2 Unix SMB/CIFS implementation.
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
7 Copyright (C) Guenther Deschner 2008
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpcclient.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_lsa.h"
28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "rpc_client/init_lsa.h"
31 #include "../libcli/security/security.h"
33 /* useful function to allow entering a name instead of a SID and
34 * looking it up automatically */
35 static NTSTATUS
name_to_sid(struct rpc_pipe_client
*cli
,
37 struct dom_sid
*sid
, const char *name
)
39 struct policy_handle pol
;
40 enum lsa_SidType
*sid_types
;
41 NTSTATUS status
, result
;
43 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
45 /* maybe its a raw SID */
46 if (strncmp(name
, "S-", 2) == 0 &&
47 string_to_sid(sid
, name
)) {
51 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
52 SEC_FLAG_MAXIMUM_ALLOWED
,
54 if (!NT_STATUS_IS_OK(status
))
57 status
= rpccli_lsa_lookup_names(cli
, mem_ctx
, &pol
, 1, &name
, NULL
, 1, &sids
, &sid_types
);
58 if (!NT_STATUS_IS_OK(status
))
61 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
69 static void display_query_info_1(struct lsa_AuditLogInfo
*r
)
71 d_printf("percent_full:\t%d\n", r
->percent_full
);
72 d_printf("maximum_log_size:\t%d\n", r
->maximum_log_size
);
73 d_printf("retention_time:\t%lld\n", (long long)r
->retention_time
);
74 d_printf("shutdown_in_progress:\t%d\n", r
->shutdown_in_progress
);
75 d_printf("time_to_shutdown:\t%lld\n", (long long)r
->time_to_shutdown
);
76 d_printf("next_audit_record:\t%d\n", r
->next_audit_record
);
79 static void display_query_info_2(struct lsa_AuditEventsInfo
*r
)
82 d_printf("Auditing enabled:\t%d\n", r
->auditing_mode
);
83 d_printf("Auditing categories:\t%d\n", r
->count
);
84 d_printf("Auditsettings:\n");
85 for (i
=0; i
<r
->count
; i
++) {
86 const char *val
= audit_policy_str(talloc_tos(), r
->settings
[i
]);
87 const char *policy
= audit_description_str(i
);
88 d_printf("%s:\t%s\n", policy
, val
);
92 static void display_query_info_3(struct lsa_DomainInfo
*r
)
94 d_printf("Domain Name: %s\n", r
->name
.string
);
95 d_printf("Domain Sid: %s\n", sid_string_tos(r
->sid
));
98 static void display_query_info_5(struct lsa_DomainInfo
*r
)
100 d_printf("Domain Name: %s\n", r
->name
.string
);
101 d_printf("Domain Sid: %s\n", sid_string_tos(r
->sid
));
104 static void display_query_info_10(struct lsa_AuditFullSetInfo
*r
)
106 d_printf("Shutdown on full: %d\n", r
->shutdown_on_full
);
109 static void display_query_info_11(struct lsa_AuditFullQueryInfo
*r
)
111 d_printf("Shutdown on full: %d\n", r
->shutdown_on_full
);
112 d_printf("Log is full: %d\n", r
->log_is_full
);
115 static void display_query_info_12(struct lsa_DnsDomainInfo
*r
)
117 d_printf("Domain NetBios Name: %s\n", r
->name
.string
);
118 d_printf("Domain DNS Name: %s\n", r
->dns_domain
.string
);
119 d_printf("Domain Forest Name: %s\n", r
->dns_forest
.string
);
120 d_printf("Domain Sid: %s\n", sid_string_tos(r
->sid
));
121 d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
125 static void display_lsa_query_info(union lsa_PolicyInformation
*info
,
126 enum lsa_PolicyInfo level
)
130 display_query_info_1(&info
->audit_log
);
133 display_query_info_2(&info
->audit_events
);
136 display_query_info_3(&info
->domain
);
139 display_query_info_5(&info
->account_domain
);
142 display_query_info_10(&info
->auditfullset
);
145 display_query_info_11(&info
->auditfullquery
);
148 display_query_info_12(&info
->dns
);
151 printf("can't display info level: %d\n", level
);
156 static NTSTATUS
cmd_lsa_query_info_policy(struct rpc_pipe_client
*cli
,
157 TALLOC_CTX
*mem_ctx
, int argc
,
160 struct policy_handle pol
;
161 NTSTATUS status
, result
;
162 union lsa_PolicyInformation
*info
= NULL
;
163 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
165 uint32 info_class
= 3;
168 printf("Usage: %s [info_class]\n", argv
[0]);
173 info_class
= atoi(argv
[1]);
175 switch (info_class
) {
177 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
178 SEC_FLAG_MAXIMUM_ALLOWED
,
181 if (!NT_STATUS_IS_OK(status
))
184 status
= dcerpc_lsa_QueryInfoPolicy2(b
, mem_ctx
,
191 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
192 SEC_FLAG_MAXIMUM_ALLOWED
,
195 if (!NT_STATUS_IS_OK(status
))
198 status
= dcerpc_lsa_QueryInfoPolicy(b
, mem_ctx
,
205 if (!NT_STATUS_IS_OK(status
)) {
209 if (NT_STATUS_IS_OK(result
)) {
210 display_lsa_query_info(info
, info_class
);
213 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
219 /* Resolve a list of names to a list of sids */
221 static NTSTATUS
cmd_lsa_lookup_names(struct rpc_pipe_client
*cli
,
222 TALLOC_CTX
*mem_ctx
, int argc
,
225 struct policy_handle pol
;
226 NTSTATUS status
, result
;
227 struct dom_sid
*sids
;
228 enum lsa_SidType
*types
;
230 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
233 printf("Usage: %s [name1 [name2 [...]]]\n", argv
[0]);
237 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
238 SEC_FLAG_MAXIMUM_ALLOWED
,
241 if (!NT_STATUS_IS_OK(status
))
244 status
= rpccli_lsa_lookup_names(cli
, mem_ctx
, &pol
, argc
- 1,
245 (const char**)(argv
+ 1), NULL
, 1, &sids
, &types
);
247 if (!NT_STATUS_IS_OK(status
) && NT_STATUS_V(status
) !=
248 NT_STATUS_V(STATUS_SOME_UNMAPPED
))
251 status
= NT_STATUS_OK
;
255 for (i
= 0; i
< (argc
- 1); i
++) {
257 sid_to_fstring(sid_str
, &sids
[i
]);
258 printf("%s %s (%s: %d)\n", argv
[i
+ 1], sid_str
,
259 sid_type_lookup(types
[i
]), types
[i
]);
262 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
268 /* Resolve a list of names to a list of sids */
270 static NTSTATUS
cmd_lsa_lookup_names_level(struct rpc_pipe_client
*cli
,
271 TALLOC_CTX
*mem_ctx
, int argc
,
274 struct policy_handle pol
;
275 NTSTATUS status
, result
;
276 struct dom_sid
*sids
;
277 enum lsa_SidType
*types
;
279 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
282 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv
[0]);
286 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
287 SEC_FLAG_MAXIMUM_ALLOWED
,
290 if (!NT_STATUS_IS_OK(status
))
293 level
= atoi(argv
[1]);
295 status
= rpccli_lsa_lookup_names(cli
, mem_ctx
, &pol
, argc
- 2,
296 (const char**)(argv
+ 2), NULL
, level
, &sids
, &types
);
298 if (!NT_STATUS_IS_OK(status
) && NT_STATUS_V(status
) !=
299 NT_STATUS_V(STATUS_SOME_UNMAPPED
))
302 status
= NT_STATUS_OK
;
306 for (i
= 0; i
< (argc
- 2); i
++) {
308 sid_to_fstring(sid_str
, &sids
[i
]);
309 printf("%s %s (%s: %d)\n", argv
[i
+ 2], sid_str
,
310 sid_type_lookup(types
[i
]), types
[i
]);
313 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
319 static NTSTATUS
cmd_lsa_lookup_names4(struct rpc_pipe_client
*cli
,
320 TALLOC_CTX
*mem_ctx
, int argc
,
323 NTSTATUS status
, result
;
326 struct lsa_String
*names
;
327 struct lsa_RefDomainList
*domains
;
328 struct lsa_TransSidArray3 sids
;
331 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
334 printf("Usage: %s [name1 [name2 [...]]]\n", argv
[0]);
341 names
= talloc_array(mem_ctx
, struct lsa_String
, num_names
);
342 NT_STATUS_HAVE_NO_MEMORY(names
);
344 for (i
=0; i
< num_names
; i
++) {
345 init_lsa_String(&names
[i
], argv
[i
+1]);
348 status
= dcerpc_lsa_LookupNames4(b
, mem_ctx
,
358 if (!NT_STATUS_IS_OK(status
)) {
361 if (!NT_STATUS_IS_OK(result
)) {
365 for (i
= 0; i
< sids
.count
; i
++) {
367 sid_to_fstring(sid_str
, sids
.sids
[i
].sid
);
368 printf("%s %s (%s: %d)\n", argv
[i
+1], sid_str
,
369 sid_type_lookup(sids
.sids
[i
].sid_type
),
370 sids
.sids
[i
].sid_type
);
376 /* Resolve a list of SIDs to a list of names */
378 static NTSTATUS
cmd_lsa_lookup_sids(struct rpc_pipe_client
*cli
, TALLOC_CTX
*mem_ctx
,
379 int argc
, const char **argv
)
381 struct policy_handle pol
;
382 NTSTATUS status
, result
;
383 struct dom_sid
*sids
;
386 enum lsa_SidType
*types
;
388 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
391 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv
[0]);
395 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
396 SEC_FLAG_MAXIMUM_ALLOWED
,
399 if (!NT_STATUS_IS_OK(status
))
402 /* Convert arguments to sids */
404 sids
= TALLOC_ARRAY(mem_ctx
, struct dom_sid
, argc
- 1);
407 printf("could not allocate memory for %d sids\n", argc
- 1);
411 for (i
= 0; i
< argc
- 1; i
++)
412 if (!string_to_sid(&sids
[i
], argv
[i
+ 1])) {
413 status
= NT_STATUS_INVALID_SID
;
417 /* Lookup the SIDs */
419 status
= rpccli_lsa_lookup_sids(cli
, mem_ctx
, &pol
, argc
- 1, sids
,
420 &domains
, &names
, &types
);
422 if (!NT_STATUS_IS_OK(status
) && NT_STATUS_V(status
) !=
423 NT_STATUS_V(STATUS_SOME_UNMAPPED
))
426 status
= NT_STATUS_OK
;
430 for (i
= 0; i
< (argc
- 1); i
++) {
433 sid_to_fstring(sid_str
, &sids
[i
]);
434 printf("%s %s\\%s (%d)\n", sid_str
,
435 domains
[i
] ? domains
[i
] : "*unknown*",
436 names
[i
] ? names
[i
] : "*unknown*", types
[i
]);
439 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
445 /* Resolve a list of SIDs to a list of names */
447 static NTSTATUS
cmd_lsa_lookup_sids3(struct rpc_pipe_client
*cli
,
449 int argc
, const char **argv
)
451 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
, result
;
453 struct lsa_SidArray sids
;
454 struct lsa_RefDomainList
*domains
;
455 struct lsa_TransNameArray2 names
;
457 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
460 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv
[0]);
466 /* Convert arguments to sids */
468 sids
.num_sids
= argc
-1;
469 sids
.sids
= talloc_array(mem_ctx
, struct lsa_SidPtr
, sids
.num_sids
);
471 printf("could not allocate memory for %d sids\n", sids
.num_sids
);
475 for (i
= 0; i
< sids
.num_sids
; i
++) {
476 sids
.sids
[i
].sid
= talloc(sids
.sids
, struct dom_sid
);
477 if (sids
.sids
[i
].sid
== NULL
) {
478 status
= NT_STATUS_NO_MEMORY
;
481 if (!string_to_sid(sids
.sids
[i
].sid
, argv
[i
+1])) {
482 status
= NT_STATUS_INVALID_SID
;
487 /* Lookup the SIDs */
488 status
= dcerpc_lsa_LookupSids3(b
, mem_ctx
,
497 if (!NT_STATUS_IS_OK(status
)) {
500 if (!NT_STATUS_IS_OK(result
) && NT_STATUS_V(result
) !=
501 NT_STATUS_V(STATUS_SOME_UNMAPPED
)) {
506 status
= NT_STATUS_OK
;
510 for (i
= 0; i
< count
; i
++) {
513 sid_to_fstring(sid_str
, sids
.sids
[i
].sid
);
514 printf("%s %s (%d)\n", sid_str
,
515 names
.names
[i
].name
.string
,
516 names
.names
[i
].sid_type
);
524 /* Enumerate list of trusted domains */
526 static NTSTATUS
cmd_lsa_enum_trust_dom(struct rpc_pipe_client
*cli
,
527 TALLOC_CTX
*mem_ctx
, int argc
,
530 struct policy_handle pol
;
531 NTSTATUS status
, result
;
532 struct lsa_DomainList domain_list
;
533 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
535 /* defaults, but may be changed using params */
538 uint32_t max_size
= (uint32_t)-1;
541 printf("Usage: %s [enum context (0)]\n", argv
[0]);
545 if (argc
== 2 && argv
[1]) {
546 enum_ctx
= atoi(argv
[2]);
549 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
550 LSA_POLICY_VIEW_LOCAL_INFORMATION
,
553 if (!NT_STATUS_IS_OK(status
))
556 status
= STATUS_MORE_ENTRIES
;
558 while (NT_STATUS_EQUAL(status
, STATUS_MORE_ENTRIES
)) {
560 /* Lookup list of trusted domains */
562 status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
568 if (!NT_STATUS_IS_OK(status
)) {
571 if (!NT_STATUS_IS_OK(result
) &&
572 !NT_STATUS_EQUAL(result
, NT_STATUS_NO_MORE_ENTRIES
) &&
573 !NT_STATUS_EQUAL(result
, STATUS_MORE_ENTRIES
)) {
578 /* Print results: list of names and sids returned in this
580 for (i
= 0; i
< domain_list
.count
; i
++) {
583 sid_to_fstring(sid_str
, domain_list
.domains
[i
].sid
);
585 domain_list
.domains
[i
].name
.string
?
586 domain_list
.domains
[i
].name
.string
: "*unknown*",
591 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
596 /* Enumerates privileges */
598 static NTSTATUS
cmd_lsa_enum_privilege(struct rpc_pipe_client
*cli
,
599 TALLOC_CTX
*mem_ctx
, int argc
,
602 struct policy_handle pol
;
603 NTSTATUS status
, result
;
604 struct lsa_PrivArray priv_array
;
605 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
607 uint32 enum_context
=0;
608 uint32 pref_max_length
=0x1000;
612 printf("Usage: %s [enum context] [max length]\n", argv
[0]);
617 enum_context
=atoi(argv
[1]);
620 pref_max_length
=atoi(argv
[2]);
622 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
623 SEC_FLAG_MAXIMUM_ALLOWED
,
626 if (!NT_STATUS_IS_OK(status
))
629 status
= dcerpc_lsa_EnumPrivs(b
, mem_ctx
,
635 if (!NT_STATUS_IS_OK(status
))
637 if (!NT_STATUS_IS_OK(result
)) {
643 printf("found %d privileges\n\n", priv_array
.count
);
645 for (i
= 0; i
< priv_array
.count
; i
++) {
646 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
647 priv_array
.privs
[i
].name
.string
? priv_array
.privs
[i
].name
.string
: "*unknown*",
648 priv_array
.privs
[i
].luid
.high
,
649 priv_array
.privs
[i
].luid
.low
,
650 priv_array
.privs
[i
].luid
.high
,
651 priv_array
.privs
[i
].luid
.low
);
654 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
659 /* Get privilege name */
661 static NTSTATUS
cmd_lsa_get_dispname(struct rpc_pipe_client
*cli
,
662 TALLOC_CTX
*mem_ctx
, int argc
,
665 struct policy_handle pol
;
666 NTSTATUS status
, result
;
667 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
670 uint16 lang_id_sys
=0;
672 struct lsa_String lsa_name
;
673 struct lsa_StringLarge
*description
= NULL
;
676 printf("Usage: %s privilege name\n", argv
[0]);
680 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
681 SEC_FLAG_MAXIMUM_ALLOWED
,
684 if (!NT_STATUS_IS_OK(status
))
687 init_lsa_String(&lsa_name
, argv
[1]);
689 status
= dcerpc_lsa_LookupPrivDisplayName(b
, mem_ctx
,
697 if (!NT_STATUS_IS_OK(status
))
699 if (!NT_STATUS_IS_OK(result
)) {
705 printf("%s -> %s (language: 0x%x)\n", argv
[1], description
->string
, lang_id_desc
);
707 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
712 /* Enumerate the LSA SIDS */
714 static NTSTATUS
cmd_lsa_enum_sids(struct rpc_pipe_client
*cli
,
715 TALLOC_CTX
*mem_ctx
, int argc
,
718 struct policy_handle pol
;
719 NTSTATUS status
, result
;
720 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
722 uint32 enum_context
=0;
723 uint32 pref_max_length
=0x1000;
724 struct lsa_SidArray sid_array
;
728 printf("Usage: %s [enum context] [max length]\n", argv
[0]);
733 enum_context
=atoi(argv
[1]);
736 pref_max_length
=atoi(argv
[2]);
738 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
739 SEC_FLAG_MAXIMUM_ALLOWED
,
742 if (!NT_STATUS_IS_OK(status
))
745 status
= dcerpc_lsa_EnumAccounts(b
, mem_ctx
,
751 if (!NT_STATUS_IS_OK(status
))
753 if (!NT_STATUS_IS_OK(result
)) {
759 printf("found %d SIDs\n\n", sid_array
.num_sids
);
761 for (i
= 0; i
< sid_array
.num_sids
; i
++) {
764 sid_to_fstring(sid_str
, sid_array
.sids
[i
].sid
);
765 printf("%s\n", sid_str
);
768 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
773 /* Create a new account */
775 static NTSTATUS
cmd_lsa_create_account(struct rpc_pipe_client
*cli
,
776 TALLOC_CTX
*mem_ctx
, int argc
,
779 struct policy_handle dom_pol
;
780 struct policy_handle user_pol
;
781 NTSTATUS status
, result
;
782 uint32 des_access
= 0x000f000f;
783 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
788 printf("Usage: %s SID\n", argv
[0]);
792 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
793 if (!NT_STATUS_IS_OK(status
))
796 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
797 SEC_FLAG_MAXIMUM_ALLOWED
,
800 if (!NT_STATUS_IS_OK(status
))
803 status
= dcerpc_lsa_CreateAccount(b
, mem_ctx
,
809 if (!NT_STATUS_IS_OK(status
))
811 if (!NT_STATUS_IS_OK(result
)) {
816 printf("Account for SID %s successfully created\n\n", argv
[1]);
817 status
= NT_STATUS_OK
;
819 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
825 /* Enumerate the privileges of an SID */
827 static NTSTATUS
cmd_lsa_enum_privsaccounts(struct rpc_pipe_client
*cli
,
828 TALLOC_CTX
*mem_ctx
, int argc
,
831 struct policy_handle dom_pol
;
832 struct policy_handle user_pol
;
833 NTSTATUS status
, result
;
834 uint32 access_desired
= 0x000f000f;
836 struct lsa_PrivilegeSet
*privs
= NULL
;
838 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
841 printf("Usage: %s SID\n", argv
[0]);
845 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
846 if (!NT_STATUS_IS_OK(status
))
849 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
850 SEC_FLAG_MAXIMUM_ALLOWED
,
853 if (!NT_STATUS_IS_OK(status
))
856 status
= dcerpc_lsa_OpenAccount(b
, mem_ctx
,
862 if (!NT_STATUS_IS_OK(status
))
864 if (!NT_STATUS_IS_OK(result
)) {
869 status
= dcerpc_lsa_EnumPrivsAccount(b
, mem_ctx
,
873 if (!NT_STATUS_IS_OK(status
))
875 if (!NT_STATUS_IS_OK(result
)) {
881 printf("found %d privileges for SID %s\n\n", privs
->count
, argv
[1]);
882 printf("high\tlow\tattribute\n");
884 for (i
= 0; i
< privs
->count
; i
++) {
885 printf("%u\t%u\t%u\n",
886 privs
->set
[i
].luid
.high
,
887 privs
->set
[i
].luid
.low
,
888 privs
->set
[i
].attribute
);
891 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
897 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
899 static NTSTATUS
cmd_lsa_enum_acct_rights(struct rpc_pipe_client
*cli
,
900 TALLOC_CTX
*mem_ctx
, int argc
,
903 struct policy_handle dom_pol
;
904 NTSTATUS status
, result
;
906 struct lsa_RightSet rights
;
907 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
912 printf("Usage: %s SID\n", argv
[0]);
916 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
917 if (!NT_STATUS_IS_OK(status
))
920 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
921 SEC_FLAG_MAXIMUM_ALLOWED
,
924 if (!NT_STATUS_IS_OK(status
))
927 status
= dcerpc_lsa_EnumAccountRights(b
, mem_ctx
,
932 if (!NT_STATUS_IS_OK(status
))
934 if (!NT_STATUS_IS_OK(result
)) {
939 printf("found %d privileges for SID %s\n", rights
.count
,
940 sid_string_tos(&sid
));
942 for (i
= 0; i
< rights
.count
; i
++) {
943 printf("\t%s\n", rights
.names
[i
].string
);
946 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
952 /* add some privileges to a SID via LsaAddAccountRights */
954 static NTSTATUS
cmd_lsa_add_acct_rights(struct rpc_pipe_client
*cli
,
955 TALLOC_CTX
*mem_ctx
, int argc
,
958 struct policy_handle dom_pol
;
959 NTSTATUS status
, result
;
960 struct lsa_RightSet rights
;
963 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
966 printf("Usage: %s SID [rights...]\n", argv
[0]);
970 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
971 if (!NT_STATUS_IS_OK(status
))
974 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
975 SEC_FLAG_MAXIMUM_ALLOWED
,
978 if (!NT_STATUS_IS_OK(status
))
981 rights
.count
= argc
-2;
982 rights
.names
= TALLOC_ARRAY(mem_ctx
, struct lsa_StringLarge
,
985 return NT_STATUS_NO_MEMORY
;
988 for (i
=0; i
<argc
-2; i
++) {
989 init_lsa_StringLarge(&rights
.names
[i
], argv
[i
+2]);
992 status
= dcerpc_lsa_AddAccountRights(b
, mem_ctx
,
997 if (!NT_STATUS_IS_OK(status
))
999 if (!NT_STATUS_IS_OK(result
)) {
1004 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
1010 /* remove some privileges to a SID via LsaRemoveAccountRights */
1012 static NTSTATUS
cmd_lsa_remove_acct_rights(struct rpc_pipe_client
*cli
,
1013 TALLOC_CTX
*mem_ctx
, int argc
,
1016 struct policy_handle dom_pol
;
1017 NTSTATUS status
, result
;
1018 struct lsa_RightSet rights
;
1021 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1024 printf("Usage: %s SID [rights...]\n", argv
[0]);
1025 return NT_STATUS_OK
;
1028 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
1029 if (!NT_STATUS_IS_OK(status
))
1032 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1033 SEC_FLAG_MAXIMUM_ALLOWED
,
1036 if (!NT_STATUS_IS_OK(status
))
1039 rights
.count
= argc
-2;
1040 rights
.names
= TALLOC_ARRAY(mem_ctx
, struct lsa_StringLarge
,
1042 if (!rights
.names
) {
1043 return NT_STATUS_NO_MEMORY
;
1046 for (i
=0; i
<argc
-2; i
++) {
1047 init_lsa_StringLarge(&rights
.names
[i
], argv
[i
+2]);
1050 status
= dcerpc_lsa_RemoveAccountRights(b
, mem_ctx
,
1056 if (!NT_STATUS_IS_OK(status
))
1058 if (!NT_STATUS_IS_OK(result
)) {
1063 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
1070 /* Get a privilege value given its name */
1072 static NTSTATUS
cmd_lsa_lookup_priv_value(struct rpc_pipe_client
*cli
,
1073 TALLOC_CTX
*mem_ctx
, int argc
,
1076 struct policy_handle pol
;
1077 NTSTATUS status
, result
;
1078 struct lsa_LUID luid
;
1079 struct lsa_String name
;
1080 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1083 printf("Usage: %s name\n", argv
[0]);
1084 return NT_STATUS_OK
;
1087 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1088 SEC_FLAG_MAXIMUM_ALLOWED
,
1091 if (!NT_STATUS_IS_OK(status
))
1094 init_lsa_String(&name
, argv
[1]);
1096 status
= dcerpc_lsa_LookupPrivValue(b
, mem_ctx
,
1101 if (!NT_STATUS_IS_OK(status
))
1103 if (!NT_STATUS_IS_OK(result
)) {
1110 printf("%u:%u (0x%x:0x%x)\n", luid
.high
, luid
.low
, luid
.high
, luid
.low
);
1112 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1117 /* Query LSA security object */
1119 static NTSTATUS
cmd_lsa_query_secobj(struct rpc_pipe_client
*cli
,
1120 TALLOC_CTX
*mem_ctx
, int argc
,
1123 struct policy_handle pol
;
1124 NTSTATUS status
, result
;
1125 struct sec_desc_buf
*sdb
;
1126 uint32 sec_info
= SECINFO_DACL
;
1127 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1129 if (argc
< 1 || argc
> 2) {
1130 printf("Usage: %s [sec_info]\n", argv
[0]);
1131 return NT_STATUS_OK
;
1134 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1135 SEC_FLAG_MAXIMUM_ALLOWED
,
1139 sscanf(argv
[1], "%x", &sec_info
);
1141 if (!NT_STATUS_IS_OK(status
))
1144 status
= dcerpc_lsa_QuerySecurity(b
, mem_ctx
,
1149 if (!NT_STATUS_IS_OK(status
))
1151 if (!NT_STATUS_IS_OK(result
)) {
1158 display_sec_desc(sdb
->sd
);
1160 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1165 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword
*p
,
1166 uint8_t session_key
[16])
1168 char *pwd
, *pwd_old
;
1170 DATA_BLOB data
= data_blob_const(p
->password
->data
, p
->password
->length
);
1171 DATA_BLOB data_old
= data_blob_const(p
->old_password
->data
, p
->old_password
->length
);
1172 DATA_BLOB session_key_blob
= data_blob_const(session_key
, sizeof(session_key
));
1174 pwd
= sess_decrypt_string(talloc_tos(), &data
, &session_key_blob
);
1175 pwd_old
= sess_decrypt_string(talloc_tos(), &data_old
, &session_key_blob
);
1177 d_printf("Password:\t%s\n", pwd
);
1178 d_printf("Old Password:\t%s\n", pwd_old
);
1181 talloc_free(pwd_old
);
1184 static void display_trust_dom_info(TALLOC_CTX
*mem_ctx
,
1185 union lsa_TrustedDomainInfo
*info
,
1186 enum lsa_TrustDomInfoEnum info_class
,
1187 uint8_t nt_hash
[16])
1189 switch (info_class
) {
1190 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD
:
1191 display_trust_dom_info_4(&info
->password
, nt_hash
);
1194 const char *str
= NULL
;
1195 str
= NDR_PRINT_UNION_STRING(mem_ctx
,
1196 lsa_TrustedDomainInfo
,
1199 d_printf("%s\n", str
);
1206 static NTSTATUS
cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client
*cli
,
1207 TALLOC_CTX
*mem_ctx
, int argc
,
1210 struct policy_handle pol
;
1211 NTSTATUS status
, result
;
1212 struct dom_sid dom_sid
;
1213 uint32 access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1214 union lsa_TrustedDomainInfo
*info
= NULL
;
1215 enum lsa_TrustDomInfoEnum info_class
= 1;
1216 uint8_t nt_hash
[16];
1217 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1219 if (argc
> 3 || argc
< 2) {
1220 printf("Usage: %s [sid] [info_class]\n", argv
[0]);
1221 return NT_STATUS_OK
;
1224 if (!string_to_sid(&dom_sid
, argv
[1]))
1225 return NT_STATUS_NO_MEMORY
;
1228 info_class
= atoi(argv
[2]);
1230 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
, access_mask
, &pol
);
1232 if (!NT_STATUS_IS_OK(status
))
1235 status
= dcerpc_lsa_QueryTrustedDomainInfoBySid(b
, mem_ctx
,
1241 if (!NT_STATUS_IS_OK(status
))
1243 if (!NT_STATUS_IS_OK(result
)) {
1248 if (!rpccli_get_pwd_hash(cli
, nt_hash
)) {
1249 d_fprintf(stderr
, "Could not get pwd hash\n");
1253 display_trust_dom_info(mem_ctx
, info
, info_class
, nt_hash
);
1256 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1261 static NTSTATUS
cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client
*cli
,
1262 TALLOC_CTX
*mem_ctx
, int argc
,
1265 struct policy_handle pol
;
1266 NTSTATUS status
, result
;
1267 uint32 access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1268 union lsa_TrustedDomainInfo
*info
= NULL
;
1269 enum lsa_TrustDomInfoEnum info_class
= 1;
1270 struct lsa_String trusted_domain
;
1271 uint8_t nt_hash
[16];
1272 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1274 if (argc
> 3 || argc
< 2) {
1275 printf("Usage: %s [name] [info_class]\n", argv
[0]);
1276 return NT_STATUS_OK
;
1280 info_class
= atoi(argv
[2]);
1282 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
, access_mask
, &pol
);
1284 if (!NT_STATUS_IS_OK(status
))
1287 init_lsa_String(&trusted_domain
, argv
[1]);
1289 status
= dcerpc_lsa_QueryTrustedDomainInfoByName(b
, mem_ctx
,
1295 if (!NT_STATUS_IS_OK(status
))
1297 if (!NT_STATUS_IS_OK(result
)) {
1302 if (!rpccli_get_pwd_hash(cli
, nt_hash
)) {
1303 d_fprintf(stderr
, "Could not get pwd hash\n");
1307 display_trust_dom_info(mem_ctx
, info
, info_class
, nt_hash
);
1310 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1315 static NTSTATUS
cmd_lsa_query_trustdominfo(struct rpc_pipe_client
*cli
,
1316 TALLOC_CTX
*mem_ctx
, int argc
,
1319 struct policy_handle pol
, trustdom_pol
;
1320 NTSTATUS status
, result
;
1321 uint32 access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
1322 union lsa_TrustedDomainInfo
*info
= NULL
;
1323 struct dom_sid dom_sid
;
1324 enum lsa_TrustDomInfoEnum info_class
= 1;
1325 uint8_t nt_hash
[16];
1326 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1328 if (argc
> 3 || argc
< 2) {
1329 printf("Usage: %s [sid] [info_class]\n", argv
[0]);
1330 return NT_STATUS_OK
;
1333 if (!string_to_sid(&dom_sid
, argv
[1]))
1334 return NT_STATUS_NO_MEMORY
;
1338 info_class
= atoi(argv
[2]);
1340 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
, access_mask
, &pol
);
1342 if (!NT_STATUS_IS_OK(status
))
1345 status
= dcerpc_lsa_OpenTrustedDomain(b
, mem_ctx
,
1351 if (!NT_STATUS_IS_OK(status
))
1353 if (!NT_STATUS_IS_OK(result
)) {
1358 status
= dcerpc_lsa_QueryTrustedDomainInfo(b
, mem_ctx
,
1363 if (!NT_STATUS_IS_OK(status
))
1365 if (!NT_STATUS_IS_OK(result
)) {
1370 if (!rpccli_get_pwd_hash(cli
, nt_hash
)) {
1371 d_fprintf(stderr
, "Could not get pwd hash\n");
1375 display_trust_dom_info(mem_ctx
, info
, info_class
, nt_hash
);
1378 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1383 static NTSTATUS
cmd_lsa_get_username(struct rpc_pipe_client
*cli
,
1384 TALLOC_CTX
*mem_ctx
, int argc
,
1387 struct policy_handle pol
;
1388 NTSTATUS status
, result
;
1389 const char *servername
= cli
->desthost
;
1390 struct lsa_String
*account_name
= NULL
;
1391 struct lsa_String
*authority_name
= NULL
;
1392 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1395 printf("Usage: %s servername\n", argv
[0]);
1396 return NT_STATUS_OK
;
1399 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, true,
1400 SEC_FLAG_MAXIMUM_ALLOWED
,
1403 if (!NT_STATUS_IS_OK(status
)) {
1407 status
= dcerpc_lsa_GetUserName(b
, mem_ctx
,
1412 if (!NT_STATUS_IS_OK(status
)) {
1415 if (!NT_STATUS_IS_OK(result
)) {
1422 printf("Account Name: %s, Authority Name: %s\n",
1423 account_name
->string
, authority_name
? authority_name
->string
:
1426 dcerpc_lsa_Close(b
, mem_ctx
, &pol
, &result
);
1431 static NTSTATUS
cmd_lsa_add_priv(struct rpc_pipe_client
*cli
,
1432 TALLOC_CTX
*mem_ctx
, int argc
,
1435 struct policy_handle dom_pol
, user_pol
;
1436 NTSTATUS status
, result
;
1437 struct lsa_PrivilegeSet privs
;
1438 struct lsa_LUIDAttribute
*set
= NULL
;
1441 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1446 printf("Usage: %s SID [rights...]\n", argv
[0]);
1447 return NT_STATUS_OK
;
1450 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
1451 if (!NT_STATUS_IS_OK(status
)) {
1455 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1456 SEC_FLAG_MAXIMUM_ALLOWED
,
1459 if (!NT_STATUS_IS_OK(status
)) {
1463 status
= dcerpc_lsa_OpenAccount(b
, mem_ctx
,
1466 SEC_FLAG_MAXIMUM_ALLOWED
,
1469 if (!NT_STATUS_IS_OK(status
)) {
1472 if (!NT_STATUS_IS_OK(result
)) {
1477 for (i
=2; i
<argc
; i
++) {
1479 struct lsa_String priv_name
;
1480 struct lsa_LUID luid
;
1482 init_lsa_String(&priv_name
, argv
[i
]);
1484 status
= dcerpc_lsa_LookupPrivValue(b
, mem_ctx
,
1489 if (!NT_STATUS_IS_OK(status
)) {
1492 if (!NT_STATUS_IS_OK(result
)) {
1498 set
= TALLOC_REALLOC_ARRAY(mem_ctx
, set
,
1499 struct lsa_LUIDAttribute
,
1502 return NT_STATUS_NO_MEMORY
;
1505 set
[privs
.count
-1].luid
= luid
;
1506 set
[privs
.count
-1].attribute
= 0;
1511 status
= dcerpc_lsa_AddPrivilegesToAccount(b
, mem_ctx
,
1515 if (!NT_STATUS_IS_OK(status
)) {
1518 if (!NT_STATUS_IS_OK(result
)) {
1523 dcerpc_lsa_Close(b
, mem_ctx
, &user_pol
, &result
);
1524 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
1529 static NTSTATUS
cmd_lsa_del_priv(struct rpc_pipe_client
*cli
,
1530 TALLOC_CTX
*mem_ctx
, int argc
,
1533 struct policy_handle dom_pol
, user_pol
;
1534 NTSTATUS status
, result
;
1535 struct lsa_PrivilegeSet privs
;
1536 struct lsa_LUIDAttribute
*set
= NULL
;
1539 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1544 printf("Usage: %s SID [rights...]\n", argv
[0]);
1545 return NT_STATUS_OK
;
1548 status
= name_to_sid(cli
, mem_ctx
, &sid
, argv
[1]);
1549 if (!NT_STATUS_IS_OK(status
)) {
1553 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1554 SEC_FLAG_MAXIMUM_ALLOWED
,
1557 if (!NT_STATUS_IS_OK(status
)) {
1561 status
= dcerpc_lsa_OpenAccount(b
, mem_ctx
,
1564 SEC_FLAG_MAXIMUM_ALLOWED
,
1567 if (!NT_STATUS_IS_OK(status
)) {
1570 if (!NT_STATUS_IS_OK(result
)) {
1575 for (i
=2; i
<argc
; i
++) {
1577 struct lsa_String priv_name
;
1578 struct lsa_LUID luid
;
1580 init_lsa_String(&priv_name
, argv
[i
]);
1582 status
= dcerpc_lsa_LookupPrivValue(b
, mem_ctx
,
1587 if (!NT_STATUS_IS_OK(status
)) {
1590 if (!NT_STATUS_IS_OK(result
)) {
1596 set
= TALLOC_REALLOC_ARRAY(mem_ctx
, set
,
1597 struct lsa_LUIDAttribute
,
1600 return NT_STATUS_NO_MEMORY
;
1603 set
[privs
.count
-1].luid
= luid
;
1604 set
[privs
.count
-1].attribute
= 0;
1610 status
= dcerpc_lsa_RemovePrivilegesFromAccount(b
, mem_ctx
,
1615 if (!NT_STATUS_IS_OK(status
)) {
1618 if (!NT_STATUS_IS_OK(result
)) {
1623 dcerpc_lsa_Close(b
, mem_ctx
, &user_pol
, &result
);
1624 dcerpc_lsa_Close(b
, mem_ctx
, &dom_pol
, &result
);
1629 static NTSTATUS
cmd_lsa_create_secret(struct rpc_pipe_client
*cli
,
1630 TALLOC_CTX
*mem_ctx
, int argc
,
1633 NTSTATUS status
, result
;
1634 struct policy_handle handle
, sec_handle
;
1635 struct lsa_String name
;
1636 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1639 printf("Usage: %s name\n", argv
[0]);
1640 return NT_STATUS_OK
;
1643 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1645 SEC_FLAG_MAXIMUM_ALLOWED
,
1647 if (!NT_STATUS_IS_OK(status
)) {
1651 init_lsa_String(&name
, argv
[1]);
1653 status
= dcerpc_lsa_CreateSecret(b
, mem_ctx
,
1656 SEC_FLAG_MAXIMUM_ALLOWED
,
1659 if (!NT_STATUS_IS_OK(status
)) {
1662 if (!NT_STATUS_IS_OK(result
)) {
1668 if (is_valid_policy_hnd(&sec_handle
)) {
1669 dcerpc_lsa_Close(b
, mem_ctx
, &sec_handle
, &result
);
1671 if (is_valid_policy_hnd(&handle
)) {
1672 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
1678 static NTSTATUS
cmd_lsa_delete_secret(struct rpc_pipe_client
*cli
,
1679 TALLOC_CTX
*mem_ctx
, int argc
,
1682 NTSTATUS status
, result
;
1683 struct policy_handle handle
, sec_handle
;
1684 struct lsa_String name
;
1685 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1688 printf("Usage: %s name\n", argv
[0]);
1689 return NT_STATUS_OK
;
1692 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1694 SEC_FLAG_MAXIMUM_ALLOWED
,
1696 if (!NT_STATUS_IS_OK(status
)) {
1700 init_lsa_String(&name
, argv
[1]);
1702 status
= dcerpc_lsa_OpenSecret(b
, mem_ctx
,
1705 SEC_FLAG_MAXIMUM_ALLOWED
,
1708 if (!NT_STATUS_IS_OK(status
)) {
1711 if (!NT_STATUS_IS_OK(result
)) {
1716 status
= dcerpc_lsa_DeleteObject(b
, mem_ctx
,
1719 if (!NT_STATUS_IS_OK(status
)) {
1722 if (!NT_STATUS_IS_OK(result
)) {
1728 if (is_valid_policy_hnd(&sec_handle
)) {
1729 dcerpc_lsa_Close(b
, mem_ctx
, &sec_handle
, &result
);
1731 if (is_valid_policy_hnd(&handle
)) {
1732 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
1738 static NTSTATUS
cmd_lsa_query_secret(struct rpc_pipe_client
*cli
,
1739 TALLOC_CTX
*mem_ctx
, int argc
,
1742 NTSTATUS status
, result
;
1743 struct policy_handle handle
, sec_handle
;
1744 struct lsa_String name
;
1745 struct lsa_DATA_BUF_PTR new_val
;
1746 NTTIME new_mtime
= 0;
1747 struct lsa_DATA_BUF_PTR old_val
;
1748 NTTIME old_mtime
= 0;
1749 DATA_BLOB session_key
;
1750 DATA_BLOB new_blob
= data_blob_null
;
1751 DATA_BLOB old_blob
= data_blob_null
;
1752 char *new_secret
, *old_secret
;
1753 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1756 printf("Usage: %s name\n", argv
[0]);
1757 return NT_STATUS_OK
;
1760 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1762 SEC_FLAG_MAXIMUM_ALLOWED
,
1764 if (!NT_STATUS_IS_OK(status
)) {
1768 init_lsa_String(&name
, argv
[1]);
1770 status
= dcerpc_lsa_OpenSecret(b
, mem_ctx
,
1773 SEC_FLAG_MAXIMUM_ALLOWED
,
1776 if (!NT_STATUS_IS_OK(status
)) {
1779 if (!NT_STATUS_IS_OK(result
)) {
1784 ZERO_STRUCT(new_val
);
1785 ZERO_STRUCT(old_val
);
1787 status
= dcerpc_lsa_QuerySecret(b
, mem_ctx
,
1794 if (!NT_STATUS_IS_OK(status
)) {
1797 if (!NT_STATUS_IS_OK(result
)) {
1802 status
= cli_get_session_key(mem_ctx
, cli
, &session_key
);
1803 if (!NT_STATUS_IS_OK(status
)) {
1808 new_blob
= data_blob_const(new_val
.buf
->data
, new_val
.buf
->length
);
1811 old_blob
= data_blob_const(old_val
.buf
->data
, old_val
.buf
->length
);
1814 new_secret
= sess_decrypt_string(mem_ctx
, &new_blob
, &session_key
);
1815 old_secret
= sess_decrypt_string(mem_ctx
, &old_blob
, &session_key
);
1817 d_printf("new secret: %s\n", new_secret
);
1820 d_printf("old secret: %s\n", old_secret
);
1824 if (is_valid_policy_hnd(&sec_handle
)) {
1825 dcerpc_lsa_Close(b
, mem_ctx
, &sec_handle
, &result
);
1827 if (is_valid_policy_hnd(&handle
)) {
1828 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
1834 static NTSTATUS
cmd_lsa_set_secret(struct rpc_pipe_client
*cli
,
1835 TALLOC_CTX
*mem_ctx
, int argc
,
1838 NTSTATUS status
, result
;
1839 struct policy_handle handle
, sec_handle
;
1840 struct lsa_String name
;
1841 struct lsa_DATA_BUF new_val
;
1842 struct lsa_DATA_BUF old_val
;
1844 DATA_BLOB session_key
;
1845 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1848 printf("Usage: %s name secret\n", argv
[0]);
1849 return NT_STATUS_OK
;
1852 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1854 SEC_FLAG_MAXIMUM_ALLOWED
,
1856 if (!NT_STATUS_IS_OK(status
)) {
1860 init_lsa_String(&name
, argv
[1]);
1862 status
= dcerpc_lsa_OpenSecret(b
, mem_ctx
,
1865 SEC_FLAG_MAXIMUM_ALLOWED
,
1868 if (!NT_STATUS_IS_OK(status
)) {
1871 if (!NT_STATUS_IS_OK(result
)) {
1876 ZERO_STRUCT(new_val
);
1877 ZERO_STRUCT(old_val
);
1879 status
= cli_get_session_key(mem_ctx
, cli
, &session_key
);
1880 if (!NT_STATUS_IS_OK(status
)) {
1884 enc_key
= sess_encrypt_string(argv
[2], &session_key
);
1886 new_val
.length
= enc_key
.length
;
1887 new_val
.size
= enc_key
.length
;
1888 new_val
.data
= enc_key
.data
;
1890 status
= dcerpc_lsa_SetSecret(b
, mem_ctx
,
1895 if (!NT_STATUS_IS_OK(status
)) {
1898 if (!NT_STATUS_IS_OK(result
)) {
1904 if (is_valid_policy_hnd(&sec_handle
)) {
1905 dcerpc_lsa_Close(b
, mem_ctx
, &sec_handle
, &result
);
1907 if (is_valid_policy_hnd(&handle
)) {
1908 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
1914 static NTSTATUS
cmd_lsa_retrieve_private_data(struct rpc_pipe_client
*cli
,
1915 TALLOC_CTX
*mem_ctx
, int argc
,
1918 NTSTATUS status
, result
;
1919 struct policy_handle handle
;
1920 struct lsa_String name
;
1921 struct lsa_DATA_BUF
*val
;
1922 DATA_BLOB session_key
;
1923 DATA_BLOB blob
= data_blob_null
;
1925 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1928 printf("Usage: %s name\n", argv
[0]);
1929 return NT_STATUS_OK
;
1932 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1934 SEC_FLAG_MAXIMUM_ALLOWED
,
1936 if (!NT_STATUS_IS_OK(status
)) {
1940 init_lsa_String(&name
, argv
[1]);
1944 status
= dcerpc_lsa_RetrievePrivateData(b
, mem_ctx
,
1949 if (!NT_STATUS_IS_OK(status
)) {
1952 if (!NT_STATUS_IS_OK(result
)) {
1957 status
= cli_get_session_key(mem_ctx
, cli
, &session_key
);
1958 if (!NT_STATUS_IS_OK(status
)) {
1963 blob
= data_blob_const(val
->data
, val
->length
);
1966 secret
= sess_decrypt_string(mem_ctx
, &blob
, &session_key
);
1968 d_printf("secret: %s\n", secret
);
1972 if (is_valid_policy_hnd(&handle
)) {
1973 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
1979 static NTSTATUS
cmd_lsa_store_private_data(struct rpc_pipe_client
*cli
,
1980 TALLOC_CTX
*mem_ctx
, int argc
,
1983 NTSTATUS status
, result
;
1984 struct policy_handle handle
;
1985 struct lsa_String name
;
1986 struct lsa_DATA_BUF val
;
1987 DATA_BLOB session_key
;
1989 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
1992 printf("Usage: %s name secret\n", argv
[0]);
1993 return NT_STATUS_OK
;
1996 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
1998 SEC_FLAG_MAXIMUM_ALLOWED
,
2000 if (!NT_STATUS_IS_OK(status
)) {
2004 init_lsa_String(&name
, argv
[1]);
2008 status
= cli_get_session_key(mem_ctx
, cli
, &session_key
);
2009 if (!NT_STATUS_IS_OK(status
)) {
2013 enc_key
= sess_encrypt_string(argv
[2], &session_key
);
2015 val
.length
= enc_key
.length
;
2016 val
.size
= enc_key
.length
;
2017 val
.data
= enc_key
.data
;
2019 status
= dcerpc_lsa_StorePrivateData(b
, mem_ctx
,
2024 if (!NT_STATUS_IS_OK(status
)) {
2027 if (!NT_STATUS_IS_OK(result
)) {
2033 if (is_valid_policy_hnd(&handle
)) {
2034 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
2040 static NTSTATUS
cmd_lsa_create_trusted_domain(struct rpc_pipe_client
*cli
,
2041 TALLOC_CTX
*mem_ctx
, int argc
,
2044 NTSTATUS status
, result
;
2045 struct policy_handle handle
, trustdom_handle
;
2047 struct lsa_DomainInfo info
;
2048 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2051 printf("Usage: %s name sid\n", argv
[0]);
2052 return NT_STATUS_OK
;
2055 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
2057 SEC_FLAG_MAXIMUM_ALLOWED
,
2059 if (!NT_STATUS_IS_OK(status
)) {
2063 init_lsa_StringLarge(&info
.name
, argv
[1]);
2065 string_to_sid(&sid
, argv
[2]);
2067 status
= dcerpc_lsa_CreateTrustedDomain(b
, mem_ctx
,
2070 SEC_FLAG_MAXIMUM_ALLOWED
,
2073 if (!NT_STATUS_IS_OK(status
)) {
2076 if (!NT_STATUS_IS_OK(result
)) {
2082 if (is_valid_policy_hnd(&trustdom_handle
)) {
2083 dcerpc_lsa_Close(b
, mem_ctx
, &trustdom_handle
, &result
);
2086 if (is_valid_policy_hnd(&handle
)) {
2087 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
2093 static NTSTATUS
cmd_lsa_delete_trusted_domain(struct rpc_pipe_client
*cli
,
2094 TALLOC_CTX
*mem_ctx
, int argc
,
2097 NTSTATUS status
, result
;
2098 struct policy_handle handle
, trustdom_handle
;
2099 struct lsa_String name
;
2100 struct dom_sid
*sid
= NULL
;
2101 struct dcerpc_binding_handle
*b
= cli
->binding_handle
;
2104 printf("Usage: %s name\n", argv
[0]);
2105 return NT_STATUS_OK
;
2108 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
,
2110 SEC_FLAG_MAXIMUM_ALLOWED
,
2112 if (!NT_STATUS_IS_OK(status
)) {
2116 init_lsa_String(&name
, argv
[1]);
2118 status
= dcerpc_lsa_OpenTrustedDomainByName(b
, mem_ctx
,
2121 SEC_FLAG_MAXIMUM_ALLOWED
,
2124 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(result
)) {
2129 uint32_t resume_handle
= 0;
2130 struct lsa_DomainList domains
;
2133 status
= dcerpc_lsa_EnumTrustDom(b
, mem_ctx
,
2139 if (!NT_STATUS_IS_OK(status
)) {
2142 if (!NT_STATUS_IS_OK(result
)) {
2147 for (i
=0; i
< domains
.count
; i
++) {
2148 if (strequal(domains
.domains
[i
].name
.string
, argv
[1])) {
2149 sid
= domains
.domains
[i
].sid
;
2155 return NT_STATUS_INVALID_SID
;
2159 status
= dcerpc_lsa_OpenTrustedDomain(b
, mem_ctx
,
2162 SEC_FLAG_MAXIMUM_ALLOWED
,
2165 if (!NT_STATUS_IS_OK(status
)) {
2168 if (!NT_STATUS_IS_OK(result
)) {
2174 status
= dcerpc_lsa_DeleteObject(b
, mem_ctx
,
2177 if (!NT_STATUS_IS_OK(status
)) {
2180 if (!NT_STATUS_IS_OK(result
)) {
2186 if (is_valid_policy_hnd(&trustdom_handle
)) {
2187 dcerpc_lsa_Close(b
, mem_ctx
, &trustdom_handle
, &result
);
2190 if (is_valid_policy_hnd(&handle
)) {
2191 dcerpc_lsa_Close(b
, mem_ctx
, &handle
, &result
);
2198 /* List of commands exported by this module */
2200 struct cmd_set lsarpc_commands
[] = {
2204 { "lsaquery", RPC_RTYPE_NTSTATUS
, cmd_lsa_query_info_policy
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query info policy", "" },
2205 { "lookupsids", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_sids
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Convert SIDs to names", "" },
2206 { "lookupsids3", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_sids3
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Convert SIDs to names", "" },
2207 { "lookupnames", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_names
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Convert names to SIDs", "" },
2208 { "lookupnames4", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_names4
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Convert names to SIDs", "" },
2209 { "lookupnames_level", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_names_level
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Convert names to SIDs", "" },
2210 { "enumtrust", RPC_RTYPE_NTSTATUS
, cmd_lsa_enum_trust_dom
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
2211 { "enumprivs", RPC_RTYPE_NTSTATUS
, cmd_lsa_enum_privilege
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Enumerate privileges", "" },
2212 { "getdispname", RPC_RTYPE_NTSTATUS
, cmd_lsa_get_dispname
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Get the privilege name", "" },
2213 { "lsaenumsid", RPC_RTYPE_NTSTATUS
, cmd_lsa_enum_sids
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Enumerate the LSA SIDS", "" },
2214 { "lsacreateaccount", RPC_RTYPE_NTSTATUS
, cmd_lsa_create_account
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Create a new lsa account", "" },
2215 { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS
, cmd_lsa_enum_privsaccounts
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Enumerate the privileges of an SID", "" },
2216 { "lsaenumacctrights", RPC_RTYPE_NTSTATUS
, cmd_lsa_enum_acct_rights
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Enumerate the rights of an SID", "" },
2217 { "lsaaddpriv", RPC_RTYPE_NTSTATUS
, cmd_lsa_add_priv
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Assign a privilege to a SID", "" },
2218 { "lsadelpriv", RPC_RTYPE_NTSTATUS
, cmd_lsa_del_priv
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Revoke a privilege from a SID", "" },
2219 { "lsaaddacctrights", RPC_RTYPE_NTSTATUS
, cmd_lsa_add_acct_rights
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Add rights to an account", "" },
2220 { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS
, cmd_lsa_remove_acct_rights
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Remove rights from an account", "" },
2221 { "lsalookupprivvalue", RPC_RTYPE_NTSTATUS
, cmd_lsa_lookup_priv_value
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Get a privilege value given its name", "" },
2222 { "lsaquerysecobj", RPC_RTYPE_NTSTATUS
, cmd_lsa_query_secobj
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query LSA security object", "" },
2223 { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS
, cmd_lsa_query_trustdominfo
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query LSA trusted domains info (given a SID)", "" },
2224 { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS
, cmd_lsa_query_trustdominfobyname
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2225 { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS
, cmd_lsa_query_trustdominfobysid
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query LSA trusted domains info (given a SID)", "" },
2226 { "getusername", RPC_RTYPE_NTSTATUS
, cmd_lsa_get_username
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Get username", "" },
2227 { "createsecret", RPC_RTYPE_NTSTATUS
, cmd_lsa_create_secret
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Create Secret", "" },
2228 { "deletesecret", RPC_RTYPE_NTSTATUS
, cmd_lsa_delete_secret
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Delete Secret", "" },
2229 { "querysecret", RPC_RTYPE_NTSTATUS
, cmd_lsa_query_secret
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Query Secret", "" },
2230 { "setsecret", RPC_RTYPE_NTSTATUS
, cmd_lsa_set_secret
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Set Secret", "" },
2231 { "retrieveprivatedata", RPC_RTYPE_NTSTATUS
, cmd_lsa_retrieve_private_data
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Retrieve Private Data", "" },
2232 { "storeprivatedata", RPC_RTYPE_NTSTATUS
, cmd_lsa_store_private_data
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Store Private Data", "" },
2233 { "createtrustdom", RPC_RTYPE_NTSTATUS
, cmd_lsa_create_trusted_domain
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Create Trusted Domain", "" },
2234 { "deletetrustdom", RPC_RTYPE_NTSTATUS
, cmd_lsa_delete_trusted_domain
, NULL
, &ndr_table_lsarpc
.syntax_id
, NULL
, "Delete Trusted Domain", "" },