source4/libnet/libnet_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2004
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23 #include "libcli/auth/libcli_auth.h"
  24 #include "librpc/gen_ndr/ndr_samr_c.h"
  25 #include "source4/librpc/rpc/dcerpc.h"
  26
  27 #include "lib/crypto/gnutls_helpers.h"
  28 #include <gnutls/gnutls.h>
  29 #include <gnutls/crypto.h>
  30
  31 /*
  32  * do a password change using DCERPC/SAMR calls
  33  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
  34  * 2. try samr_ChangePasswordUser3
  35  * 3. try samr_ChangePasswordUser2
  36  * 4. try samr_OemChangePasswordUser2
  37  * (not yet: 5. try samr_ChangePasswordUser)
  38  */
  39 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
  40 {
  41         NTSTATUS status;
  42         struct libnet_RpcConnect c;
  43 #if 0
  44         struct policy_handle user_handle;
  45         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
  46         struct samr_ChangePasswordUser pw;
  47 #endif
  48         struct samr_OemChangePasswordUser2 oe2;
  49         struct samr_ChangePasswordUser2 pw2;
  50         struct samr_ChangePasswordUser3 pw3;
  51         struct lsa_String server, account;
  52         struct lsa_AsciiString a_server, a_account;
  53         struct samr_CryptPassword nt_pass, lm_pass;
  54         struct samr_Password nt_verifier, lm_verifier;
  55         uint8_t old_nt_hash[16], new_nt_hash[16];
  56         uint8_t old_lm_hash[16], new_lm_hash[16];
  57         struct samr_DomInfo1 *dominfo = NULL;
  58         struct userPwdChangeFailureInformation *reject = NULL;
  59         gnutls_cipher_hd_t cipher_hnd = NULL;
  60         gnutls_datum_t nt_session_key = {
  61                 .data = old_nt_hash,
  62                 .size = sizeof(old_nt_hash),
  63         };
  64         gnutls_datum_t lm_session_key = {
  65                 .data = old_lm_hash,
  66                 .size = sizeof(old_lm_hash),
  67         };
  68         int rc;
  69
  70         ZERO_STRUCT(c);
  71
  72         /* prepare connect to the SAMR pipe of the users domain PDC */
  73         c.level                    = LIBNET_RPC_CONNECT_PDC;
  74         c.in.name                  = r->samr.in.domain_name;
  75         c.in.dcerpc_iface          = &ndr_table_samr;
  76         c.in.dcerpc_flags          = DCERPC_ANON_FALLBACK;
  77
  78         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
  79         status = libnet_RpcConnect(ctx, mem_ctx, &c);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
  82                                                 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
  83                                                 r->samr.in.domain_name, nt_errstr(status));
  84                 return status;
  85         }
  86
  87         /* prepare password change for account */
  88         server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
  89         account.string = r->samr.in.account_name;
  90
  91         E_md4hash(r->samr.in.oldpassword, old_nt_hash);
  92         E_md4hash(r->samr.in.newpassword, new_nt_hash);
  93
  94         E_deshash(r->samr.in.oldpassword, old_lm_hash);
  95         E_deshash(r->samr.in.newpassword, new_lm_hash);
  96
  97         /* prepare samr_ChangePasswordUser3 */
  98         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
  99
 100         rc = gnutls_cipher_init(&cipher_hnd,
 101                                 GNUTLS_CIPHER_ARCFOUR_128,
 102                                 &nt_session_key,
 103                                 NULL);
 104         if (rc < 0) {
 105                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 106                 goto disconnect;
 107         }
 108
 109         rc = gnutls_cipher_encrypt(cipher_hnd,
 110                                    lm_pass.data,
 111                                    516);
 112         gnutls_cipher_deinit(cipher_hnd);
 113         if (rc < 0) {
 114                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 115                 goto disconnect;
 116         }
 117
 118         rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 119         if (rc != 0) {
 120                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 121                 goto disconnect;
 122         }
 123
 124         encode_pw_buffer(nt_pass.data,  r->samr.in.newpassword, STR_UNICODE);
 125
 126         rc = gnutls_cipher_init(&cipher_hnd,
 127                                 GNUTLS_CIPHER_ARCFOUR_128,
 128                                 &nt_session_key,
 129                                 NULL);
 130         if (rc < 0) {
 131                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 132                 goto disconnect;
 133         }
 134
 135         rc = gnutls_cipher_encrypt(cipher_hnd,
 136                                    nt_pass.data,
 137                                    516);
 138         gnutls_cipher_deinit(cipher_hnd);
 139         if (rc < 0) {
 140                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 141                 goto disconnect;
 142         }
 143
 144         rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
 145         if (rc != 0) {
 146                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 147                 goto disconnect;
 148         }
 149
 150         pw3.in.server = &server;
 151         pw3.in.account = &account;
 152         pw3.in.nt_password = &nt_pass;
 153         pw3.in.nt_verifier = &nt_verifier;
 154         pw3.in.lm_change = 1;
 155         pw3.in.lm_password = &lm_pass;
 156         pw3.in.lm_verifier = &lm_verifier;
 157         pw3.in.password3 = NULL;
 158         pw3.out.dominfo = &dominfo;
 159         pw3.out.reject = &reject;
 160
 161         /* 2. try samr_ChangePasswordUser3 */
 162         status = dcerpc_samr_ChangePasswordUser3_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw3);
 163         if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
 164                 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw3.out.result)) {
 165                         status = pw3.out.result;
 166                 }
 167                 if (!NT_STATUS_IS_OK(status)) {
 168                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 169                                                                    "samr_ChangePasswordUser3 failed: %s",
 170                                                                    nt_errstr(status));
 171                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 172                                                                    "samr_ChangePasswordUser3 for '%s\\%s' failed: %s",
 173                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 174                                                                    nt_errstr(status));
 175                 }
 176                 goto disconnect;
 177         }
 178
 179         /* prepare samr_ChangePasswordUser2 */
 180         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
 181
 182         rc = gnutls_cipher_init(&cipher_hnd,
 183                                 GNUTLS_CIPHER_ARCFOUR_128,
 184                                 &lm_session_key,
 185                                 NULL);
 186         if (rc < 0) {
 187                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 188                 goto disconnect;
 189         }
 190
 191         rc = gnutls_cipher_encrypt(cipher_hnd,
 192                                    lm_pass.data,
 193                                    516);
 194         gnutls_cipher_deinit(cipher_hnd);
 195         if (rc < 0) {
 196                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 197                 goto disconnect;
 198         }
 199
 200         rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 201         if (rc != 0) {
 202                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 203                 goto disconnect;
 204         }
 205
 206         encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
 207
 208         rc = gnutls_cipher_init(&cipher_hnd,
 209                                 GNUTLS_CIPHER_ARCFOUR_128,
 210                                 &nt_session_key,
 211                                 NULL);
 212         if (rc < 0) {
 213                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 214                 goto disconnect;
 215         }
 216         rc = gnutls_cipher_encrypt(cipher_hnd,
 217                                    nt_pass.data,
 218                                    516);
 219         gnutls_cipher_deinit(cipher_hnd);
 220         if (rc < 0) {
 221                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 222                 goto disconnect;
 223         }
 224
 225         rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
 226         if (rc != 0) {
 227                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 228                 goto disconnect;
 229         }
 230
 231         pw2.in.server = &server;
 232         pw2.in.account = &account;
 233         pw2.in.nt_password = &nt_pass;
 234         pw2.in.nt_verifier = &nt_verifier;
 235         pw2.in.lm_change = 1;
 236         pw2.in.lm_password = &lm_pass;
 237         pw2.in.lm_verifier = &lm_verifier;
 238
 239         /* 3. try samr_ChangePasswordUser2 */
 240         status = dcerpc_samr_ChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw2);
 241         if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
 242                 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw2.out.result)) {
 243                         status = pw2.out.result;
 244                 }
 245                 if (!NT_STATUS_IS_OK(status)) {
 246                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 247                                                                    "samr_ChangePasswordUser2 for '%s\\%s' failed: %s",
 248                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 249                                                                    nt_errstr(status));
 250                 }
 251                 goto disconnect;
 252         }
 253
 254
 255         /* prepare samr_OemChangePasswordUser2 */
 256         a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
 257         a_account.string = r->samr.in.account_name;
 258
 259         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
 260
 261         rc = gnutls_cipher_init(&cipher_hnd,
 262                                 GNUTLS_CIPHER_ARCFOUR_128,
 263                                 &lm_session_key,
 264                                 NULL);
 265         if (rc < 0) {
 266                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 267                 goto disconnect;
 268         }
 269
 270         rc = gnutls_cipher_encrypt(cipher_hnd,
 271                                    lm_pass.data,
 272                                    516);
 273         gnutls_cipher_deinit(cipher_hnd);
 274         if (rc < 0) {
 275                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 276                 goto disconnect;
 277         }
 278
 279         rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 280         if (rc != 0) {
 281                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 282                 goto disconnect;
 283         }
 284
 285         oe2.in.server = &a_server;
 286         oe2.in.account = &a_account;
 287         oe2.in.password = &lm_pass;
 288         oe2.in.hash = &lm_verifier;
 289
 290         /* 4. try samr_OemChangePasswordUser2 */
 291         status = dcerpc_samr_OemChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &oe2);
 292         if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
 293                 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(oe2.out.result)) {
 294                         status = oe2.out.result;
 295                 }
 296                 if (!NT_STATUS_IS_OK(oe2.out.result)) {
 297                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 298                                                                    "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s",
 299                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 300                                                                    nt_errstr(status));
 301                 }
 302                 goto disconnect;
 303         }
 304
 305 #if 0
 306         /* prepare samr_ChangePasswordUser */
 307         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
 308         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
 309         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
 310         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
 311         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
 312         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
 313
 314         /* TODO: ask for a user_handle */
 315         pw.in.handle = &user_handle;
 316         pw.in.lm_present = 1;
 317         pw.in.old_lm_crypted = &hash1;
 318         pw.in.new_lm_crypted = &hash2;
 319         pw.in.nt_present = 1;
 320         pw.in.old_nt_crypted = &hash3;
 321         pw.in.new_nt_crypted = &hash4;
 322         pw.in.cross1_present = 1;
 323         pw.in.nt_cross = &hash5;
 324         pw.in.cross2_present = 1;
 325         pw.in.lm_cross = &hash6;
 326
 327         /* 5. try samr_ChangePasswordUser */
 328         status = dcerpc_samr_ChangePasswordUser_r(c.pdc.out.dcerpc_pipe->binding_handle, mem_ctx, &pw);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 331                                                 "samr_ChangePasswordUser failed: %s",
 332                                                 nt_errstr(status));
 333                 goto disconnect;
 334         }
 335
 336         /* check result of samr_ChangePasswordUser */
 337         if (!NT_STATUS_IS_OK(pw.out.result)) {
 338                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 339                                                 "samr_ChangePasswordUser for '%s\\%s' failed: %s",
 340                                                 r->samr.in.domain_name, r->samr.in.account_name,
 341                                                 nt_errstr(pw.out.result));
 342                 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 343                         status = pw.out.result;
 344                         goto disconnect;
 345                 }
 346                 goto disconnect;
 347         }
 348 #endif
 349 disconnect:
 350         /* close connection */
 351         talloc_unlink(ctx, c.out.dcerpc_pipe);
 352
 353         return status;
 354 }
 355
 356 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 357 {
 358         NTSTATUS status;
 359         union libnet_ChangePassword r2;
 360
 361         r2.samr.level           = LIBNET_CHANGE_PASSWORD_SAMR;
 362         r2.samr.in.account_name = r->generic.in.account_name;
 363         r2.samr.in.domain_name  = r->generic.in.domain_name;
 364         r2.samr.in.oldpassword  = r->generic.in.oldpassword;
 365         r2.samr.in.newpassword  = r->generic.in.newpassword;
 366
 367         status = libnet_ChangePassword(ctx, mem_ctx, &r2);
 368
 369         r->generic.out.error_string = r2.samr.out.error_string;
 370
 371         return status;
 372 }
 373
 374 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 375 {
 376         switch (r->generic.level) {
 377                 case LIBNET_CHANGE_PASSWORD_GENERIC:
 378                         return libnet_ChangePassword_generic(ctx, mem_ctx, r);
 379                 case LIBNET_CHANGE_PASSWORD_SAMR:
 380                         return libnet_ChangePassword_samr(ctx, mem_ctx, r);
 381                 case LIBNET_CHANGE_PASSWORD_KRB5:
 382                         return NT_STATUS_NOT_IMPLEMENTED;
 383                 case LIBNET_CHANGE_PASSWORD_LDAP:
 384                         return NT_STATUS_NOT_IMPLEMENTED;
 385                 case LIBNET_CHANGE_PASSWORD_RAP:
 386                         return NT_STATUS_NOT_IMPLEMENTED;
 387         }
 388
 389         return NT_STATUS_INVALID_LEVEL;
 390 }
 391
 392 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 393 {
 394         NTSTATUS status;
 395         struct samr_SetUserInfo2 sui;
 396         union samr_UserInfo u_info;
 397         DATA_BLOB session_key;
 398
 399         if (r->samr_handle.in.info21) {
 400                 return NT_STATUS_INVALID_PARAMETER_MIX;
 401         }
 402
 403         /* prepare samr_SetUserInfo2 level 26 */
 404         ZERO_STRUCT(u_info);
 405         u_info.info26.password_expired = 0;
 406
 407         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 408         if (!NT_STATUS_IS_OK(status)) {
 409                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 410                                                                   "dcerpc_fetch_session_key failed: %s",
 411                                                                   nt_errstr(status));
 412                 return status;
 413         }
 414
 415         status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
 416                                           &session_key,
 417                                           &u_info.info26.password);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 r->samr_handle.out.error_string =
 420                         talloc_asprintf(mem_ctx,
 421                                         "encode_rc4_passwd_buffer failed: %s",
 422                                         nt_errstr(status));
 423                 return status;
 424         }
 425
 426         sui.in.user_handle = r->samr_handle.in.user_handle;
 427         sui.in.info = &u_info;
 428         sui.in.level = 26;
 429
 430         /* 7. try samr_SetUserInfo2 level 26 to set the password */
 431         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 432         /* check result of samr_SetUserInfo2 level 26 */
 433         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
 434                 status = sui.out.result;
 435         }
 436         if (!NT_STATUS_IS_OK(status)) {
 437                 r->samr_handle.out.error_string
 438                         = talloc_asprintf(mem_ctx,
 439                                           "SetUserInfo2 level 26 for [%s] failed: %s",
 440                                           r->samr_handle.in.account_name, nt_errstr(status));
 441         }
 442
 443         return status;
 444 }
 445
 446 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 447 {
 448         NTSTATUS status;
 449         struct samr_SetUserInfo2 sui;
 450         union samr_UserInfo u_info;
 451         DATA_BLOB session_key;
 452
 453         if (!r->samr_handle.in.info21) {
 454                 return NT_STATUS_INVALID_PARAMETER_MIX;
 455         }
 456
 457         /* prepare samr_SetUserInfo2 level 25 */
 458         ZERO_STRUCT(u_info);
 459         u_info.info25.info = *r->samr_handle.in.info21;
 460         u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
 461
 462         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 463         if (!NT_STATUS_IS_OK(status)) {
 464                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 465                                                 "dcerpc_fetch_session_key failed: %s",
 466                                                 nt_errstr(status));
 467                 return status;
 468         }
 469
 470         status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
 471                                           &session_key,
 472                                           &u_info.info25.password);
 473         if (!NT_STATUS_IS_OK(status)) {
 474                 r->samr_handle.out.error_string =
 475                         talloc_asprintf(mem_ctx,
 476                                         "encode_rc4_passwd_buffer failed: %s",
 477                                         nt_errstr(status));
 478                 return status;
 479         }
 480
 481
 482         sui.in.user_handle = r->samr_handle.in.user_handle;
 483         sui.in.info = &u_info;
 484         sui.in.level = 25;
 485
 486         /* 8. try samr_SetUserInfo2 level 25 to set the password */
 487         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 488         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
 489                 status = sui.out.result;
 490         }
 491         if (!NT_STATUS_IS_OK(status)) {
 492                 r->samr_handle.out.error_string
 493                         = talloc_asprintf(mem_ctx,
 494                                           "SetUserInfo2 level 25 for [%s] failed: %s",
 495                                           r->samr_handle.in.account_name, nt_errstr(status));
 496         }
 497
 498         return status;
 499 }
 500
 501 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 502 {
 503         NTSTATUS status;
 504         struct samr_SetUserInfo2 sui;
 505         union samr_UserInfo u_info;
 506         DATA_BLOB session_key;
 507         gnutls_cipher_hd_t cipher_hnd = NULL;
 508         gnutls_datum_t enc_session_key;
 509         int rc;
 510
 511         if (r->samr_handle.in.info21) {
 512                 return NT_STATUS_INVALID_PARAMETER_MIX;
 513         }
 514
 515         /* prepare samr_SetUserInfo2 level 24 */
 516         ZERO_STRUCT(u_info);
 517         encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 518         u_info.info24.password_expired = 0;
 519
 520         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 521         if (!NT_STATUS_IS_OK(status)) {
 522                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 523                                                 "dcerpc_fetch_session_key failed: %s",
 524                                                 nt_errstr(status));
 525                 return status;
 526         }
 527
 528         enc_session_key = (gnutls_datum_t) {
 529                 .data = session_key.data,
 530                 .size = session_key.length,
 531         };
 532
 533         rc = gnutls_cipher_init(&cipher_hnd,
 534                                 GNUTLS_CIPHER_ARCFOUR_128,
 535                                 &enc_session_key,
 536                                 NULL);
 537         if (rc < 0) {
 538                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 539                 goto out;
 540         }
 541
 542         rc = gnutls_cipher_encrypt(cipher_hnd,
 543                                    u_info.info24.password.data,
 544                                    516);
 545         gnutls_cipher_deinit(cipher_hnd);
 546         if (rc < 0) {
 547                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 548                 goto out;
 549         }
 550
 551         sui.in.user_handle = r->samr_handle.in.user_handle;
 552         sui.in.info = &u_info;
 553         sui.in.level = 24;
 554
 555         /* 9. try samr_SetUserInfo2 level 24 to set the password */
 556         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 557         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
 558                 status = sui.out.result;
 559         }
 560         if (!NT_STATUS_IS_OK(status)) {
 561                 r->samr_handle.out.error_string
 562                         = talloc_asprintf(mem_ctx,
 563                                           "SetUserInfo2 level 24 for [%s] failed: %s",
 564                                           r->samr_handle.in.account_name, nt_errstr(status));
 565         }
 566
 567 out:
 568         data_blob_clear(&session_key);
 569         return status;
 570 }
 571
 572 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 573 {
 574         NTSTATUS status;
 575         struct samr_SetUserInfo2 sui;
 576         union samr_UserInfo u_info;
 577         DATA_BLOB session_key;
 578         gnutls_cipher_hd_t cipher_hnd = NULL;
 579         gnutls_datum_t _session_key;
 580         int rc;
 581
 582         if (!r->samr_handle.in.info21) {
 583                 return NT_STATUS_INVALID_PARAMETER_MIX;
 584         }
 585
 586         /* prepare samr_SetUserInfo2 level 23 */
 587         ZERO_STRUCT(u_info);
 588         u_info.info23.info = *r->samr_handle.in.info21;
 589         u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
 590         encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 591
 592         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 593         if (!NT_STATUS_IS_OK(status)) {
 594                 r->samr_handle.out.error_string
 595                         = talloc_asprintf(mem_ctx,
 596                                           "dcerpc_fetch_session_key failed: %s",
 597                                           nt_errstr(status));
 598                 return status;
 599         }
 600
 601         _session_key = (gnutls_datum_t) {
 602                 .data = session_key.data,
 603                 .size = session_key.length,
 604         };
 605
 606         rc = gnutls_cipher_init(&cipher_hnd,
 607                                 GNUTLS_CIPHER_ARCFOUR_128,
 608                                 &_session_key,
 609                                 NULL);
 610         if (rc < 0) {
 611                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 612                 goto out;
 613         }
 614
 615         rc = gnutls_cipher_encrypt(cipher_hnd,
 616                                    u_info.info23.password.data,
 617                                    516);
 618         data_blob_clear_free(&session_key);
 619         gnutls_cipher_deinit(cipher_hnd);
 620         if (rc < 0) {
 621                 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
 622                 goto out;
 623         }
 624
 625         sui.in.user_handle = r->samr_handle.in.user_handle;
 626         sui.in.info = &u_info;
 627         sui.in.level = 23;
 628
 629         /* 10. try samr_SetUserInfo2 level 23 to set the password */
 630         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 631         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
 632                 status = sui.out.result;
 633         }
 634         if (!NT_STATUS_IS_OK(status)) {
 635                 r->samr_handle.out.error_string
 636                         = talloc_asprintf(mem_ctx,
 637                                           "SetUserInfo2 level 23 for [%s] failed: %s",
 638                                           r->samr_handle.in.account_name, nt_errstr(status));
 639         }
 640
 641 out:
 642         return status;
 643 }
 644
 645 /*
 646  * 1. try samr_SetUserInfo2 level 26 to set the password
 647  * 2. try samr_SetUserInfo2 level 25 to set the password
 648  * 3. try samr_SetUserInfo2 level 24 to set the password
 649  * 4. try samr_SetUserInfo2 level 23 to set the password
 650 */
 651 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 652 {
 653
 654         NTSTATUS status;
 655         enum libnet_SetPassword_level levels[] = {
 656                 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
 657                 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
 658                 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
 659                 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
 660         };
 661         unsigned int i;
 662
 663         for (i=0; i < ARRAY_SIZE(levels); i++) {
 664                 r->generic.level = levels[i];
 665                 status = libnet_SetPassword(ctx, mem_ctx, r);
 666                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
 667                     || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
 668                     || NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
 669                         /* Try another password set mechanism */
 670                         continue;
 671                 }
 672                 break;
 673         }
 674
 675         return status;
 676 }
 677 /*
 678  * set a password with DCERPC/SAMR calls
 679  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
 680  *    is it correct to contact the the pdc of the domain of the user who's password should be set?
 681  * 2. do a samr_Connect to get a policy handle
 682  * 3. do a samr_LookupDomain to get the domain sid
 683  * 4. do a samr_OpenDomain to get a domain handle
 684  * 5. do a samr_LookupNames to get the users rid
 685  * 6. do a samr_OpenUser to get a user handle
 686  * 7  call libnet_SetPassword_samr_handle to set the password
 687  */
 688 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 689 {
 690         NTSTATUS status;
 691         struct libnet_RpcConnect c;
 692         struct samr_Connect sc;
 693         struct policy_handle p_handle;
 694         struct samr_LookupDomain ld;
 695         struct dom_sid2 *sid = NULL;
 696         struct lsa_String d_name;
 697         struct samr_OpenDomain od;
 698         struct policy_handle d_handle;
 699         struct samr_LookupNames ln;
 700         struct samr_Ids rids, types;
 701         struct samr_OpenUser ou;
 702         struct policy_handle u_handle;
 703         union libnet_SetPassword r2;
 704
 705         ZERO_STRUCT(c);
 706         /* prepare connect to the SAMR pipe of users domain PDC */
 707         c.level               = LIBNET_RPC_CONNECT_PDC;
 708         c.in.name             = r->samr.in.domain_name;
 709         c.in.dcerpc_iface     = &ndr_table_samr;
 710
 711         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
 712         status = libnet_RpcConnect(ctx, mem_ctx, &c);
 713         if (!NT_STATUS_IS_OK(status)) {
 714                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 715                                                            "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
 716                                                            r->samr.in.domain_name, nt_errstr(status));
 717                 return status;
 718         }
 719
 720         /* prepare samr_Connect */
 721         ZERO_STRUCT(p_handle);
 722         sc.in.system_name = NULL;
 723         sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 724         sc.out.connect_handle = &p_handle;
 725
 726         /* 2. do a samr_Connect to get a policy handle */
 727         status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc);
 728         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) {
 729                 status = sc.out.result;
 730         }
 731         if (!NT_STATUS_IS_OK(status)) {
 732                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 733                                                 "samr_Connect failed: %s",
 734                                                 nt_errstr(status));
 735                 goto disconnect;
 736         }
 737
 738         /* prepare samr_LookupDomain */
 739         d_name.string = r->samr.in.domain_name;
 740         ld.in.connect_handle = &p_handle;
 741         ld.in.domain_name = &d_name;
 742         ld.out.sid = &sid;
 743
 744         /* 3. do a samr_LookupDomain to get the domain sid */
 745         status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld);
 746         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ld.out.result)) {
 747                 status = ld.out.result;
 748         }
 749         if (!NT_STATUS_IS_OK(status)) {
 750                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 751                                                 "samr_LookupDomain for [%s] failed: %s",
 752                                                 r->samr.in.domain_name, nt_errstr(status));
 753                 goto disconnect;
 754         }
 755
 756         /* prepare samr_OpenDomain */
 757         ZERO_STRUCT(d_handle);
 758         od.in.connect_handle = &p_handle;
 759         od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 760         od.in.sid = *ld.out.sid;
 761         od.out.domain_handle = &d_handle;
 762
 763         /* 4. do a samr_OpenDomain to get a domain handle */
 764         status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od);
 765         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) {
 766                 status = od.out.result;
 767         }
 768         if (!NT_STATUS_IS_OK(status)) {
 769                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 770                                                 "samr_OpenDomain for [%s] failed: %s",
 771                                                 r->samr.in.domain_name, nt_errstr(status));
 772                 goto disconnect;
 773         }
 774
 775         /* prepare samr_LookupNames */
 776         ln.in.domain_handle = &d_handle;
 777         ln.in.num_names = 1;
 778         ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
 779         ln.out.rids = &rids;
 780         ln.out.types = &types;
 781         if (!ln.in.names) {
 782                 r->samr.out.error_string = "Out of Memory";
 783                 return NT_STATUS_NO_MEMORY;
 784         }
 785         ln.in.names[0].string = r->samr.in.account_name;
 786
 787         /* 5. do a samr_LookupNames to get the users rid */
 788         status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln);
 789         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) {
 790                 status = ln.out.result;
 791         }
 792         if (!NT_STATUS_IS_OK(status)) {
 793                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 794                                                 "samr_LookupNames for [%s] failed: %s",
 795                                                 r->samr.in.account_name, nt_errstr(status));
 796                 goto disconnect;
 797         }
 798
 799         /* check if we got one RID for the user */
 800         if (ln.out.rids->count != 1) {
 801                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 802                                                 "samr_LookupNames for [%s] returns %d RIDs",
 803                                                 r->samr.in.account_name, ln.out.rids->count);
 804                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
 805                 goto disconnect;
 806         }
 807
 808         if (ln.out.types->count != 1) {
 809                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 810                                                 "samr_LookupNames for [%s] returns %d RID TYPEs",
 811                                                 r->samr.in.account_name, ln.out.types->count);
 812                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
 813                 goto disconnect;
 814         }
 815
 816         /* prepare samr_OpenUser */
 817         ZERO_STRUCT(u_handle);
 818         ou.in.domain_handle = &d_handle;
 819         ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 820         ou.in.rid = ln.out.rids->ids[0];
 821         ou.out.user_handle = &u_handle;
 822
 823         /* 6. do a samr_OpenUser to get a user handle */
 824         status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou);
 825         if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) {
 826                 status = ou.out.result;
 827         }
 828         if (!NT_STATUS_IS_OK(status)) {
 829                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 830                                                 "samr_OpenUser for [%s] failed: %s",
 831                                                 r->samr.in.account_name, nt_errstr(status));
 832                 goto disconnect;
 833         }
 834
 835         r2.samr_handle.level            = LIBNET_SET_PASSWORD_SAMR_HANDLE;
 836         r2.samr_handle.in.account_name  = r->samr.in.account_name;
 837         r2.samr_handle.in.newpassword   = r->samr.in.newpassword;
 838         r2.samr_handle.in.user_handle   = &u_handle;
 839         r2.samr_handle.in.dcerpc_pipe   = c.out.dcerpc_pipe;
 840         r2.samr_handle.in.info21        = NULL;
 841
 842         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 843
 844         r->generic.out.error_string = r2.samr_handle.out.error_string;
 845
 846 disconnect:
 847         /* close connection */
 848         talloc_unlink(ctx, c.out.dcerpc_pipe);
 849
 850         return status;
 851 }
 852
 853 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 854 {
 855         NTSTATUS status;
 856         union libnet_SetPassword r2;
 857
 858         r2.samr.level           = LIBNET_SET_PASSWORD_SAMR;
 859         r2.samr.in.account_name = r->generic.in.account_name;
 860         r2.samr.in.domain_name  = r->generic.in.domain_name;
 861         r2.samr.in.newpassword  = r->generic.in.newpassword;
 862
 863         r->generic.out.error_string = "Unknown Error";
 864         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 865
 866         r->generic.out.error_string = r2.samr.out.error_string;
 867
 868         return status;
 869 }
 870
 871 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 872 {
 873         switch (r->generic.level) {
 874                 case LIBNET_SET_PASSWORD_GENERIC:
 875                         return libnet_SetPassword_generic(ctx, mem_ctx, r);
 876                 case LIBNET_SET_PASSWORD_SAMR:
 877                         return libnet_SetPassword_samr(ctx, mem_ctx, r);
 878                 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
 879                         return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
 880                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
 881                         return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
 882                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
 883                         return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
 884                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
 885                         return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
 886                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
 887                         return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
 888                 case LIBNET_SET_PASSWORD_KRB5:
 889                         return NT_STATUS_NOT_IMPLEMENTED;
 890                 case LIBNET_SET_PASSWORD_LDAP:
 891                         return NT_STATUS_NOT_IMPLEMENTED;
 892                 case LIBNET_SET_PASSWORD_RAP:
 893                         return NT_STATUS_NOT_IMPLEMENTED;
 894         }
 895
 896         return NT_STATUS_INVALID_LEVEL;
 897 }