2 Unix SMB/CIFS implementation.
5 Copyright (C) Andrew Tridgell 1992-2000,
6 Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
7 Copyright (C) Elrond 2000,
8 Copyright (C) Tim Potter 2000
9 Copyright (C) Guenther Deschner 2008
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "rpcclient.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr.h"
29 #include "../librpc/gen_ndr/ndr_samr_c.h"
30 #include "rpc_client/cli_samr.h"
31 #include "rpc_client/init_samr.h"
32 #include "rpc_client/init_lsa.h"
33 #include "../libcli/security/security.h"
35 extern struct dom_sid domain_sid
;
37 /****************************************************************************
38 display samr_user_info_7 structure
39 ****************************************************************************/
40 static void display_samr_user_info_7(struct samr_UserInfo7
*r
)
42 printf("\tUser Name :\t%s\n", r
->account_name
.string
);
45 /****************************************************************************
46 display samr_user_info_9 structure
47 ****************************************************************************/
48 static void display_samr_user_info_9(struct samr_UserInfo9
*r
)
50 printf("\tPrimary group RID :\tox%x\n", r
->primary_gid
);
53 /****************************************************************************
54 display samr_user_info_16 structure
55 ****************************************************************************/
56 static void display_samr_user_info_16(struct samr_UserInfo16
*r
)
58 printf("\tAcct Flags :\tox%x\n", r
->acct_flags
);
61 /****************************************************************************
62 display samr_user_info_20 structure
63 ****************************************************************************/
64 static void display_samr_user_info_20(struct samr_UserInfo20
*r
)
66 printf("\tRemote Dial :\n");
67 dump_data(0, (uint8_t *)r
->parameters
.array
, r
->parameters
.length
*2);
71 /****************************************************************************
72 display samr_user_info_21 structure
73 ****************************************************************************/
74 static void display_samr_user_info_21(struct samr_UserInfo21
*r
)
76 printf("\tUser Name :\t%s\n", r
->account_name
.string
);
77 printf("\tFull Name :\t%s\n", r
->full_name
.string
);
78 printf("\tHome Drive :\t%s\n", r
->home_directory
.string
);
79 printf("\tDir Drive :\t%s\n", r
->home_drive
.string
);
80 printf("\tProfile Path:\t%s\n", r
->profile_path
.string
);
81 printf("\tLogon Script:\t%s\n", r
->logon_script
.string
);
82 printf("\tDescription :\t%s\n", r
->description
.string
);
83 printf("\tWorkstations:\t%s\n", r
->workstations
.string
);
84 printf("\tComment :\t%s\n", r
->comment
.string
);
85 printf("\tRemote Dial :\n");
86 dump_data(0, (uint8_t *)r
->parameters
.array
, r
->parameters
.length
*2);
88 printf("\tLogon Time :\t%s\n",
89 http_timestring(talloc_tos(), nt_time_to_unix(r
->last_logon
)));
90 printf("\tLogoff Time :\t%s\n",
91 http_timestring(talloc_tos(), nt_time_to_unix(r
->last_logoff
)));
92 printf("\tKickoff Time :\t%s\n",
93 http_timestring(talloc_tos(), nt_time_to_unix(r
->acct_expiry
)));
94 printf("\tPassword last set Time :\t%s\n",
95 http_timestring(talloc_tos(), nt_time_to_unix(r
->last_password_change
)));
96 printf("\tPassword can change Time :\t%s\n",
97 http_timestring(talloc_tos(), nt_time_to_unix(r
->allow_password_change
)));
98 printf("\tPassword must change Time:\t%s\n",
99 http_timestring(talloc_tos(), nt_time_to_unix(r
->force_password_change
)));
101 printf("\tunknown_2[0..31]...\n"); /* user passwords? */
103 printf("\tuser_rid :\t0x%x\n" , r
->rid
); /* User ID */
104 printf("\tgroup_rid:\t0x%x\n" , r
->primary_gid
); /* Group ID */
105 printf("\tacb_info :\t0x%08x\n", r
->acct_flags
); /* Account Control Info */
107 printf("\tfields_present:\t0x%08x\n", r
->fields_present
); /* 0x00ff ffff */
108 printf("\tlogon_divs:\t%d\n", r
->logon_hours
.units_per_week
); /* 0x0000 00a8 which is 168 which is num hrs in a week */
109 printf("\tbad_password_count:\t0x%08x\n", r
->bad_password_count
);
110 printf("\tlogon_count:\t0x%08x\n", r
->logon_count
);
112 printf("\tpadding1[0..7]...\n");
114 if (r
->logon_hours
.bits
) {
115 printf("\tlogon_hrs[0..%d]...\n", r
->logon_hours
.units_per_week
/8);
120 static void display_password_properties(uint32_t password_properties
)
122 printf("password_properties: 0x%08x\n", password_properties
);
124 if (password_properties
& DOMAIN_PASSWORD_COMPLEX
)
125 printf("\tDOMAIN_PASSWORD_COMPLEX\n");
127 if (password_properties
& DOMAIN_PASSWORD_NO_ANON_CHANGE
)
128 printf("\tDOMAIN_PASSWORD_NO_ANON_CHANGE\n");
130 if (password_properties
& DOMAIN_PASSWORD_NO_CLEAR_CHANGE
)
131 printf("\tDOMAIN_PASSWORD_NO_CLEAR_CHANGE\n");
133 if (password_properties
& DOMAIN_PASSWORD_LOCKOUT_ADMINS
)
134 printf("\tDOMAIN_PASSWORD_LOCKOUT_ADMINS\n");
136 if (password_properties
& DOMAIN_PASSWORD_STORE_CLEARTEXT
)
137 printf("\tDOMAIN_PASSWORD_STORE_CLEARTEXT\n");
139 if (password_properties
& DOMAIN_REFUSE_PASSWORD_CHANGE
)
140 printf("\tDOMAIN_REFUSE_PASSWORD_CHANGE\n");
143 static void display_sam_dom_info_1(struct samr_DomInfo1
*info1
)
145 printf("Minimum password length:\t\t\t%d\n",
146 info1
->min_password_length
);
147 printf("Password uniqueness (remember x passwords):\t%d\n",
148 info1
->password_history_length
);
149 display_password_properties(info1
->password_properties
);
150 printf("password expire in:\t\t\t\t%s\n",
151 display_time(info1
->max_password_age
));
152 printf("Min password age (allow changing in x days):\t%s\n",
153 display_time(info1
->min_password_age
));
156 static void display_sam_dom_info_2(struct samr_DomGeneralInformation
*general
)
158 printf("Domain:\t\t%s\n", general
->domain_name
.string
);
159 printf("Server:\t\t%s\n", general
->primary
.string
);
160 printf("Comment:\t%s\n", general
->oem_information
.string
);
162 printf("Total Users:\t%d\n", general
->num_users
);
163 printf("Total Groups:\t%d\n", general
->num_groups
);
164 printf("Total Aliases:\t%d\n", general
->num_aliases
);
166 printf("Sequence No:\t%llu\n", (unsigned long long)general
->sequence_num
);
168 printf("Force Logoff:\t%d\n",
169 (int)nt_time_to_unix_abs(&general
->force_logoff_time
));
171 printf("Domain Server State:\t0x%x\n", general
->domain_server_state
);
172 printf("Server Role:\t%s\n", server_role_str(general
->role
));
173 printf("Unknown 3:\t0x%x\n", general
->unknown3
);
176 static void display_sam_dom_info_3(struct samr_DomInfo3
*info3
)
178 printf("Force Logoff:\t%d\n",
179 (int)nt_time_to_unix_abs(&info3
->force_logoff_time
));
182 static void display_sam_dom_info_4(struct samr_DomOEMInformation
*oem
)
184 printf("Comment:\t%s\n", oem
->oem_information
.string
);
187 static void display_sam_dom_info_5(struct samr_DomInfo5
*info5
)
189 printf("Domain:\t\t%s\n", info5
->domain_name
.string
);
192 static void display_sam_dom_info_6(struct samr_DomInfo6
*info6
)
194 printf("Server:\t\t%s\n", info6
->primary
.string
);
197 static void display_sam_dom_info_7(struct samr_DomInfo7
*info7
)
199 printf("Server Role:\t%s\n", server_role_str(info7
->role
));
202 static void display_sam_dom_info_8(struct samr_DomInfo8
*info8
)
204 printf("Sequence No:\t%llu\n", (unsigned long long)info8
->sequence_num
);
205 printf("Domain Create Time:\t%s\n",
206 http_timestring(talloc_tos(), nt_time_to_unix(info8
->domain_create_time
)));
209 static void display_sam_dom_info_9(struct samr_DomInfo9
*info9
)
211 printf("Domain Server State:\t0x%x\n", info9
->domain_server_state
);
214 static void display_sam_dom_info_12(struct samr_DomInfo12
*info12
)
216 printf("Bad password lockout duration: %s\n",
217 display_time(info12
->lockout_duration
));
218 printf("Reset Lockout after: %s\n",
219 display_time(info12
->lockout_window
));
220 printf("Lockout after bad attempts: %d\n",
221 info12
->lockout_threshold
);
224 static void display_sam_dom_info_13(struct samr_DomInfo13
*info13
)
226 printf("Sequence No:\t%llu\n", (unsigned long long)info13
->sequence_num
);
227 printf("Domain Create Time:\t%s\n",
228 http_timestring(talloc_tos(), nt_time_to_unix(info13
->domain_create_time
)));
229 printf("Sequence No at last promotion:\t%llu\n",
230 (unsigned long long)info13
->modified_count_at_last_promotion
);
233 static void display_sam_info_1(struct samr_DispEntryGeneral
*r
)
235 printf("index: 0x%x ", r
->idx
);
236 printf("RID: 0x%x ", r
->rid
);
237 printf("acb: 0x%08x ", r
->acct_flags
);
238 printf("Account: %s\t", r
->account_name
.string
);
239 printf("Name: %s\t", r
->full_name
.string
);
240 printf("Desc: %s\n", r
->description
.string
);
243 static void display_sam_info_2(struct samr_DispEntryFull
*r
)
245 printf("index: 0x%x ", r
->idx
);
246 printf("RID: 0x%x ", r
->rid
);
247 printf("acb: 0x%08x ", r
->acct_flags
);
248 printf("Account: %s\t", r
->account_name
.string
);
249 printf("Desc: %s\n", r
->description
.string
);
252 static void display_sam_info_3(struct samr_DispEntryFullGroup
*r
)
254 printf("index: 0x%x ", r
->idx
);
255 printf("RID: 0x%x ", r
->rid
);
256 printf("acb: 0x%08x ", r
->acct_flags
);
257 printf("Account: %s\t", r
->account_name
.string
);
258 printf("Desc: %s\n", r
->description
.string
);
261 static void display_sam_info_4(struct samr_DispEntryAscii
*r
)
263 printf("index: 0x%x ", r
->idx
);
264 printf("Account: %s\n", r
->account_name
.string
);
267 static void display_sam_info_5(struct samr_DispEntryAscii
*r
)
269 printf("index: 0x%x ", r
->idx
);
270 printf("Account: %s\n", r
->account_name
.string
);
273 /****************************************************************************
274 ****************************************************************************/
276 static NTSTATUS
get_domain_handle(struct rpc_pipe_client
*cli
,
279 struct policy_handle
*connect_pol
,
280 uint32_t access_mask
,
281 struct dom_sid
*_domain_sid
,
282 struct policy_handle
*domain_pol
)
284 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
285 NTSTATUS status
= NT_STATUS_INVALID_PARAMETER
, result
;
287 if (strcasecmp_m(sam
, "domain") == 0) {
288 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
294 } else if (strcasecmp_m(sam
, "builtin") == 0) {
295 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
298 discard_const_p(struct dom_sid2
, &global_sid_Builtin
),
303 if (!NT_STATUS_IS_OK(status
)) {
310 /**********************************************************************
311 * Query user information
313 static NTSTATUS
cmd_samr_query_user(struct rpc_pipe_client
*cli
,
315 int argc
, const char **argv
)
317 struct policy_handle connect_pol
, domain_pol
, user_pol
;
318 NTSTATUS status
, result
;
319 uint32 info_level
= 21;
320 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
321 union samr_UserInfo
*info
= NULL
;
323 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
325 if ((argc
< 2) || (argc
> 4)) {
326 printf("Usage: %s rid [info level] [access mask] \n", argv
[0]);
330 sscanf(argv
[1], "%i", &user_rid
);
333 sscanf(argv
[2], "%i", &info_level
);
336 sscanf(argv
[3], "%x", &access_mask
);
339 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
340 MAXIMUM_ALLOWED_ACCESS
,
342 if (!NT_STATUS_IS_OK(status
)) {
346 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
348 MAXIMUM_ALLOWED_ACCESS
,
352 if (!NT_STATUS_IS_OK(status
)) {
355 if (!NT_STATUS_IS_OK(result
)) {
360 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
366 if (!NT_STATUS_IS_OK(status
)) {
369 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
) &&
372 /* Probably this was a user name, try lookupnames */
373 struct samr_Ids rids
, types
;
374 struct lsa_String lsa_acct_name
;
376 init_lsa_String(&lsa_acct_name
, argv
[1]);
378 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
385 if (!NT_STATUS_IS_OK(status
)) {
388 if (NT_STATUS_IS_OK(result
)) {
389 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
395 if (!NT_STATUS_IS_OK(status
)) {
402 if (!NT_STATUS_IS_OK(result
)) {
407 status
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
412 if (!NT_STATUS_IS_OK(status
)) {
415 if (!NT_STATUS_IS_OK(result
)) {
420 switch (info_level
) {
422 display_samr_user_info_7(&info
->info7
);
425 display_samr_user_info_9(&info
->info9
);
428 display_samr_user_info_16(&info
->info16
);
431 display_samr_user_info_20(&info
->info20
);
434 display_samr_user_info_21(&info
->info21
);
437 printf("Unsupported infolevel: %d\n", info_level
);
441 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
442 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
443 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
449 /****************************************************************************
451 ****************************************************************************/
452 static void display_group_info1(struct samr_GroupInfoAll
*info1
)
454 printf("\tGroup Name:\t%s\n", info1
->name
.string
);
455 printf("\tDescription:\t%s\n", info1
->description
.string
);
456 printf("\tGroup Attribute:%d\n", info1
->attributes
);
457 printf("\tNum Members:%d\n", info1
->num_members
);
460 /****************************************************************************
462 ****************************************************************************/
463 static void display_group_info2(struct lsa_String
*info2
)
465 printf("\tGroup Description:%s\n", info2
->string
);
469 /****************************************************************************
471 ****************************************************************************/
472 static void display_group_info3(struct samr_GroupInfoAttributes
*info3
)
474 printf("\tGroup Attribute:%d\n", info3
->attributes
);
478 /****************************************************************************
480 ****************************************************************************/
481 static void display_group_info4(struct lsa_String
*info4
)
483 printf("\tGroup Description:%s\n", info4
->string
);
486 /****************************************************************************
488 ****************************************************************************/
489 static void display_group_info5(struct samr_GroupInfoAll
*info5
)
491 printf("\tGroup Name:\t%s\n", info5
->name
.string
);
492 printf("\tDescription:\t%s\n", info5
->description
.string
);
493 printf("\tGroup Attribute:%d\n", info5
->attributes
);
494 printf("\tNum Members:%d\n", info5
->num_members
);
497 /****************************************************************************
498 display sam sync structure
499 ****************************************************************************/
500 static void display_group_info(union samr_GroupInfo
*info
,
501 enum samr_GroupInfoEnum level
)
505 display_group_info1(&info
->all
);
508 display_group_info2(&info
->name
);
511 display_group_info3(&info
->attributes
);
514 display_group_info4(&info
->description
);
517 display_group_info5(&info
->all2
);
522 /***********************************************************************
523 * Query group information
525 static NTSTATUS
cmd_samr_query_group(struct rpc_pipe_client
*cli
,
527 int argc
, const char **argv
)
529 struct policy_handle connect_pol
, domain_pol
, group_pol
;
530 NTSTATUS status
, result
;
531 enum samr_GroupInfoEnum info_level
= GROUPINFOALL
;
532 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
533 union samr_GroupInfo
*group_info
= NULL
;
535 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
537 if ((argc
< 2) || (argc
> 4)) {
538 printf("Usage: %s rid [info level] [access mask]\n", argv
[0]);
542 sscanf(argv
[1], "%i", &group_rid
);
545 info_level
= atoi(argv
[2]);
548 sscanf(argv
[3], "%x", &access_mask
);
550 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
551 MAXIMUM_ALLOWED_ACCESS
,
553 if (!NT_STATUS_IS_OK(status
)) {
557 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
559 MAXIMUM_ALLOWED_ACCESS
,
563 if (!NT_STATUS_IS_OK(status
)) {
566 if (!NT_STATUS_IS_OK(result
)) {
571 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
577 if (!NT_STATUS_IS_OK(status
)) {
580 if (!NT_STATUS_IS_OK(result
)) {
585 status
= dcerpc_samr_QueryGroupInfo(b
, mem_ctx
,
590 if (!NT_STATUS_IS_OK(status
)) {
593 if (!NT_STATUS_IS_OK(result
)) {
598 display_group_info(group_info
, info_level
);
600 dcerpc_samr_Close(b
, mem_ctx
, &group_pol
, &result
);
601 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
602 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
607 /* Query groups a user is a member of */
609 static NTSTATUS
cmd_samr_query_usergroups(struct rpc_pipe_client
*cli
,
611 int argc
, const char **argv
)
613 struct policy_handle connect_pol
,
616 NTSTATUS status
, result
;
618 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
620 struct samr_RidWithAttributeArray
*rid_array
= NULL
;
621 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
623 if ((argc
< 2) || (argc
> 3)) {
624 printf("Usage: %s rid [access mask]\n", argv
[0]);
628 sscanf(argv
[1], "%i", &user_rid
);
631 sscanf(argv
[2], "%x", &access_mask
);
633 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
634 MAXIMUM_ALLOWED_ACCESS
,
636 if (!NT_STATUS_IS_OK(status
)) {
640 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
642 MAXIMUM_ALLOWED_ACCESS
,
646 if (!NT_STATUS_IS_OK(status
)) {
649 if (!NT_STATUS_IS_OK(result
)) {
654 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
661 if (!NT_STATUS_IS_OK(status
)) {
664 if (!NT_STATUS_IS_OK(result
)) {
669 status
= dcerpc_samr_GetGroupsForUser(b
, mem_ctx
,
673 if (!NT_STATUS_IS_OK(status
)) {
676 if (!NT_STATUS_IS_OK(result
)) {
681 for (i
= 0; i
< rid_array
->count
; i
++) {
682 printf("\tgroup rid:[0x%x] attr:[0x%x]\n",
683 rid_array
->rids
[i
].rid
,
684 rid_array
->rids
[i
].attributes
);
687 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
688 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
689 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
694 /* Query aliases a user is a member of */
696 static NTSTATUS
cmd_samr_query_useraliases(struct rpc_pipe_client
*cli
,
698 int argc
, const char **argv
)
700 struct policy_handle connect_pol
, domain_pol
;
701 NTSTATUS status
, result
;
702 struct dom_sid
*sids
;
704 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
706 struct lsa_SidArray sid_array
;
707 struct samr_Ids alias_rids
;
708 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
711 printf("Usage: %s builtin|domain sid1 sid2 ...\n", argv
[0]);
712 return NT_STATUS_INVALID_PARAMETER
;
718 for (i
=2; i
<argc
; i
++) {
719 struct dom_sid tmp_sid
;
720 if (!string_to_sid(&tmp_sid
, argv
[i
])) {
721 printf("%s is not a legal SID\n", argv
[i
]);
722 return NT_STATUS_INVALID_PARAMETER
;
724 result
= add_sid_to_array(mem_ctx
, &tmp_sid
, &sids
, &num_sids
);
725 if (!NT_STATUS_IS_OK(result
)) {
731 sid_array
.sids
= talloc_zero_array(mem_ctx
, struct lsa_SidPtr
, num_sids
);
732 if (sid_array
.sids
== NULL
)
733 return NT_STATUS_NO_MEMORY
;
735 sid_array
.sids
= NULL
;
738 for (i
=0; i
<num_sids
; i
++) {
739 sid_array
.sids
[i
].sid
= dom_sid_dup(mem_ctx
, &sids
[i
]);
740 if (!sid_array
.sids
[i
].sid
) {
741 return NT_STATUS_NO_MEMORY
;
745 sid_array
.num_sids
= num_sids
;
747 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
748 MAXIMUM_ALLOWED_ACCESS
,
750 if (!NT_STATUS_IS_OK(status
)) {
754 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
759 if (!NT_STATUS_IS_OK(status
)) {
763 status
= dcerpc_samr_GetAliasMembership(b
, mem_ctx
,
768 if (!NT_STATUS_IS_OK(status
)) {
771 if (!NT_STATUS_IS_OK(result
)) {
776 for (i
= 0; i
< alias_rids
.count
; i
++) {
777 printf("\tgroup rid:[0x%x]\n", alias_rids
.ids
[i
]);
780 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
781 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
786 /* Query members of a group */
788 static NTSTATUS
cmd_samr_query_groupmem(struct rpc_pipe_client
*cli
,
790 int argc
, const char **argv
)
792 struct policy_handle connect_pol
, domain_pol
, group_pol
;
793 NTSTATUS status
, result
;
795 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
797 unsigned int old_timeout
;
798 struct samr_RidAttrArray
*rids
= NULL
;
799 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
801 if ((argc
< 2) || (argc
> 3)) {
802 printf("Usage: %s rid [access mask]\n", argv
[0]);
806 sscanf(argv
[1], "%i", &group_rid
);
809 sscanf(argv
[2], "%x", &access_mask
);
811 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
812 MAXIMUM_ALLOWED_ACCESS
,
814 if (!NT_STATUS_IS_OK(status
)) {
818 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
820 MAXIMUM_ALLOWED_ACCESS
,
824 if (!NT_STATUS_IS_OK(status
)) {
827 if (!NT_STATUS_IS_OK(result
)) {
832 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
838 if (!NT_STATUS_IS_OK(status
)) {
841 if (!NT_STATUS_IS_OK(result
)) {
846 /* Make sure to wait for our DC's reply */
847 old_timeout
= rpccli_set_timeout(cli
, 30000); /* 30 seconds. */
848 rpccli_set_timeout(cli
, MAX(30000, old_timeout
)); /* At least 30 sec */
850 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
855 rpccli_set_timeout(cli
, old_timeout
);
857 if (!NT_STATUS_IS_OK(status
)) {
860 if (!NT_STATUS_IS_OK(result
)) {
865 for (i
= 0; i
< rids
->count
; i
++) {
866 printf("\trid:[0x%x] attr:[0x%x]\n", rids
->rids
[i
],
867 rids
->attributes
[i
]);
870 dcerpc_samr_Close(b
, mem_ctx
, &group_pol
, &result
);
871 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
872 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
877 /* Enumerate domain users */
879 static NTSTATUS
cmd_samr_enum_dom_users(struct rpc_pipe_client
*cli
,
881 int argc
, const char **argv
)
883 struct policy_handle connect_pol
;
884 struct policy_handle domain_pol
= { 0, };
885 NTSTATUS status
, result
;
886 uint32 start_idx
, num_dom_users
, i
;
887 struct samr_SamArray
*dom_users
= NULL
;
888 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
889 uint32 acb_mask
= ACB_NORMAL
;
890 uint32_t size
= 0xffff;
891 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
893 if ((argc
< 1) || (argc
> 4)) {
894 printf("Usage: %s [access_mask] [acb_mask] [size]\n", argv
[0]);
899 sscanf(argv
[1], "%x", &access_mask
);
903 sscanf(argv
[2], "%x", &acb_mask
);
907 sscanf(argv
[3], "%x", &size
);
910 /* Get sam policy handle */
912 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
913 MAXIMUM_ALLOWED_ACCESS
,
915 if (!NT_STATUS_IS_OK(status
)) {
919 /* Get domain policy handle */
921 status
= get_domain_handle(cli
, mem_ctx
, "domain",
926 if (!NT_STATUS_IS_OK(status
)) {
930 /* Enumerate domain users */
935 status
= dcerpc_samr_EnumDomainUsers(b
, mem_ctx
,
943 if (!NT_STATUS_IS_OK(status
)) {
946 if (NT_STATUS_IS_OK(result
) ||
947 NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
)) {
949 for (i
= 0; i
< num_dom_users
; i
++)
950 printf("user:[%s] rid:[0x%x]\n",
951 dom_users
->entries
[i
].name
.string
,
952 dom_users
->entries
[i
].idx
);
955 } while (NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
));
958 if (is_valid_policy_hnd(&domain_pol
))
959 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
961 if (is_valid_policy_hnd(&connect_pol
))
962 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
967 /* Enumerate domain groups */
969 static NTSTATUS
cmd_samr_enum_dom_groups(struct rpc_pipe_client
*cli
,
971 int argc
, const char **argv
)
973 struct policy_handle connect_pol
;
974 struct policy_handle domain_pol
= { 0, };
975 NTSTATUS status
, result
;
976 uint32 start_idx
, num_dom_groups
, i
;
977 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
978 struct samr_SamArray
*dom_groups
= NULL
;
979 uint32_t size
= 0xffff;
980 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
982 if ((argc
< 1) || (argc
> 3)) {
983 printf("Usage: %s [access_mask] [max_size]\n", argv
[0]);
988 sscanf(argv
[1], "%x", &access_mask
);
992 sscanf(argv
[2], "%x", &size
);
995 /* Get sam policy handle */
997 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
998 MAXIMUM_ALLOWED_ACCESS
,
1000 if (!NT_STATUS_IS_OK(status
)) {
1004 /* Get domain policy handle */
1006 status
= get_domain_handle(cli
, mem_ctx
, "domain",
1011 if (!NT_STATUS_IS_OK(status
)) {
1015 /* Enumerate domain groups */
1020 status
= dcerpc_samr_EnumDomainGroups(b
, mem_ctx
,
1027 if (!NT_STATUS_IS_OK(status
)) {
1030 if (NT_STATUS_IS_OK(result
) ||
1031 NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
)) {
1033 for (i
= 0; i
< num_dom_groups
; i
++)
1034 printf("group:[%s] rid:[0x%x]\n",
1035 dom_groups
->entries
[i
].name
.string
,
1036 dom_groups
->entries
[i
].idx
);
1039 } while (NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
));
1042 if (is_valid_policy_hnd(&domain_pol
))
1043 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1045 if (is_valid_policy_hnd(&connect_pol
))
1046 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1051 /* Enumerate alias groups */
1053 static NTSTATUS
cmd_samr_enum_als_groups(struct rpc_pipe_client
*cli
,
1054 TALLOC_CTX
*mem_ctx
,
1055 int argc
, const char **argv
)
1057 struct policy_handle connect_pol
, domain_pol
;
1058 NTSTATUS status
, result
;
1059 uint32 start_idx
, num_als_groups
, i
;
1060 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1061 struct samr_SamArray
*als_groups
= NULL
;
1062 uint32_t size
= 0xffff;
1063 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1065 if ((argc
< 2) || (argc
> 4)) {
1066 printf("Usage: %s builtin|domain [access mask] [max_size]\n", argv
[0]);
1067 return NT_STATUS_OK
;
1071 sscanf(argv
[2], "%x", &access_mask
);
1075 sscanf(argv
[3], "%x", &size
);
1078 /* Get sam policy handle */
1080 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1081 MAXIMUM_ALLOWED_ACCESS
,
1083 if (!NT_STATUS_IS_OK(status
)) {
1087 /* Get domain policy handle */
1089 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
1094 if (!NT_STATUS_IS_OK(status
)) {
1098 /* Enumerate alias groups */
1103 status
= dcerpc_samr_EnumDomainAliases(b
, mem_ctx
,
1110 if (!NT_STATUS_IS_OK(status
)) {
1113 if (NT_STATUS_IS_OK(result
) ||
1114 NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
)) {
1116 for (i
= 0; i
< num_als_groups
; i
++)
1117 printf("group:[%s] rid:[0x%x]\n",
1118 als_groups
->entries
[i
].name
.string
,
1119 als_groups
->entries
[i
].idx
);
1121 } while (NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
));
1124 if (is_valid_policy_hnd(&domain_pol
))
1125 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1127 if (is_valid_policy_hnd(&connect_pol
))
1128 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1133 /* Enumerate domains */
1135 static NTSTATUS
cmd_samr_enum_domains(struct rpc_pipe_client
*cli
,
1136 TALLOC_CTX
*mem_ctx
,
1137 int argc
, const char **argv
)
1139 struct policy_handle connect_pol
;
1140 NTSTATUS status
, result
;
1141 uint32 start_idx
, size
, num_entries
, i
;
1142 uint32 access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1143 struct samr_SamArray
*sam
= NULL
;
1144 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1146 if ((argc
< 1) || (argc
> 2)) {
1147 printf("Usage: %s [access mask]\n", argv
[0]);
1148 return NT_STATUS_OK
;
1152 sscanf(argv
[1], "%x", &access_mask
);
1155 /* Get sam policy handle */
1157 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1160 if (!NT_STATUS_IS_OK(status
)) {
1164 /* Enumerate alias groups */
1170 status
= dcerpc_samr_EnumDomains(b
, mem_ctx
,
1177 if (!NT_STATUS_IS_OK(status
)) {
1180 if (NT_STATUS_IS_OK(result
) ||
1181 NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
)) {
1183 for (i
= 0; i
< num_entries
; i
++)
1184 printf("name:[%s] idx:[0x%x]\n",
1185 sam
->entries
[i
].name
.string
,
1186 sam
->entries
[i
].idx
);
1188 } while (NT_STATUS_V(result
) == NT_STATUS_V(STATUS_MORE_ENTRIES
));
1191 if (is_valid_policy_hnd(&connect_pol
)) {
1192 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1199 /* Query alias membership */
1201 static NTSTATUS
cmd_samr_query_aliasmem(struct rpc_pipe_client
*cli
,
1202 TALLOC_CTX
*mem_ctx
,
1203 int argc
, const char **argv
)
1205 struct policy_handle connect_pol
, domain_pol
, alias_pol
;
1206 NTSTATUS status
, result
;
1207 uint32 alias_rid
, i
;
1208 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1209 struct lsa_SidArray sid_array
;
1210 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1212 if ((argc
< 3) || (argc
> 4)) {
1213 printf("Usage: %s builtin|domain rid [access mask]\n", argv
[0]);
1214 return NT_STATUS_OK
;
1217 sscanf(argv
[2], "%i", &alias_rid
);
1220 sscanf(argv
[3], "%x", &access_mask
);
1222 /* Open SAMR handle */
1224 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1225 MAXIMUM_ALLOWED_ACCESS
,
1227 if (!NT_STATUS_IS_OK(status
)) {
1231 /* Open handle on domain */
1233 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
1235 MAXIMUM_ALLOWED_ACCESS
,
1238 if (!NT_STATUS_IS_OK(status
)) {
1242 /* Open handle on alias */
1244 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1250 if (!NT_STATUS_IS_OK(status
)) {
1253 if (!NT_STATUS_IS_OK(result
)) {
1258 status
= dcerpc_samr_GetMembersInAlias(b
, mem_ctx
,
1262 if (!NT_STATUS_IS_OK(status
)) {
1265 if (!NT_STATUS_IS_OK(result
)) {
1270 for (i
= 0; i
< sid_array
.num_sids
; i
++) {
1273 sid_to_fstring(sid_str
, sid_array
.sids
[i
].sid
);
1274 printf("\tsid:[%s]\n", sid_str
);
1277 dcerpc_samr_Close(b
, mem_ctx
, &alias_pol
, &result
);
1278 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1279 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1284 /* Query alias info */
1286 static NTSTATUS
cmd_samr_query_aliasinfo(struct rpc_pipe_client
*cli
,
1287 TALLOC_CTX
*mem_ctx
,
1288 int argc
, const char **argv
)
1290 struct policy_handle connect_pol
, domain_pol
, alias_pol
;
1291 NTSTATUS status
, result
;
1293 uint32_t access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1294 union samr_AliasInfo
*info
= NULL
;
1295 enum samr_AliasInfoEnum level
= ALIASINFOALL
;
1296 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1298 if ((argc
< 3) || (argc
> 4)) {
1299 printf("Usage: %s builtin|domain rid [level] [access mask]\n",
1301 return NT_STATUS_OK
;
1304 sscanf(argv
[2], "%i", &alias_rid
);
1307 level
= atoi(argv
[3]);
1311 sscanf(argv
[4], "%x", &access_mask
);
1314 /* Open SAMR handle */
1316 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1317 SEC_FLAG_MAXIMUM_ALLOWED
,
1319 if (!NT_STATUS_IS_OK(status
)) {
1323 /* Open handle on domain */
1325 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
1327 SEC_FLAG_MAXIMUM_ALLOWED
,
1330 if (!NT_STATUS_IS_OK(status
)) {
1334 /* Open handle on alias */
1336 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1342 if (!NT_STATUS_IS_OK(status
)) {
1345 if (!NT_STATUS_IS_OK(result
)) {
1350 status
= dcerpc_samr_QueryAliasInfo(b
, mem_ctx
,
1355 if (!NT_STATUS_IS_OK(status
)) {
1358 if (!NT_STATUS_IS_OK(result
)) {
1365 printf("Name: %s\n", info
->all
.name
.string
);
1366 printf("Description: %s\n", info
->all
.description
.string
);
1367 printf("Num Members: %d\n", info
->all
.num_members
);
1370 printf("Name: %s\n", info
->name
.string
);
1372 case ALIASINFODESCRIPTION
:
1373 printf("Description: %s\n", info
->description
.string
);
1379 dcerpc_samr_Close(b
, mem_ctx
, &alias_pol
, &result
);
1380 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1381 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1387 /* Query delete an alias membership */
1389 static NTSTATUS
cmd_samr_delete_alias(struct rpc_pipe_client
*cli
,
1390 TALLOC_CTX
*mem_ctx
,
1391 int argc
, const char **argv
)
1393 struct policy_handle connect_pol
, domain_pol
, alias_pol
;
1394 NTSTATUS status
, result
;
1396 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1397 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1400 printf("Usage: %s builtin|domain [rid|name]\n", argv
[0]);
1401 return NT_STATUS_OK
;
1404 alias_rid
= strtoul(argv
[2], NULL
, 10);
1406 /* Open SAMR handle */
1408 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1409 MAXIMUM_ALLOWED_ACCESS
,
1411 if (!NT_STATUS_IS_OK(status
)) {
1415 /* Open handle on domain */
1417 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
1419 MAXIMUM_ALLOWED_ACCESS
,
1422 if (!NT_STATUS_IS_OK(status
)) {
1426 /* Open handle on alias */
1428 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1434 if (!NT_STATUS_IS_OK(status
)) {
1437 if (!NT_STATUS_IS_OK(result
) && (alias_rid
== 0)) {
1438 /* Probably this was a user name, try lookupnames */
1439 struct samr_Ids rids
, types
;
1440 struct lsa_String lsa_acct_name
;
1442 init_lsa_String(&lsa_acct_name
, argv
[2]);
1444 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
1451 if (!NT_STATUS_IS_OK(status
)) {
1454 if (NT_STATUS_IS_OK(result
)) {
1455 status
= dcerpc_samr_OpenAlias(b
, mem_ctx
,
1461 if (!NT_STATUS_IS_OK(status
)) {
1467 status
= dcerpc_samr_DeleteDomAlias(b
, mem_ctx
,
1470 if (!NT_STATUS_IS_OK(status
)) {
1473 if (!NT_STATUS_IS_OK(result
)) {
1478 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1479 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1484 /* Query display info */
1486 static NTSTATUS
cmd_samr_query_dispinfo_internal(struct rpc_pipe_client
*cli
,
1487 TALLOC_CTX
*mem_ctx
,
1488 int argc
, const char **argv
,
1491 struct policy_handle connect_pol
, domain_pol
;
1492 NTSTATUS status
, result
;
1493 uint32 start_idx
=0, max_entries
=250, max_size
= 0xffff, num_entries
= 0, i
;
1494 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1495 uint32 info_level
= 1;
1496 union samr_DispInfo info
;
1498 bool got_params
= False
; /* Use get_query_dispinfo_params() or not? */
1499 uint32_t total_size
, returned_size
;
1500 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1503 printf("Usage: %s [info level] [start index] [max entries] [max size] [access mask]\n", argv
[0]);
1504 return NT_STATUS_OK
;
1508 sscanf(argv
[1], "%i", &info_level
);
1511 sscanf(argv
[2], "%i", &start_idx
);
1514 sscanf(argv
[3], "%i", &max_entries
);
1519 sscanf(argv
[4], "%i", &max_size
);
1524 sscanf(argv
[5], "%x", &access_mask
);
1526 /* Get sam policy handle */
1528 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1529 MAXIMUM_ALLOWED_ACCESS
,
1531 if (!NT_STATUS_IS_OK(status
)) {
1535 /* Get domain policy handle */
1537 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1543 if (!NT_STATUS_IS_OK(status
)) {
1546 if (!NT_STATUS_IS_OK(result
)) {
1551 /* Query display info */
1556 dcerpc_get_query_dispinfo_params(
1557 loop_count
, &max_entries
, &max_size
);
1560 case NDR_SAMR_QUERYDISPLAYINFO
:
1561 status
= dcerpc_samr_QueryDisplayInfo(b
, mem_ctx
,
1572 case NDR_SAMR_QUERYDISPLAYINFO2
:
1573 status
= dcerpc_samr_QueryDisplayInfo2(b
, mem_ctx
,
1585 case NDR_SAMR_QUERYDISPLAYINFO3
:
1586 status
= dcerpc_samr_QueryDisplayInfo3(b
, mem_ctx
,
1599 return NT_STATUS_INVALID_PARAMETER
;
1602 if (!NT_STATUS_IS_OK(status
)) {
1606 if (!NT_STATUS_IS_OK(result
) &&
1607 !NT_STATUS_EQUAL(result
, NT_STATUS_NO_MORE_ENTRIES
) &&
1608 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
)) {
1614 switch (info_level
) {
1616 num_entries
= info
.info1
.count
;
1619 num_entries
= info
.info2
.count
;
1622 num_entries
= info
.info3
.count
;
1625 num_entries
= info
.info4
.count
;
1628 num_entries
= info
.info5
.count
;
1634 start_idx
+= num_entries
;
1636 if (num_entries
== 0)
1639 for (i
= 0; i
< num_entries
; i
++) {
1640 switch (info_level
) {
1642 display_sam_info_1(&info
.info1
.entries
[i
]);
1645 display_sam_info_2(&info
.info2
.entries
[i
]);
1648 display_sam_info_3(&info
.info3
.entries
[i
]);
1651 display_sam_info_4(&info
.info4
.entries
[i
]);
1654 display_sam_info_5(&info
.info5
.entries
[i
]);
1658 } while ( NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
));
1660 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1661 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1666 static NTSTATUS
cmd_samr_query_dispinfo(struct rpc_pipe_client
*cli
,
1667 TALLOC_CTX
*mem_ctx
,
1668 int argc
, const char **argv
)
1670 return cmd_samr_query_dispinfo_internal(cli
, mem_ctx
, argc
, argv
,
1671 NDR_SAMR_QUERYDISPLAYINFO
);
1674 static NTSTATUS
cmd_samr_query_dispinfo2(struct rpc_pipe_client
*cli
,
1675 TALLOC_CTX
*mem_ctx
,
1676 int argc
, const char **argv
)
1678 return cmd_samr_query_dispinfo_internal(cli
, mem_ctx
, argc
, argv
,
1679 NDR_SAMR_QUERYDISPLAYINFO2
);
1682 static NTSTATUS
cmd_samr_query_dispinfo3(struct rpc_pipe_client
*cli
,
1683 TALLOC_CTX
*mem_ctx
,
1684 int argc
, const char **argv
)
1686 return cmd_samr_query_dispinfo_internal(cli
, mem_ctx
, argc
, argv
,
1687 NDR_SAMR_QUERYDISPLAYINFO3
);
1690 /* Query domain info */
1692 static NTSTATUS
cmd_samr_query_dominfo(struct rpc_pipe_client
*cli
,
1693 TALLOC_CTX
*mem_ctx
,
1694 int argc
, const char **argv
)
1696 struct policy_handle connect_pol
, domain_pol
;
1697 NTSTATUS status
, result
;
1698 uint32 switch_level
= 2;
1699 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1700 union samr_DomainInfo
*info
= NULL
;
1701 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1704 printf("Usage: %s [info level] [access mask]\n", argv
[0]);
1705 return NT_STATUS_OK
;
1709 sscanf(argv
[1], "%i", &switch_level
);
1712 sscanf(argv
[2], "%x", &access_mask
);
1714 /* Get sam policy handle */
1716 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1717 MAXIMUM_ALLOWED_ACCESS
,
1719 if (!NT_STATUS_IS_OK(status
)) {
1723 /* Get domain policy handle */
1725 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1731 if (!NT_STATUS_IS_OK(status
)) {
1734 if (!NT_STATUS_IS_OK(result
)) {
1739 /* Query domain info */
1741 status
= dcerpc_samr_QueryDomainInfo(b
, mem_ctx
,
1746 if (!NT_STATUS_IS_OK(status
)) {
1749 if (!NT_STATUS_IS_OK(result
)) {
1754 /* Display domain info */
1756 switch (switch_level
) {
1758 display_sam_dom_info_1(&info
->info1
);
1761 display_sam_dom_info_2(&info
->general
);
1764 display_sam_dom_info_3(&info
->info3
);
1767 display_sam_dom_info_4(&info
->oem
);
1770 display_sam_dom_info_5(&info
->info5
);
1773 display_sam_dom_info_6(&info
->info6
);
1776 display_sam_dom_info_7(&info
->info7
);
1779 display_sam_dom_info_8(&info
->info8
);
1782 display_sam_dom_info_9(&info
->info9
);
1785 display_sam_dom_info_12(&info
->info12
);
1788 display_sam_dom_info_13(&info
->info13
);
1792 printf("cannot display domain info for switch value %d\n",
1799 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1800 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1804 /* Create domain user */
1806 static NTSTATUS
cmd_samr_create_dom_user(struct rpc_pipe_client
*cli
,
1807 TALLOC_CTX
*mem_ctx
,
1808 int argc
, const char **argv
)
1810 struct policy_handle connect_pol
, domain_pol
, user_pol
;
1811 NTSTATUS status
, result
;
1812 struct lsa_String acct_name
;
1814 uint32 acct_flags
, user_rid
;
1815 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1816 uint32_t access_granted
= 0;
1817 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1819 if ((argc
< 2) || (argc
> 3)) {
1820 printf("Usage: %s username [access mask]\n", argv
[0]);
1821 return NT_STATUS_OK
;
1824 init_lsa_String(&acct_name
, argv
[1]);
1827 sscanf(argv
[2], "%x", &access_mask
);
1829 /* Get sam policy handle */
1831 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1832 MAXIMUM_ALLOWED_ACCESS
,
1834 if (!NT_STATUS_IS_OK(status
)) {
1838 /* Get domain policy handle */
1840 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1846 if (!NT_STATUS_IS_OK(status
)) {
1849 if (!NT_STATUS_IS_OK(result
)) {
1854 /* Create domain user */
1856 acb_info
= ACB_NORMAL
;
1857 acct_flags
= SEC_GENERIC_READ
| SEC_GENERIC_WRITE
| SEC_GENERIC_EXECUTE
|
1858 SEC_STD_WRITE_DAC
| SEC_STD_DELETE
|
1859 SAMR_USER_ACCESS_SET_PASSWORD
|
1860 SAMR_USER_ACCESS_GET_ATTRIBUTES
|
1861 SAMR_USER_ACCESS_SET_ATTRIBUTES
;
1863 status
= dcerpc_samr_CreateUser2(b
, mem_ctx
,
1872 if (!NT_STATUS_IS_OK(status
)) {
1875 if (!NT_STATUS_IS_OK(result
)) {
1880 status
= dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
1881 if (!NT_STATUS_IS_OK(status
)) goto done
;
1883 status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1884 if (!NT_STATUS_IS_OK(status
)) goto done
;
1886 status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1887 if (!NT_STATUS_IS_OK(status
)) goto done
;
1893 /* Create domain group */
1895 static NTSTATUS
cmd_samr_create_dom_group(struct rpc_pipe_client
*cli
,
1896 TALLOC_CTX
*mem_ctx
,
1897 int argc
, const char **argv
)
1899 struct policy_handle connect_pol
, domain_pol
, group_pol
;
1900 NTSTATUS status
, result
;
1901 struct lsa_String grp_name
;
1902 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1904 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1906 if ((argc
< 2) || (argc
> 3)) {
1907 printf("Usage: %s groupname [access mask]\n", argv
[0]);
1908 return NT_STATUS_OK
;
1911 init_lsa_String(&grp_name
, argv
[1]);
1914 sscanf(argv
[2], "%x", &access_mask
);
1916 /* Get sam policy handle */
1918 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1919 MAXIMUM_ALLOWED_ACCESS
,
1921 if (!NT_STATUS_IS_OK(status
)) {
1925 /* Get domain policy handle */
1927 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
1933 if (!NT_STATUS_IS_OK(status
)) {
1936 if (!NT_STATUS_IS_OK(result
)) {
1941 /* Create domain user */
1942 status
= dcerpc_samr_CreateDomainGroup(b
, mem_ctx
,
1945 MAXIMUM_ALLOWED_ACCESS
,
1949 if (!NT_STATUS_IS_OK(status
)) {
1952 if (!NT_STATUS_IS_OK(result
)) {
1957 status
= dcerpc_samr_Close(b
, mem_ctx
, &group_pol
, &result
);
1958 if (!NT_STATUS_IS_OK(status
)) goto done
;
1960 status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
1961 if (!NT_STATUS_IS_OK(status
)) goto done
;
1963 status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
1964 if (!NT_STATUS_IS_OK(status
)) goto done
;
1970 /* Create domain alias */
1972 static NTSTATUS
cmd_samr_create_dom_alias(struct rpc_pipe_client
*cli
,
1973 TALLOC_CTX
*mem_ctx
,
1974 int argc
, const char **argv
)
1976 struct policy_handle connect_pol
, domain_pol
, alias_pol
;
1977 NTSTATUS status
, result
;
1978 struct lsa_String alias_name
;
1979 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
1981 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1983 if ((argc
< 2) || (argc
> 3)) {
1984 printf("Usage: %s aliasname [access mask]\n", argv
[0]);
1985 return NT_STATUS_OK
;
1988 init_lsa_String(&alias_name
, argv
[1]);
1991 sscanf(argv
[2], "%x", &access_mask
);
1993 /* Get sam policy handle */
1995 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
1996 MAXIMUM_ALLOWED_ACCESS
,
1998 if (!NT_STATUS_IS_OK(status
)) {
2002 /* Get domain policy handle */
2004 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2010 if (!NT_STATUS_IS_OK(status
)) {
2013 if (!NT_STATUS_IS_OK(result
)) {
2018 /* Create domain user */
2020 status
= dcerpc_samr_CreateDomAlias(b
, mem_ctx
,
2023 MAXIMUM_ALLOWED_ACCESS
,
2027 if (!NT_STATUS_IS_OK(status
)) {
2030 if (!NT_STATUS_IS_OK(result
)) {
2036 status
= dcerpc_samr_Close(b
, mem_ctx
, &alias_pol
, &result
);
2037 if (!NT_STATUS_IS_OK(status
)) goto done
;
2039 status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2040 if (!NT_STATUS_IS_OK(status
)) goto done
;
2042 status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2043 if (!NT_STATUS_IS_OK(status
)) goto done
;
2049 /* Lookup sam names */
2051 static NTSTATUS
cmd_samr_lookup_names(struct rpc_pipe_client
*cli
,
2052 TALLOC_CTX
*mem_ctx
,
2053 int argc
, const char **argv
)
2055 NTSTATUS status
, result
;
2056 struct policy_handle connect_pol
, domain_pol
;
2058 struct samr_Ids rids
, name_types
;
2060 struct lsa_String
*names
= NULL
;
2061 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2064 printf("Usage: %s domain|builtin name1 [name2 [name3] [...]]\n", argv
[0]);
2065 printf("check on the domain SID: S-1-5-21-x-y-z\n");
2066 printf("or check on the builtin SID: S-1-5-32\n");
2067 return NT_STATUS_OK
;
2070 /* Get sam policy and domain handles */
2072 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2073 MAXIMUM_ALLOWED_ACCESS
,
2075 if (!NT_STATUS_IS_OK(status
)) {
2079 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
2081 MAXIMUM_ALLOWED_ACCESS
,
2084 if (!NT_STATUS_IS_OK(status
)) {
2090 num_names
= argc
- 2;
2092 if ((names
= talloc_array(mem_ctx
, struct lsa_String
, num_names
)) == NULL
) {
2093 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2094 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2095 status
= NT_STATUS_NO_MEMORY
;
2099 for (i
= 0; i
< num_names
; i
++) {
2100 init_lsa_String(&names
[i
], argv
[i
+ 2]);
2103 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2110 if (!NT_STATUS_IS_OK(status
)) {
2113 if (!NT_STATUS_IS_OK(result
)) {
2118 /* Display results */
2120 for (i
= 0; i
< num_names
; i
++)
2121 printf("name %s: 0x%x (%d)\n", names
[i
].string
, rids
.ids
[i
],
2124 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2125 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2130 /* Lookup sam rids */
2132 static NTSTATUS
cmd_samr_lookup_rids(struct rpc_pipe_client
*cli
,
2133 TALLOC_CTX
*mem_ctx
,
2134 int argc
, const char **argv
)
2136 NTSTATUS status
, result
;
2137 struct policy_handle connect_pol
, domain_pol
;
2138 uint32_t num_rids
, *rids
;
2139 struct lsa_Strings names
;
2140 struct samr_Ids types
;
2141 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2146 printf("Usage: %s domain|builtin rid1 [rid2 [rid3] [...]]\n", argv
[0]);
2147 return NT_STATUS_OK
;
2150 /* Get sam policy and domain handles */
2152 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2153 MAXIMUM_ALLOWED_ACCESS
,
2155 if (!NT_STATUS_IS_OK(status
)) {
2159 status
= get_domain_handle(cli
, mem_ctx
, argv
[1],
2161 MAXIMUM_ALLOWED_ACCESS
,
2164 if (!NT_STATUS_IS_OK(status
)) {
2170 num_rids
= argc
- 2;
2172 if ((rids
= talloc_array(mem_ctx
, uint32
, num_rids
)) == NULL
) {
2173 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2174 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2175 status
= NT_STATUS_NO_MEMORY
;
2179 for (i
= 0; i
< argc
- 2; i
++)
2180 sscanf(argv
[i
+ 2], "%i", &rids
[i
]);
2182 status
= dcerpc_samr_LookupRids(b
, mem_ctx
,
2189 if (!NT_STATUS_IS_OK(status
)) {
2193 if (!NT_STATUS_IS_OK(result
) &&
2194 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
2197 /* Display results */
2199 for (i
= 0; i
< num_rids
; i
++) {
2200 printf("rid 0x%x: %s (%d)\n",
2201 rids
[i
], names
.names
[i
].string
, types
.ids
[i
]);
2204 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2205 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2210 /* Delete domain group */
2212 static NTSTATUS
cmd_samr_delete_dom_group(struct rpc_pipe_client
*cli
,
2213 TALLOC_CTX
*mem_ctx
,
2214 int argc
, const char **argv
)
2216 NTSTATUS status
, result
;
2217 struct policy_handle connect_pol
, domain_pol
, group_pol
;
2218 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2219 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2221 if ((argc
< 2) || (argc
> 3)) {
2222 printf("Usage: %s groupname\n", argv
[0]);
2223 return NT_STATUS_OK
;
2227 sscanf(argv
[2], "%x", &access_mask
);
2229 /* Get sam policy and domain handles */
2231 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2232 MAXIMUM_ALLOWED_ACCESS
,
2234 if (!NT_STATUS_IS_OK(status
)) {
2238 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2240 MAXIMUM_ALLOWED_ACCESS
,
2244 if (!NT_STATUS_IS_OK(status
)) {
2247 if (!NT_STATUS_IS_OK(result
)) {
2252 /* Get handle on group */
2255 struct samr_Ids group_rids
, name_types
;
2256 struct lsa_String lsa_acct_name
;
2258 init_lsa_String(&lsa_acct_name
, argv
[1]);
2260 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2267 if (!NT_STATUS_IS_OK(status
)) {
2270 if (!NT_STATUS_IS_OK(result
)) {
2275 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
2281 if (!NT_STATUS_IS_OK(status
)) {
2284 if (!NT_STATUS_IS_OK(result
)) {
2292 status
= dcerpc_samr_DeleteDomainGroup(b
, mem_ctx
,
2295 if (!NT_STATUS_IS_OK(status
)) {
2298 if (!NT_STATUS_IS_OK(result
)) {
2303 /* Display results */
2305 dcerpc_samr_Close(b
, mem_ctx
, &group_pol
, &result
);
2306 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2307 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2313 /* Delete domain user */
2315 static NTSTATUS
cmd_samr_delete_dom_user(struct rpc_pipe_client
*cli
,
2316 TALLOC_CTX
*mem_ctx
,
2317 int argc
, const char **argv
)
2319 NTSTATUS status
, result
;
2320 struct policy_handle connect_pol
, domain_pol
, user_pol
;
2321 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2322 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2324 if ((argc
< 2) || (argc
> 3)) {
2325 printf("Usage: %s username\n", argv
[0]);
2326 return NT_STATUS_OK
;
2330 sscanf(argv
[2], "%x", &access_mask
);
2332 /* Get sam policy and domain handles */
2334 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2335 MAXIMUM_ALLOWED_ACCESS
,
2337 if (!NT_STATUS_IS_OK(status
)) {
2341 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2343 MAXIMUM_ALLOWED_ACCESS
,
2347 if (!NT_STATUS_IS_OK(status
)) {
2350 if (!NT_STATUS_IS_OK(result
)) {
2355 /* Get handle on user */
2358 struct samr_Ids user_rids
, name_types
;
2359 struct lsa_String lsa_acct_name
;
2361 init_lsa_String(&lsa_acct_name
, argv
[1]);
2363 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2370 if (!NT_STATUS_IS_OK(status
)) {
2373 if (!NT_STATUS_IS_OK(result
)) {
2378 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
2384 if (!NT_STATUS_IS_OK(status
)) {
2387 if (!NT_STATUS_IS_OK(result
)) {
2395 status
= dcerpc_samr_DeleteUser(b
, mem_ctx
,
2398 if (!NT_STATUS_IS_OK(status
)) {
2401 if (!NT_STATUS_IS_OK(result
)) {
2406 /* Display results */
2408 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
2409 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2410 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2416 /**********************************************************************
2417 * Query user security object
2419 static NTSTATUS
cmd_samr_query_sec_obj(struct rpc_pipe_client
*cli
,
2420 TALLOC_CTX
*mem_ctx
,
2421 int argc
, const char **argv
)
2423 struct policy_handle connect_pol
, domain_pol
, user_pol
, *pol
;
2424 NTSTATUS status
, result
;
2425 uint32 sec_info
= SECINFO_DACL
;
2426 uint32 user_rid
= 0;
2427 TALLOC_CTX
*ctx
= NULL
;
2428 struct sec_desc_buf
*sec_desc_buf
=NULL
;
2429 bool domain
= False
;
2430 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2432 ctx
=talloc_init("cmd_samr_query_sec_obj");
2434 if ((argc
< 1) || (argc
> 3)) {
2435 printf("Usage: %s [rid|-d] [sec_info]\n", argv
[0]);
2436 printf("\tSpecify rid for security on user, -d for security on domain\n");
2437 talloc_destroy(ctx
);
2438 return NT_STATUS_OK
;
2442 if (strcmp(argv
[1], "-d") == 0)
2445 sscanf(argv
[1], "%i", &user_rid
);
2449 sec_info
= atoi(argv
[2]);
2452 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2453 MAXIMUM_ALLOWED_ACCESS
,
2455 if (!NT_STATUS_IS_OK(status
)) {
2459 if (domain
|| user_rid
) {
2460 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2462 MAXIMUM_ALLOWED_ACCESS
,
2466 if (!NT_STATUS_IS_OK(status
)) {
2469 if (!NT_STATUS_IS_OK(result
)) {
2476 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
2478 MAXIMUM_ALLOWED_ACCESS
,
2482 if (!NT_STATUS_IS_OK(status
)) {
2485 if (!NT_STATUS_IS_OK(result
)) {
2491 /* Pick which query pol to use */
2501 /* Query SAM security object */
2503 status
= dcerpc_samr_QuerySecurity(b
, mem_ctx
,
2508 if (!NT_STATUS_IS_OK(status
)) {
2511 if (!NT_STATUS_IS_OK(result
)) {
2516 display_sec_desc(sec_desc_buf
->sd
);
2518 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
2519 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2520 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2522 talloc_destroy(ctx
);
2526 static NTSTATUS
cmd_samr_get_usrdom_pwinfo(struct rpc_pipe_client
*cli
,
2527 TALLOC_CTX
*mem_ctx
,
2528 int argc
, const char **argv
)
2530 NTSTATUS status
, result
;
2531 struct policy_handle connect_pol
, domain_pol
, user_pol
;
2532 struct samr_PwInfo info
;
2534 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2537 printf("Usage: %s rid\n", argv
[0]);
2538 return NT_STATUS_OK
;
2541 sscanf(argv
[1], "%i", &rid
);
2543 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2544 MAXIMUM_ALLOWED_ACCESS
,
2546 if (!NT_STATUS_IS_OK(status
)) {
2550 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2552 MAXIMUM_ALLOWED_ACCESS
,
2556 if (!NT_STATUS_IS_OK(status
)) {
2559 if (!NT_STATUS_IS_OK(result
)) {
2564 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
2566 MAXIMUM_ALLOWED_ACCESS
,
2570 if (!NT_STATUS_IS_OK(status
)) {
2573 if (!NT_STATUS_IS_OK(result
)) {
2578 status
= dcerpc_samr_GetUserPwInfo(b
, mem_ctx
,
2582 if (!NT_STATUS_IS_OK(status
)) {
2586 if (NT_STATUS_IS_OK(result
)) {
2587 printf("min_password_length: %d\n", info
.min_password_length
);
2589 NDR_PRINT_STRUCT_STRING(mem_ctx
,
2590 samr_PasswordProperties
, &info
.password_properties
));
2594 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
2595 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2596 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2601 static NTSTATUS
cmd_samr_get_dom_pwinfo(struct rpc_pipe_client
*cli
,
2602 TALLOC_CTX
*mem_ctx
,
2603 int argc
, const char **argv
)
2605 NTSTATUS status
, result
;
2606 struct lsa_String domain_name
;
2607 struct samr_PwInfo info
;
2608 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2610 if (argc
< 1 || argc
> 3) {
2611 printf("Usage: %s <domain>\n", argv
[0]);
2612 return NT_STATUS_OK
;
2615 init_lsa_String(&domain_name
, argv
[1]);
2617 status
= dcerpc_samr_GetDomPwInfo(b
, mem_ctx
,
2621 if (!NT_STATUS_IS_OK(status
)) {
2624 if (NT_STATUS_IS_OK(result
)) {
2625 printf("min_password_length: %d\n", info
.min_password_length
);
2626 display_password_properties(info
.password_properties
);
2632 /* Look up domain name */
2634 static NTSTATUS
cmd_samr_lookup_domain(struct rpc_pipe_client
*cli
,
2635 TALLOC_CTX
*mem_ctx
,
2636 int argc
, const char **argv
)
2638 struct policy_handle connect_pol
, domain_pol
;
2639 NTSTATUS status
, result
;
2640 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2642 struct lsa_String domain_name
;
2643 struct dom_sid
*sid
= NULL
;
2644 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2647 printf("Usage: %s domain_name\n", argv
[0]);
2648 return NT_STATUS_OK
;
2651 init_lsa_String(&domain_name
, argv
[1]);
2653 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2656 if (!NT_STATUS_IS_OK(status
)) {
2660 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2666 if (!NT_STATUS_IS_OK(status
)) {
2669 if (!NT_STATUS_IS_OK(result
)) {
2674 status
= dcerpc_samr_LookupDomain(b
, mem_ctx
,
2679 if (!NT_STATUS_IS_OK(status
)) {
2682 if (!NT_STATUS_IS_OK(result
)) {
2687 if (NT_STATUS_IS_OK(result
)) {
2688 sid_to_fstring(sid_string
, sid
);
2689 printf("SAMR_LOOKUP_DOMAIN: Domain Name: %s Domain SID: %s\n",
2690 argv
[1], sid_string
);
2693 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2694 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2699 /* Change user password */
2701 static NTSTATUS
cmd_samr_chgpasswd(struct rpc_pipe_client
*cli
,
2702 TALLOC_CTX
*mem_ctx
,
2703 int argc
, const char **argv
)
2705 struct policy_handle connect_pol
, domain_pol
, user_pol
;
2706 NTSTATUS status
, result
;
2707 const char *user
, *oldpass
, *newpass
;
2708 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2709 struct samr_Ids rids
, types
;
2710 struct lsa_String lsa_acct_name
;
2711 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2714 printf("Usage: %s username oldpass newpass\n", argv
[0]);
2715 return NT_STATUS_INVALID_PARAMETER
;
2722 /* Get sam policy handle */
2724 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2725 MAXIMUM_ALLOWED_ACCESS
,
2727 if (!NT_STATUS_IS_OK(status
)) {
2731 /* Get domain policy handle */
2733 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2739 if (!NT_STATUS_IS_OK(status
)) {
2742 if (!NT_STATUS_IS_OK(result
)) {
2747 init_lsa_String(&lsa_acct_name
, user
);
2749 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
2756 if (!NT_STATUS_IS_OK(status
)) {
2759 if (!NT_STATUS_IS_OK(result
)) {
2764 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
2770 if (!NT_STATUS_IS_OK(status
)) {
2773 if (!NT_STATUS_IS_OK(result
)) {
2778 /* Change user password */
2779 status
= rpccli_samr_chgpasswd_user(cli
, mem_ctx
,
2783 if (!NT_STATUS_IS_OK(status
)) {
2788 if (is_valid_policy_hnd(&user_pol
)) {
2789 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result
);
2791 if (is_valid_policy_hnd(&domain_pol
)) {
2792 dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2794 if (is_valid_policy_hnd(&connect_pol
)) {
2795 dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2802 /* Change user password */
2804 static NTSTATUS
cmd_samr_chgpasswd2(struct rpc_pipe_client
*cli
,
2805 TALLOC_CTX
*mem_ctx
,
2806 int argc
, const char **argv
)
2808 struct policy_handle connect_pol
, domain_pol
;
2809 NTSTATUS status
, result
;
2810 const char *user
, *oldpass
, *newpass
;
2811 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2812 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2815 printf("Usage: %s username oldpass newpass\n", argv
[0]);
2816 return NT_STATUS_INVALID_PARAMETER
;
2823 /* Get sam policy handle */
2825 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2826 MAXIMUM_ALLOWED_ACCESS
,
2828 if (!NT_STATUS_IS_OK(status
)) {
2832 /* Get domain policy handle */
2834 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2840 if (!NT_STATUS_IS_OK(status
)) {
2843 if (!NT_STATUS_IS_OK(result
)) {
2848 /* Change user password */
2849 status
= rpccli_samr_chgpasswd_user2(cli
, mem_ctx
, user
, newpass
, oldpass
);
2851 if (!NT_STATUS_IS_OK(status
)) {
2855 status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2856 if (!NT_STATUS_IS_OK(status
)) goto done
;
2858 status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2859 if (!NT_STATUS_IS_OK(status
)) goto done
;
2866 /* Change user password */
2868 static NTSTATUS
cmd_samr_chgpasswd3(struct rpc_pipe_client
*cli
,
2869 TALLOC_CTX
*mem_ctx
,
2870 int argc
, const char **argv
)
2872 struct policy_handle connect_pol
, domain_pol
;
2873 NTSTATUS status
, result
;
2874 const char *user
, *oldpass
, *newpass
;
2875 uint32 access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2876 struct samr_DomInfo1
*info
= NULL
;
2877 struct userPwdChangeFailureInformation
*reject
= NULL
;
2878 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2881 printf("Usage: %s username oldpass newpass\n", argv
[0]);
2882 return NT_STATUS_INVALID_PARAMETER
;
2889 /* Get sam policy handle */
2891 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
2892 MAXIMUM_ALLOWED_ACCESS
,
2894 if (!NT_STATUS_IS_OK(status
)) {
2898 /* Get domain policy handle */
2900 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
2906 if (!NT_STATUS_IS_OK(status
)) {
2909 if (!NT_STATUS_IS_OK(result
)) {
2914 /* Change user password */
2915 status
= rpccli_samr_chgpasswd_user3(cli
, mem_ctx
,
2921 if (!NT_STATUS_IS_OK(status
)) {
2925 if (NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_RESTRICTION
)) {
2927 display_sam_dom_info_1(info
);
2929 switch (reject
->extendedFailureReason
) {
2930 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT
:
2931 d_printf("SAM_PWD_CHANGE_PASSWORD_TOO_SHORT\n");
2933 case SAM_PWD_CHANGE_PWD_IN_HISTORY
:
2934 d_printf("SAM_PWD_CHANGE_PWD_IN_HISTORY\n");
2936 case SAM_PWD_CHANGE_NOT_COMPLEX
:
2937 d_printf("SAM_PWD_CHANGE_NOT_COMPLEX\n");
2940 d_printf("unknown reject reason: %d\n",
2941 reject
->extendedFailureReason
);
2946 if (!NT_STATUS_IS_OK(result
)) {
2951 status
= dcerpc_samr_Close(b
, mem_ctx
, &domain_pol
, &result
);
2952 if (!NT_STATUS_IS_OK(status
)) goto done
;
2954 status
= dcerpc_samr_Close(b
, mem_ctx
, &connect_pol
, &result
);
2955 if (!NT_STATUS_IS_OK(status
)) goto done
;
2961 static NTSTATUS
cmd_samr_setuserinfo_int(struct rpc_pipe_client
*cli
,
2962 TALLOC_CTX
*mem_ctx
,
2963 int argc
, const char **argv
,
2966 struct policy_handle connect_pol
, domain_pol
, user_pol
;
2967 NTSTATUS status
, result
;
2968 const char *user
, *param
;
2969 uint32_t access_mask
= MAXIMUM_ALLOWED_ACCESS
;
2972 union samr_UserInfo info
;
2973 struct samr_CryptPassword pwd_buf
;
2974 struct samr_CryptPasswordEx pwd_buf_ex
;
2975 uint8_t nt_hash
[16];
2976 uint8_t lm_hash
[16];
2977 DATA_BLOB session_key
;
2978 uint8_t password_expired
= 0;
2979 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2982 printf("Usage: %s username level password [password_expired]\n",
2984 return NT_STATUS_INVALID_PARAMETER
;
2988 level
= atoi(argv
[2]);
2992 password_expired
= atoi(argv
[4]);
2995 status
= cli_get_session_key(mem_ctx
, cli
, &session_key
);
2996 if (!NT_STATUS_IS_OK(status
)) {
3000 init_samr_CryptPassword(param
, &session_key
, &pwd_buf
);
3001 init_samr_CryptPasswordEx(param
, &session_key
, &pwd_buf_ex
);
3002 nt_lm_owf_gen(param
, nt_hash
, lm_hash
);
3008 in
= data_blob_const(nt_hash
, 16);
3009 out
= data_blob_talloc_zero(mem_ctx
, 16);
3010 sess_crypt_blob(&out
, &in
, &session_key
, true);
3011 memcpy(nt_hash
, out
.data
, out
.length
);
3015 in
= data_blob_const(lm_hash
, 16);
3016 out
= data_blob_talloc_zero(mem_ctx
, 16);
3017 sess_crypt_blob(&out
, &in
, &session_key
, true);
3018 memcpy(lm_hash
, out
.data
, out
.length
);
3021 memcpy(info
.info18
.nt_pwd
.hash
, nt_hash
, 16);
3022 memcpy(info
.info18
.lm_pwd
.hash
, lm_hash
, 16);
3023 info
.info18
.nt_pwd_active
= true;
3024 info
.info18
.lm_pwd_active
= true;
3025 info
.info18
.password_expired
= password_expired
;
3029 ZERO_STRUCT(info
.info21
);
3031 info
.info21
.fields_present
= SAMR_FIELD_NT_PASSWORD_PRESENT
|
3032 SAMR_FIELD_LM_PASSWORD_PRESENT
;
3034 info
.info21
.fields_present
|= SAMR_FIELD_EXPIRED_FLAG
;
3035 info
.info21
.password_expired
= password_expired
;
3038 info
.info21
.lm_password_set
= true;
3039 info
.info21
.lm_owf_password
.length
= 16;
3040 info
.info21
.lm_owf_password
.size
= 16;
3042 info
.info21
.nt_password_set
= true;
3043 info
.info21
.nt_owf_password
.length
= 16;
3044 info
.info21
.nt_owf_password
.size
= 16;
3048 in
= data_blob_const(nt_hash
, 16);
3049 out
= data_blob_talloc_zero(mem_ctx
, 16);
3050 sess_crypt_blob(&out
, &in
, &session_key
, true);
3051 info
.info21
.nt_owf_password
.array
=
3052 (uint16_t *)talloc_memdup(mem_ctx
, out
.data
, 16);
3056 in
= data_blob_const(lm_hash
, 16);
3057 out
= data_blob_talloc_zero(mem_ctx
, 16);
3058 sess_crypt_blob(&out
, &in
, &session_key
, true);
3059 info
.info21
.lm_owf_password
.array
=
3060 (uint16_t *)talloc_memdup(mem_ctx
, out
.data
, 16);
3065 ZERO_STRUCT(info
.info23
);
3067 info
.info23
.info
.fields_present
= SAMR_FIELD_NT_PASSWORD_PRESENT
|
3068 SAMR_FIELD_LM_PASSWORD_PRESENT
;
3070 info
.info23
.info
.fields_present
|= SAMR_FIELD_EXPIRED_FLAG
;
3071 info
.info23
.info
.password_expired
= password_expired
;
3074 info
.info23
.password
= pwd_buf
;
3078 info
.info24
.password
= pwd_buf
;
3079 info
.info24
.password_expired
= password_expired
;
3083 ZERO_STRUCT(info
.info25
);
3085 info
.info25
.info
.fields_present
= SAMR_FIELD_NT_PASSWORD_PRESENT
|
3086 SAMR_FIELD_LM_PASSWORD_PRESENT
;
3088 info
.info25
.info
.fields_present
|= SAMR_FIELD_EXPIRED_FLAG
;
3089 info
.info25
.info
.password_expired
= password_expired
;
3092 info
.info25
.password
= pwd_buf_ex
;
3096 info
.info26
.password
= pwd_buf_ex
;
3097 info
.info26
.password_expired
= password_expired
;
3101 return NT_STATUS_INVALID_INFO_CLASS
;
3104 /* Get sam policy handle */
3106 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
3107 MAXIMUM_ALLOWED_ACCESS
,
3109 if (!NT_STATUS_IS_OK(status
)) {
3113 /* Get domain policy handle */
3115 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3122 if (!NT_STATUS_IS_OK(status
))
3124 if (!NT_STATUS_IS_OK(result
)) {
3129 user_rid
= strtol(user
, NULL
, 0);
3131 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
3137 if (!NT_STATUS_IS_OK(status
)) {
3144 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
) ||
3147 /* Probably this was a user name, try lookupnames */
3148 struct samr_Ids rids
, types
;
3149 struct lsa_String lsa_acct_name
;
3151 init_lsa_String(&lsa_acct_name
, user
);
3153 status
= dcerpc_samr_LookupNames(b
, mem_ctx
,
3160 if (!NT_STATUS_IS_OK(status
)) {
3163 if (!NT_STATUS_IS_OK(result
)) {
3168 status
= dcerpc_samr_OpenUser(b
, mem_ctx
,
3174 if (!NT_STATUS_IS_OK(status
)) {
3177 if (!NT_STATUS_IS_OK(result
)) {
3183 case NDR_SAMR_SETUSERINFO
:
3184 status
= dcerpc_samr_SetUserInfo(b
, mem_ctx
,
3190 case NDR_SAMR_SETUSERINFO2
:
3191 status
= dcerpc_samr_SetUserInfo2(b
, mem_ctx
,
3198 return NT_STATUS_INVALID_PARAMETER
;
3200 if (!NT_STATUS_IS_OK(status
)) {
3201 DEBUG(0,("status: %s\n", nt_errstr(status
)));
3204 if (!NT_STATUS_IS_OK(result
)) {
3206 DEBUG(0,("result: %s\n", nt_errstr(status
)));
3213 static NTSTATUS
cmd_samr_setuserinfo(struct rpc_pipe_client
*cli
,
3214 TALLOC_CTX
*mem_ctx
,
3215 int argc
, const char **argv
)
3217 return cmd_samr_setuserinfo_int(cli
, mem_ctx
, argc
, argv
,
3218 NDR_SAMR_SETUSERINFO
);
3221 static NTSTATUS
cmd_samr_setuserinfo2(struct rpc_pipe_client
*cli
,
3222 TALLOC_CTX
*mem_ctx
,
3223 int argc
, const char **argv
)
3225 return cmd_samr_setuserinfo_int(cli
, mem_ctx
, argc
, argv
,
3226 NDR_SAMR_SETUSERINFO2
);
3229 static NTSTATUS
cmd_samr_get_dispinfo_idx(struct rpc_pipe_client
*cli
,
3230 TALLOC_CTX
*mem_ctx
,
3231 int argc
, const char **argv
)
3233 NTSTATUS status
, result
;
3234 struct policy_handle connect_handle
;
3235 struct policy_handle domain_handle
= { 0, };
3237 struct lsa_String name
;
3239 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
3241 if (argc
< 2 || argc
> 3) {
3242 printf("Usage: %s name level\n", argv
[0]);
3243 return NT_STATUS_INVALID_PARAMETER
;
3246 init_lsa_String(&name
, argv
[1]);
3249 level
= atoi(argv
[2]);
3252 status
= rpccli_try_samr_connects(cli
, mem_ctx
,
3253 SEC_FLAG_MAXIMUM_ALLOWED
,
3255 if (!NT_STATUS_IS_OK(status
)) {
3259 status
= dcerpc_samr_OpenDomain(b
, mem_ctx
,
3261 SEC_FLAG_MAXIMUM_ALLOWED
,
3265 if (!NT_STATUS_IS_OK(status
)) {
3268 if (!NT_STATUS_IS_OK(result
)) {
3273 status
= dcerpc_samr_GetDisplayEnumerationIndex(b
, mem_ctx
,
3279 if (!NT_STATUS_IS_OK(status
)) {
3285 if (NT_STATUS_IS_OK(status
) ||
3286 NT_STATUS_EQUAL(status
, NT_STATUS_NO_MORE_ENTRIES
)) {
3287 printf("idx: %d (0x%08x)\n", idx
, idx
);
3291 if (is_valid_policy_hnd(&domain_handle
)) {
3292 dcerpc_samr_Close(b
, mem_ctx
, &domain_handle
, &result
);
3294 if (is_valid_policy_hnd(&connect_handle
)) {
3295 dcerpc_samr_Close(b
, mem_ctx
, &connect_handle
, &result
);
3301 /* List of commands exported by this module */
3303 struct cmd_set samr_commands
[] = {
3307 { "queryuser", RPC_RTYPE_NTSTATUS
, cmd_samr_query_user
, NULL
, &ndr_table_samr
, NULL
, "Query user info", "" },
3308 { "querygroup", RPC_RTYPE_NTSTATUS
, cmd_samr_query_group
, NULL
, &ndr_table_samr
, NULL
, "Query group info", "" },
3309 { "queryusergroups", RPC_RTYPE_NTSTATUS
, cmd_samr_query_usergroups
, NULL
, &ndr_table_samr
, NULL
, "Query user groups", "" },
3310 { "queryuseraliases", RPC_RTYPE_NTSTATUS
, cmd_samr_query_useraliases
, NULL
, &ndr_table_samr
, NULL
, "Query user aliases", "" },
3311 { "querygroupmem", RPC_RTYPE_NTSTATUS
, cmd_samr_query_groupmem
, NULL
, &ndr_table_samr
, NULL
, "Query group membership", "" },
3312 { "queryaliasmem", RPC_RTYPE_NTSTATUS
, cmd_samr_query_aliasmem
, NULL
, &ndr_table_samr
, NULL
, "Query alias membership", "" },
3313 { "queryaliasinfo", RPC_RTYPE_NTSTATUS
, cmd_samr_query_aliasinfo
, NULL
, &ndr_table_samr
, NULL
, "Query alias info", "" },
3314 { "deletealias", RPC_RTYPE_NTSTATUS
, cmd_samr_delete_alias
, NULL
, &ndr_table_samr
, NULL
, "Delete an alias", "" },
3315 { "querydispinfo", RPC_RTYPE_NTSTATUS
, cmd_samr_query_dispinfo
, NULL
, &ndr_table_samr
, NULL
, "Query display info", "" },
3316 { "querydispinfo2", RPC_RTYPE_NTSTATUS
, cmd_samr_query_dispinfo2
, NULL
, &ndr_table_samr
, NULL
, "Query display info", "" },
3317 { "querydispinfo3", RPC_RTYPE_NTSTATUS
, cmd_samr_query_dispinfo3
, NULL
, &ndr_table_samr
, NULL
, "Query display info", "" },
3318 { "querydominfo", RPC_RTYPE_NTSTATUS
, cmd_samr_query_dominfo
, NULL
, &ndr_table_samr
, NULL
, "Query domain info", "" },
3319 { "enumdomusers", RPC_RTYPE_NTSTATUS
, cmd_samr_enum_dom_users
, NULL
, &ndr_table_samr
, NULL
, "Enumerate domain users", "" },
3320 { "enumdomgroups", RPC_RTYPE_NTSTATUS
, cmd_samr_enum_dom_groups
, NULL
, &ndr_table_samr
, NULL
, "Enumerate domain groups", "" },
3321 { "enumalsgroups", RPC_RTYPE_NTSTATUS
, cmd_samr_enum_als_groups
, NULL
, &ndr_table_samr
, NULL
, "Enumerate alias groups", "" },
3322 { "enumdomains", RPC_RTYPE_NTSTATUS
, cmd_samr_enum_domains
, NULL
, &ndr_table_samr
, NULL
, "Enumerate domains", "" },
3324 { "createdomuser", RPC_RTYPE_NTSTATUS
, cmd_samr_create_dom_user
, NULL
, &ndr_table_samr
, NULL
, "Create domain user", "" },
3325 { "createdomgroup", RPC_RTYPE_NTSTATUS
, cmd_samr_create_dom_group
, NULL
, &ndr_table_samr
, NULL
, "Create domain group", "" },
3326 { "createdomalias", RPC_RTYPE_NTSTATUS
, cmd_samr_create_dom_alias
, NULL
, &ndr_table_samr
, NULL
, "Create domain alias", "" },
3327 { "samlookupnames", RPC_RTYPE_NTSTATUS
, cmd_samr_lookup_names
, NULL
, &ndr_table_samr
, NULL
, "Look up names", "" },
3328 { "samlookuprids", RPC_RTYPE_NTSTATUS
, cmd_samr_lookup_rids
, NULL
, &ndr_table_samr
, NULL
, "Look up names", "" },
3329 { "deletedomgroup", RPC_RTYPE_NTSTATUS
, cmd_samr_delete_dom_group
, NULL
, &ndr_table_samr
, NULL
, "Delete domain group", "" },
3330 { "deletedomuser", RPC_RTYPE_NTSTATUS
, cmd_samr_delete_dom_user
, NULL
, &ndr_table_samr
, NULL
, "Delete domain user", "" },
3331 { "samquerysecobj", RPC_RTYPE_NTSTATUS
, cmd_samr_query_sec_obj
, NULL
, &ndr_table_samr
, NULL
, "Query SAMR security object", "" },
3332 { "getdompwinfo", RPC_RTYPE_NTSTATUS
, cmd_samr_get_dom_pwinfo
, NULL
, &ndr_table_samr
, NULL
, "Retrieve domain password info", "" },
3333 { "getusrdompwinfo", RPC_RTYPE_NTSTATUS
, cmd_samr_get_usrdom_pwinfo
, NULL
, &ndr_table_samr
, NULL
, "Retrieve user domain password info", "" },
3335 { "lookupdomain", RPC_RTYPE_NTSTATUS
, cmd_samr_lookup_domain
, NULL
, &ndr_table_samr
, NULL
, "Lookup Domain Name", "" },
3336 { "chgpasswd", RPC_RTYPE_NTSTATUS
, cmd_samr_chgpasswd
, NULL
, &ndr_table_samr
, NULL
, "Change user password", "" },
3337 { "chgpasswd2", RPC_RTYPE_NTSTATUS
, cmd_samr_chgpasswd2
, NULL
, &ndr_table_samr
, NULL
, "Change user password", "" },
3338 { "chgpasswd3", RPC_RTYPE_NTSTATUS
, cmd_samr_chgpasswd3
, NULL
, &ndr_table_samr
, NULL
, "Change user password", "" },
3339 { "getdispinfoidx", RPC_RTYPE_NTSTATUS
, cmd_samr_get_dispinfo_idx
, NULL
, &ndr_table_samr
, NULL
, "Get Display Information Index", "" },
3340 { "setuserinfo", RPC_RTYPE_NTSTATUS
, cmd_samr_setuserinfo
, NULL
, &ndr_table_samr
, NULL
, "Set user info", "" },
3341 { "setuserinfo2", RPC_RTYPE_NTSTATUS
, cmd_samr_setuserinfo2
, NULL
, &ndr_table_samr
, NULL
, "Set user info2", "" },