **argv)
994 {
995 struct policy_handle pol;
996 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
997 DOM_SID dom_sid;
998 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
999 union lsa_TrustedDomainInfo *info = NULL;
1000 enum lsa_TrustDomInfoEnum info_class = 1;
1001 uint8_t nt_hash[16];
1002
1003 if (argc > 3 || argc < 2) {
1004 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1005 return NT_STATUS_OK;
1006 }
1007
1008 if (!string_to_sid(&dom_sid, argv[1]))
1009 return NT_STATUS_NO_MEMORY;
1010
1011 if (argc == 3)
1012 info_class = atoi(argv[2]);
1013
1014 result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1015
1016 if (!NT_STATUS_IS_OK(result))
1017 goto done;
1018
1019 result = rpccli_lsa_QueryTrustedDomainInfoBySid(cli, mem_ctx,
1020 &pol,
1021 &dom_sid,
1022 info_class,
1023 &info);
1024 if (!NT_STATUS_IS_OK(result))
1025 goto done;
1026
1027 if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1028 d_fprintf(stderr, "Could not get pwd hash\n");
1029 goto done;
1030 }
1031
1032 display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1033
1034 done:
1035 rpccli_lsa_Close(cli, mem_ctx, &pol);
1036
1037 return result;
1038 }
1039
1040 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1041 TALLOC_CTX *mem_ctx, int argc,
1042 const char **argv)
1043 {
1044 struct policy_handle pol;
1045 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1046 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1047 union lsa_TrustedDomainInfo *info = NULL;
1048 enum lsa_TrustDomInfoEnum info_class = 1;
1049 struct lsa_String trusted_domain;
1050 uint8_t nt_hash[16];
1051
1052 if (argc > 3 || argc < 2) {
1053 printf("Usage: %s [name] [info_class]\n", argv[0]);
1054 return NT_STATUS_OK;
1055 }
1056
1057 if (argc == 3)
1058 info_class = atoi(argv[2]);
1059
1060 result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1061
1062 if (!NT_STATUS_IS_OK(result))
1063 goto done;
1064
1065 init_lsa_String(&trusted_domain, argv[1]);
1066
1067 result = rpccli_lsa_QueryTrustedDomainInfoByName(cli, mem_ctx,
1068 &pol,
1069 &trusted_domain,
1070 info_class,
1071 &info);
1072 if (!NT_STATUS_IS_OK(result))
1073 goto done;
1074
1075 if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1076 d_fprintf(stderr, "Could not get pwd hash\n");
1077 goto done;
1078 }
1079
1080 display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1081
1082 done:
1083 rpccli_lsa_Close(cli, mem_ctx, &pol);
1084
1085 return result;
1086 }
1087
1088 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1089 TALLOC_CTX *mem_ctx, int argc,
1090 const char **argv)
1091 {
1092 struct policy_handle pol, trustdom_pol;
1093 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1094 uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1095 union lsa_TrustedDomainInfo *info = NULL;
1096 DOM_SID dom_sid;
1097 enum lsa_TrustDomInfoEnum info_class = 1;
1098 uint8_t nt_hash[16];
1099
1100 if (argc > 3 || argc < 2) {
1101 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1102 return NT_STATUS_OK;
1103 }
1104
1105 if (!string_to_sid(&dom_sid, argv[1]))
1106 return NT_STATUS_NO_MEMORY;
1107
1108
1109 if (argc == 3)
1110 info_class = atoi(argv[2]);
1111
1112 result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1113
1114 if (!NT_STATUS_IS_OK(result))
1115 goto done;
1116
1117 result = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1118 &pol,
1119 &dom_sid,
1120 access_mask,
1121 &trustdom_pol);
1122
1123 if (!NT_STATUS_IS_OK(result))
1124 goto done;
1125
1126 result = rpccli_lsa_QueryTrustedDomainInfo(cli, mem_ctx,
1127 &trustdom_pol,
1128 info_class,
1129 &info);
1130
1131 if (!NT_STATUS_IS_OK(result))
1132 goto done;
1133
1134 if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1135 d_fprintf(stderr, "Could not get pwd hash\n");
1136 goto done;
1137 }
1138
1139 display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1140
1141 done:
1142 rpccli_lsa_Close(cli, mem_ctx, &pol);
1143
1144 return result;
1145 }
1146
1147 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1148 TALLOC_CTX *mem_ctx, int argc,
1149 const char **argv)
1150 {
1151 struct policy_handle pol;
1152 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1153 const char *servername = cli->desthost;
1154 struct lsa_String *account_name = NULL;
1155 struct lsa_String *authority_name = NULL;
1156
1157 if (argc > 2) {
1158 printf("Usage: %s servername\n", argv[0]);
1159 return NT_STATUS_OK;
1160 }
1161
1162 result = rpccli_lsa_open_policy(cli, mem_ctx, true,
1163 SEC_FLAG_MAXIMUM_ALLOWED,
1164 &pol);
1165
1166 if (!NT_STATUS_IS_OK(result)) {
1167 goto done;
1168 }
1169
1170 result = rpccli_lsa_GetUserName(cli, mem_ctx,
1171 servername,
1172 &account_name,
1173 &authority_name);
1174 if (!NT_STATUS_IS_OK(result)) {
1175 goto done;
1176 }
1177
1178 /* Print results */
1179
1180 printf("Account Name: %s, Authority Name: %s\n",
1181 account_name->string, authority_name ? authority_name->string :
1182 "");
1183
1184 rpccli_lsa_Close(cli, mem_ctx, &pol);
1185 done:
1186 return result;
1187 }
1188
1189 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1190 TALLOC_CTX *mem_ctx, int argc,
1191 const char **argv)
1192 {
1193 struct policy_handle dom_pol, user_pol;
1194 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1195 struct lsa_PrivilegeSet privs;
1196 struct lsa_LUIDAttribute *set = NULL;
1197 DOM_SID sid;
1198 int i;
1199
1200 ZERO_STRUCT(privs);
1201
1202 if (argc < 3 ) {
1203 printf("Usage: %s SID [rights...]\n", argv[0]);
1204 return NT_STATUS_OK;
1205 }
1206
1207 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1208 if (!NT_STATUS_IS_OK(result)) {
1209 goto done;
1210 }
1211
1212 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1213 SEC_FLAG_MAXIMUM_ALLOWED,
1214 &dom_pol);
1215
1216 if (!NT_STATUS_IS_OK(result)) {
1217 goto done;
1218 }
1219
1220 result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1221 &dom_pol,
1222 &sid,
1223 SEC_FLAG_MAXIMUM_ALLOWED,
1224 &user_pol);
1225
1226 if (!NT_STATUS_IS_OK(result)) {
1227 goto done;
1228 }
1229
1230 for (i=2; i<argc; i++) {
1231
1232 struct lsa_String priv_name;
1233 struct lsa_LUID luid;
1234
1235 init_lsa_String(&priv_name, argv[i]);
1236
1237 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1238 &dom_pol,
1239 &priv_name,
1240 &luid);
1241 if (!NT_STATUS_IS_OK(result)) {
1242 continue;
1243 }
1244
1245 privs.count++;
1246 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1247 struct lsa_LUIDAttribute,
1248 privs.count);
1249 if (!set) {
1250 return NT_STATUS_NO_MEMORY;
1251 }
1252
1253 set[privs.count-1].luid = luid;
1254 set[privs.count-1].attribute = 0;
1255 }
1256
1257 privs.set = set;
1258
1259 result = rpccli_lsa_AddPrivilegesToAccount(cli, mem_ctx,
1260 &user_pol,
1261 &privs);
1262
1263 if (!NT_STATUS_IS_OK(result)) {
1264 goto done;
1265 }
1266
1267 rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1268 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1269 done:
1270 return result;
1271 }
1272
1273 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1274 TALLOC_CTX *mem_ctx, int argc,
1275 const char **argv)
1276 {
1277 struct policy_handle dom_pol, user_pol;
1278 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1279 struct lsa_PrivilegeSet privs;
1280 struct lsa_LUIDAttribute *set = NULL;
1281 DOM_SID sid;
1282 int i;
1283
1284 ZERO_STRUCT(privs);
1285
1286 if (argc < 3 ) {
1287 printf("Usage: %s SID [rights...]\n", argv[0]);
1288 return NT_STATUS_OK;
1289 }
1290
1291 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1292 if (!NT_STATUS_IS_OK(result)) {
1293 goto done;
1294 }
1295
1296 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1297 SEC_FLAG_MAXIMUM_ALLOWED,
1298 &dom_pol);
1299
1300 if (!NT_STATUS_IS_OK(result)) {
1301 goto done;
1302 }
1303
1304 result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1305 &dom_pol,
1306 &sid,
1307 SEC_FLAG_MAXIMUM_ALLOWED,
1308 &user_pol);
1309
1310 if (!NT_STATUS_IS_OK(result)) {
1311 goto done;
1312 }
1313
1314 for (i=2; i<argc; i++) {
1315
1316 struct lsa_String priv_name;
1317 struct lsa_LUID luid;
1318
1319 init_lsa_String(&priv_name, argv[i]);
1320
1321 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1322 &dom_pol,
1323 &priv_name,
1324 &luid);
1325 if (!NT_STATUS_IS_OK(result)) {
1326 continue;
1327 }
1328
1329 privs.count++;
1330 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1331 struct lsa_LUIDAttribute,
1332 privs.count);
1333 if (!set) {
1334 return NT_STATUS_NO_MEMORY;
1335 }
1336
1337 set[privs.count-1].luid = luid;
1338 set[privs.count-1].attribute = 0;
1339 }
1340
1341 privs.set = set;
1342
1343
1344 result = rpccli_lsa_RemovePrivilegesFromAccount(cli, mem_ctx,
1345 &user_pol,
1346 false,
1347 &privs);
1348
1349 if (!NT_STATUS_IS_OK(result)) {
1350 goto done;
1351 }
1352
1353 rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1354 rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1355 done:
1356 return result;
1357 }
1358
1359 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1360 TALLOC_CTX *mem_ctx, int argc,
1361 const char **argv)
1362 {
1363 NTSTATUS status;
1364 struct policy_handle handle, sec_handle;
1365 struct lsa_String name;
1366
1367 if (argc < 2) {
1368 printf("Usage: %s name\n", argv[0]);
1369 return NT_STATUS_OK;
1370 }
1371
1372 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1373 true,
1374 SEC_FLAG_MAXIMUM_ALLOWED,
1375 &handle);
1376 if (!NT_STATUS_IS_OK(status)) {
1377 return status;
1378 }
1379
1380 init_lsa_String(&name, argv[1]);
1381
1382 status = rpccli_lsa_CreateSecret(cli, mem_ctx,
1383 &handle,
1384 name,
1385 SEC_FLAG_MAXIMUM_ALLOWED,
1386 &sec_handle);
1387 if (!NT_STATUS_IS_OK(status)) {
1388 goto done;
1389 }
1390
1391 done:
1392 if (is_valid_policy_hnd(&sec_handle)) {
1393 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1394 }
1395 if (is_valid_policy_hnd(&handle)) {
1396 rpccli_lsa_Close(cli, mem_ctx, &handle);
1397 }
1398
1399 return status;
1400 }
1401
1402 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1403 TALLOC_CTX *mem_ctx, int argc,
1404 const char **argv)
1405 {
1406 NTSTATUS status;
1407 struct policy_handle handle, sec_handle;
1408 struct lsa_String name;
1409
1410 if (argc < 2) {
1411 printf("Usage: %s name\n", argv[0]);
1412 return NT_STATUS_OK;
1413 }
1414
1415 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1416 true,
1417 SEC_FLAG_MAXIMUM_ALLOWED,
1418 &handle);
1419 if (!NT_STATUS_IS_OK(status)) {
1420 return status;
1421 }
1422
1423 init_lsa_String(&name, argv[1]);
1424
1425 status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1426 &handle,
1427 name,
1428 SEC_FLAG_MAXIMUM_ALLOWED,
1429 &sec_handle);
1430 if (!NT_STATUS_IS_OK(status)) {
1431 goto done;
1432 }
1433
1434 status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1435 &sec_handle);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 goto done;
1438 }
1439
1440 done:
1441 if (is_valid_policy_hnd(&sec_handle)) {
1442 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1443 }
1444 if (is_valid_policy_hnd(&handle)) {
1445 rpccli_lsa_Close(cli, mem_ctx, &handle);
1446 }
1447
1448 return status;
1449 }
1450
1451 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1452 TALLOC_CTX *mem_ctx, int argc,
1453 const char **argv)
1454 {
1455 NTSTATUS status;
1456 struct policy_handle handle, sec_handle;
1457 struct lsa_String name;
1458 struct lsa_DATA_BUF_PTR new_val;
1459 NTTIME new_mtime = 0;
1460 struct lsa_DATA_BUF_PTR old_val;
1461 NTTIME old_mtime = 0;
1462 DATA_BLOB session_key;
1463 DATA_BLOB new_blob = data_blob_null;
1464 DATA_BLOB old_blob = data_blob_null;
1465 char *new_secret, *old_secret;
1466
1467 if (argc < 2) {
1468 printf("Usage: %s name\n", argv[0]);
1469 return NT_STATUS_OK;
1470 }
1471
1472 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1473 true,
1474 SEC_FLAG_MAXIMUM_ALLOWED,
1475 &handle);
1476 if (!NT_STATUS_IS_OK(status)) {
1477 return status;
1478 }
1479
1480 init_lsa_String(&name, argv[1]);
1481
1482 status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1483 &handle,
1484 name,
1485 SEC_FLAG_MAXIMUM_ALLOWED,
1486 &sec_handle);
1487 if (!NT_STATUS_IS_OK(status)) {
1488 goto done;
1489 }
1490
1491 ZERO_STRUCT(new_val);
1492 ZERO_STRUCT(old_val);
1493
1494 status = rpccli_lsa_QuerySecret(cli, mem_ctx,
1495 &sec_handle,
1496 &new_val,
1497 &new_mtime,
1498 &old_val,
1499 &old_mtime);
1500 if (!NT_STATUS_IS_OK(status)) {
1501 goto done;
1502 }
1503
1504 status = cli_get_session_key(mem_ctx, cli, &session_key);
1505 if (!NT_STATUS_IS_OK(status)) {
1506 goto done;
1507 }
1508
1509 if (new_val.buf) {
1510 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1511 }
1512 if (old_val.buf) {
1513 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1514 }
1515
1516 new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1517 old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1518 if (new_secret) {
1519 d_printf("new secret: %s\n", new_secret);
1520 }
1521 if (old_secret) {
1522 d_printf("old secret: %s\n", old_secret);
1523 }
1524
1525 done:
1526 if (is_valid_policy_hnd(&sec_handle)) {
1527 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1528 }
1529 if (is_valid_policy_hnd(&handle)) {
1530 rpccli_lsa_Close(cli, mem_ctx, &handle);
1531 }
1532
1533 return status;
1534 }
1535
1536 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
1537 TALLOC_CTX *mem_ctx, int argc,
1538 const char **argv)
1539 {
1540 NTSTATUS status;
1541 struct policy_handle handle, sec_handle;
1542 struct lsa_String name;
1543 struct lsa_DATA_BUF new_val;
1544 struct lsa_DATA_BUF old_val;
1545 DATA_BLOB enc_key;
1546 DATA_BLOB session_key;
1547
1548 if (argc < 3) {
1549 printf("Usage: %s name secret\n", argv[0]);
1550 return NT_STATUS_OK;
1551 }
1552
1553 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1554 true,
1555 SEC_FLAG_MAXIMUM_ALLOWED,
1556 &handle);
1557 if (!NT_STATUS_IS_OK(status)) {
1558 return status;
1559 }
1560
1561 init_lsa_String(&name, argv[1]);
1562
1563 status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1564 &handle,
1565 name,
1566 SEC_FLAG_MAXIMUM_ALLOWED,
1567 &sec_handle);
1568 if (!NT_STATUS_IS_OK(status)) {
1569 goto done;
1570 }
1571
1572 ZERO_STRUCT(new_val);
1573 ZERO_STRUCT(old_val);
1574
1575 status = cli_get_session_key(mem_ctx, cli, &session_key);
1576 if (!NT_STATUS_IS_OK(status)) {
1577 goto done;
1578 }
1579
1580 enc_key = sess_encrypt_string(argv[2], &session_key);
1581
1582 new_val.length = enc_key.length;
1583 new_val.size = enc_key.length;
1584 new_val.data = enc_key.data;
1585
1586 status = rpccli_lsa_SetSecret(cli, mem_ctx,
1587 &sec_handle,
1588 &new_val,
1589 NULL);
1590 if (!NT_STATUS_IS_OK(status)) {
1591 goto done;
1592 }
1593
1594 done:
1595 if (is_valid_policy_hnd(&sec_handle)) {
1596 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1597 }
1598 if (is_valid_policy_hnd(&handle)) {
1599 rpccli_lsa_Close(cli, mem_ctx, &handle);
1600 }
1601
1602 return status;
1603 }
1604
1605 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
1606 TALLOC_CTX *mem_ctx, int argc,
1607 const char **argv)
1608 {
1609 NTSTATUS status;
1610 struct policy_handle handle;
1611 struct lsa_String name;
1612 struct lsa_DATA_BUF *val;
1613 DATA_BLOB session_key;
1614 DATA_BLOB blob;
1615 char *secret;
1616
1617 if (argc < 2) {
1618 printf("Usage: %s name\n", argv[0]);
1619 return NT_STATUS_OK;
1620 }
1621
1622 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1623 true,
1624 SEC_FLAG_MAXIMUM_ALLOWED,
1625 &handle);
1626 if (!NT_STATUS_IS_OK(status)) {
1627 return status;
1628 }
1629
1630 init_lsa_String(&name, argv[1]);
1631
1632 ZERO_STRUCT(val);
1633
1634 status = rpccli_lsa_RetrievePrivateData(cli, mem_ctx,
1635 &handle,
1636 &name,
1637 &val);
1638 if (!NT_STATUS_IS_OK(status)) {
1639 goto done;
1640 }
1641
1642 status = cli_get_session_key(mem_ctx, cli, &session_key);
1643 if (!NT_STATUS_IS_OK(status)) {
1644 goto done;
1645 }
1646
1647 if (val) {
1648 blob = data_blob_const(val->data, val->length);
1649 }
1650
1651 secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
1652 if (secret) {
1653 d_printf("secret: %s\n", secret);
1654 }
1655
1656 done:
1657 if (is_valid_policy_hnd(&handle)) {
1658 rpccli_lsa_Close(cli, mem_ctx, &handle);
1659 }
1660
1661 return status;
1662 }
1663
1664 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
1665 TALLOC_CTX *mem_ctx, int argc,
1666 const char **argv)
1667 {
1668 NTSTATUS status;
1669 struct policy_handle handle;
1670 struct lsa_String name;
1671 struct lsa_DATA_BUF val;
1672 DATA_BLOB session_key;
1673 DATA_BLOB enc_key;
1674
1675 if (argc < 3) {
1676 printf("Usage: %s name secret\n", argv[0]);
1677 return NT_STATUS_OK;
1678 }
1679
1680 status = rpccli_lsa_open_policy2(cli, mem_ctx,
1681 true,
1682 SEC_FLAG_MAXIMUM_ALLOWED,
1683 &handle);
1684 if (!NT_STATUS_IS_OK(status)) {
1685 return status;
1686 }
1687
1688 init_lsa_String(&name, argv[1]);
1689
1690 ZERO_STRUCT(val);
1691
1692 status = cli_get_session_key(mem_ctx, cli, &session_key);
1693 if (!NT_STATUS_IS_OK(status)) {
1694 goto done;
1695 }
1696
1697 enc_key = sess_encrypt_string(argv[2], &session_key);
1698
1699 val.length = enc_key.length;
1700 val.size = enc_key.length;
1701 val.data = enc_key.data;
1702
1703 status = rpccli_lsa_StorePrivateData(cli, mem_ctx,
1704 &handle,
1705 &name,
1706 &val);
1707 if (!NT_STATUS_IS_OK(status)) {
1708 goto done;
1709 }
1710
1711 done:
1712 if (is_valid_policy_hnd(&handle)) {
1713 rpccli_lsa_Close(cli, mem_ctx, &handle);
1714 }
1715
1716 return status;
1717 }
1718
1719
1720 /* List of commands exported by this module */
1721
1722 struct cmd_set lsarpc_commands[] = {
1723
1724 { "LSARPC" },
1725
1726 { "lsaquery", RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query info policy", "" },
1727 { "lookupsids", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names", "" },
1728 { "lookupnames", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs", "" },
1729 { "lookupnames_level", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs", "" },
1730 { "enumtrust", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
1731 { "enumprivs", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate privileges", "" },
1732 { "getdispname", RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get the privilege name", "" },
1733 { "lsaenumsid", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the LSA SIDS", "" },
1734 { "lsacreateaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_create_account, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create a new lsa account", "" },
1735 { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the privileges of an SID", "" },
1736 { "lsaenumacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the rights of an SID", "" },
1737 { "lsaaddpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Assign a privilege to a SID", "" },
1738 { "lsadelpriv", RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Revoke a privilege from a SID", "" },
1739 { "lsaaddacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Add rights to an account", "" },
1740 { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Remove rights from an account", "" },
1741 { "lsalookupprivvalue", RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get a privilege value given its name", "" },
1742 { "lsaquerysecobj", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA security object", "" },
1743 { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
1744 { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
1745 { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
1746 { "getusername", RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get username", "" },
1747 { "createsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Secret", "" },
1748 { "deletesecret", RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Secret", "" },
1749 { "querysecret", RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query Secret", "" },
1750 { "setsecret", RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Set Secret", "" },
1751 { "retrieveprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Retrieve Private Data", "" },
1752 { "storeprivatedata", RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Store Private Data", "" },
1753
1754 { NULL }
1755 };
1756
aatanasov's samba4 branch