2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include "librpc/gen_ndr/ndr_samr.h"
25 * do a password change using DCERPC/SAMR calls
26 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
27 * 2. try samr_ChangePasswordUser3
28 * 3. try samr_ChangePasswordUser2
29 * 4. try samr_OemChangePasswordUser2
30 * (not yet: 5. try samr_ChangePasswordUser)
32 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
35 union libnet_rpc_connect c;
37 struct policy_handle user_handle;
38 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
39 struct samr_ChangePasswordUser pw;
41 struct samr_OemChangePasswordUser2 oe2;
42 struct samr_ChangePasswordUser2 pw2;
43 struct samr_ChangePasswordUser3 pw3;
44 struct samr_Name server, account;
45 struct samr_AsciiName a_server, a_account;
46 struct samr_CryptPassword nt_pass, lm_pass;
47 struct samr_Password nt_verifier, lm_verifier;
48 uint8_t old_nt_hash[16], new_nt_hash[16];
49 uint8_t old_lm_hash[16], new_lm_hash[16];
51 /* prepare connect to the SAMR pipe of the users domain PDC */
52 c.pdc.level = LIBNET_RPC_CONNECT_PDC;
53 c.pdc.in.domain_name = r->samr.in.domain_name;
54 c.pdc.in.dcerpc_iface_name = DCERPC_SAMR_NAME;
55 c.pdc.in.dcerpc_iface_uuid = DCERPC_SAMR_UUID;
56 c.pdc.in.dcerpc_iface_version = DCERPC_SAMR_VERSION;
58 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
59 status = libnet_rpc_connect(ctx, mem_ctx, &c);
60 if (!NT_STATUS_IS_OK(status)) {
61 r->samr.out.error_string = talloc_asprintf(mem_ctx,
62 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
63 r->samr.in.domain_name, nt_errstr(status));
67 /* prepare password change for account */
68 server.name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
69 account.name = r->samr.in.account_name;
71 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
72 E_md4hash(r->samr.in.newpassword, new_nt_hash);
74 E_deshash(r->samr.in.oldpassword, old_lm_hash);
75 E_deshash(r->samr.in.newpassword, new_lm_hash);
77 /* prepare samr_ChangePasswordUser3 */
78 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
79 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
80 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
82 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
83 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
84 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
86 pw3.in.server = &server;
87 pw3.in.account = &account;
88 pw3.in.nt_password = &nt_pass;
89 pw3.in.nt_verifier = &nt_verifier;
91 pw3.in.lm_password = &lm_pass;
92 pw3.in.lm_verifier = &lm_verifier;
93 pw3.in.password3 = NULL;
95 /* 2. try samr_ChangePasswordUser3 */
96 status = dcerpc_samr_ChangePasswordUser3(c.pdc.out.dcerpc_pipe, mem_ctx, &pw3);
97 if (!NT_STATUS_IS_OK(status)) {
98 r->samr.out.error_string = talloc_asprintf(mem_ctx,
99 "samr_ChangePasswordUser3 failed: %s\n",
101 goto ChangePasswordUser2;
104 /* check result of samr_ChangePasswordUser3 */
105 if (!NT_STATUS_IS_OK(pw3.out.result)) {
106 r->samr.out.error_string = talloc_asprintf(mem_ctx,
107 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
108 r->samr.in.domain_name, r->samr.in.account_name,
109 nt_errstr(pw3.out.result));
110 /* TODO: give the reason of the reject */
111 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
112 status = pw3.out.result;
115 goto ChangePasswordUser2;
121 /* prepare samr_ChangePasswordUser2 */
122 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
123 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
124 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
126 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
127 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
128 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
130 pw2.in.server = &server;
131 pw2.in.account = &account;
132 pw2.in.nt_password = &nt_pass;
133 pw2.in.nt_verifier = &nt_verifier;
134 pw2.in.lm_change = 1;
135 pw2.in.lm_password = &lm_pass;
136 pw2.in.lm_verifier = &lm_verifier;
138 /* 3. try samr_ChangePasswordUser2 */
139 status = dcerpc_samr_ChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &pw2);
140 if (!NT_STATUS_IS_OK(status)) {
141 r->samr.out.error_string = talloc_asprintf(mem_ctx,
142 "samr_ChangePasswordUser2 failed: %s\n",
144 goto OemChangePasswordUser2;
147 /* check result of samr_ChangePasswordUser2 */
148 if (!NT_STATUS_IS_OK(pw2.out.result)) {
149 r->samr.out.error_string = talloc_asprintf(mem_ctx,
150 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
151 r->samr.in.domain_name, r->samr.in.account_name,
152 nt_errstr(pw2.out.result));
153 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
154 status = pw2.out.result;
157 goto OemChangePasswordUser2;
162 OemChangePasswordUser2:
163 /* prepare samr_OemChangePasswordUser2 */
164 a_server.name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
165 a_account.name = r->samr.in.account_name;
167 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
168 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
169 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
171 oe2.in.server = &a_server;
172 oe2.in.account = &a_account;
173 oe2.in.password = &lm_pass;
174 oe2.in.hash = &lm_verifier;
176 /* 4. try samr_OemChangePasswordUser2 */
177 status = dcerpc_samr_OemChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &oe2);
178 if (!NT_STATUS_IS_OK(status)) {
179 r->samr.out.error_string = talloc_asprintf(mem_ctx,
180 "samr_OemChangePasswordUser2 failed: %s\n",
182 goto ChangePasswordUser;
185 /* check result of samr_OemChangePasswordUser2 */
186 if (!NT_STATUS_IS_OK(oe2.out.result)) {
187 r->samr.out.error_string = talloc_asprintf(mem_ctx,
188 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
189 r->samr.in.domain_name, r->samr.in.account_name,
190 nt_errstr(oe2.out.result));
191 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
192 status = oe2.out.result;
195 goto ChangePasswordUser;
202 /* prepare samr_ChangePasswordUser */
203 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
204 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
205 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
206 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
207 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
208 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
210 /* TODO: ask for a user_handle */
211 pw.in.handle = &user_handle;
212 pw.in.lm_present = 1;
213 pw.in.old_lm_crypted = &hash1;
214 pw.in.new_lm_crypted = &hash2;
215 pw.in.nt_present = 1;
216 pw.in.old_nt_crypted = &hash3;
217 pw.in.new_nt_crypted = &hash4;
218 pw.in.cross1_present = 1;
219 pw.in.nt_cross = &hash5;
220 pw.in.cross2_present = 1;
221 pw.in.lm_cross = &hash6;
223 /* 5. try samr_ChangePasswordUser */
224 status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
225 if (!NT_STATUS_IS_OK(status)) {
226 r->samr.out.error_string = talloc_asprintf(mem_ctx,
227 "samr_ChangePasswordUser failed: %s\n",
232 /* check result of samr_ChangePasswordUser */
233 if (!NT_STATUS_IS_OK(pw.out.result)) {
234 r->samr.out.error_string = talloc_asprintf(mem_ctx,
235 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
236 r->samr.in.domain_name, r->samr.in.account_name,
237 nt_errstr(pw.out.result));
238 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
239 status = pw.out.result;
246 /* close connection */
247 dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
252 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
255 union libnet_ChangePassword r2;
257 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
258 r2.samr.in.account_name = r->generic.in.account_name;
259 r2.samr.in.domain_name = r->generic.in.domain_name;
260 r2.samr.in.oldpassword = r->generic.in.oldpassword;
261 r2.samr.in.newpassword = r->generic.in.newpassword;
263 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
265 r->generic.out.error_string = r2.samr.out.error_string;
270 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
272 switch (r->generic.level) {
273 case LIBNET_CHANGE_PASSWORD_GENERIC:
274 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
275 case LIBNET_CHANGE_PASSWORD_SAMR:
276 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
277 case LIBNET_CHANGE_PASSWORD_KRB5:
278 return NT_STATUS_NOT_IMPLEMENTED;
279 case LIBNET_CHANGE_PASSWORD_LDAP:
280 return NT_STATUS_NOT_IMPLEMENTED;
281 case LIBNET_CHANGE_PASSWORD_RAP:
282 return NT_STATUS_NOT_IMPLEMENTED;
285 return NT_STATUS_INVALID_LEVEL;
289 * set a password with DCERPC/SAMR calls
290 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
291 * is it correct to contact the the pdc of the domain of the user who's password should be set?
292 * 2. do a samr_Connect to get a policy handle
293 * 3. do a samr_LookupDomain to get the domain sid
294 * 4. do a samr_OpenDomain to get a domain handle
295 * 5. do a samr_LookupNames to get the users rid
296 * 6. do a samr_OpenUser to get a user handle
297 * 7. try samr_SetUserInfo level 26 to set the password
298 * 8. try samr_SetUserInfo level 25 to set the password
299 * 8. try samr_SetUserInfo level 24 to set the password
300 *10. try samr_SetUserInfo level 23 to set the password
302 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
305 union libnet_rpc_connect c;
306 struct samr_Connect sc;
307 struct policy_handle p_handle;
308 struct samr_LookupDomain ld;
309 struct samr_Name d_name;
310 struct samr_OpenDomain od;
311 struct policy_handle d_handle;
312 struct samr_LookupNames ln;
313 struct samr_OpenUser ou;
314 struct policy_handle u_handle;
315 struct samr_SetUserInfo sui;
316 union samr_UserInfo u_info;
317 DATA_BLOB session_key;
318 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
319 uint8_t confounder[16];
320 struct MD5Context md5;
322 /* prepare connect to the SAMR pipe of users domain PDC */
323 c.pdc.level = LIBNET_RPC_CONNECT_PDC;
324 c.pdc.in.domain_name = r->samr.in.domain_name;
325 c.pdc.in.dcerpc_iface_name = DCERPC_SAMR_NAME;
326 c.pdc.in.dcerpc_iface_uuid = DCERPC_SAMR_UUID;
327 c.pdc.in.dcerpc_iface_version = DCERPC_SAMR_VERSION;
329 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
330 status = libnet_rpc_connect(ctx, mem_ctx, &c);
331 if (!NT_STATUS_IS_OK(status)) {
332 r->samr.out.error_string = talloc_asprintf(mem_ctx,
333 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
334 r->samr.in.domain_name, nt_errstr(status));
338 /* prepare samr_Connect */
339 ZERO_STRUCT(p_handle);
340 sc.in.system_name = NULL;
341 sc.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
342 sc.out.connect_handle = &p_handle;
344 /* 2. do a samr_Connect to get a policy handle */
345 status = dcerpc_samr_Connect(c.pdc.out.dcerpc_pipe, mem_ctx, &sc);
346 if (!NT_STATUS_IS_OK(status)) {
347 r->samr.out.error_string = talloc_asprintf(mem_ctx,
348 "samr_Connect failed: %s\n",
353 /* check result of samr_Connect */
354 if (!NT_STATUS_IS_OK(sc.out.result)) {
355 r->samr.out.error_string = talloc_asprintf(mem_ctx,
356 "samr_Connect failed: %s\n",
357 nt_errstr(sc.out.result));
358 status = sc.out.result;
362 /* prepare samr_LookupDomain */
363 d_name.name = r->samr.in.domain_name;
364 ld.in.connect_handle = &p_handle;
365 ld.in.domain = &d_name;
367 /* 3. do a samr_LookupDomain to get the domain sid */
368 status = dcerpc_samr_LookupDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &ld);
369 if (!NT_STATUS_IS_OK(status)) {
370 r->samr.out.error_string = talloc_asprintf(mem_ctx,
371 "samr_LookupDomain for [%s] failed: %s\n",
372 r->samr.in.domain_name, nt_errstr(status));
376 /* check result of samr_LookupDomain */
377 if (!NT_STATUS_IS_OK(ld.out.result)) {
378 r->samr.out.error_string = talloc_asprintf(mem_ctx,
379 "samr_LookupDomain for [%s] failed: %s\n",
380 r->samr.in.domain_name, nt_errstr(ld.out.result));
381 status = ld.out.result;
385 /* prepare samr_OpenDomain */
386 ZERO_STRUCT(d_handle);
387 od.in.connect_handle = &p_handle;
388 od.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
389 od.in.sid = ld.out.sid;
390 od.out.domain_handle = &d_handle;
392 /* 4. do a samr_OpenDomain to get a domain handle */
393 status = dcerpc_samr_OpenDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &od);
394 if (!NT_STATUS_IS_OK(status)) {
395 r->samr.out.error_string = talloc_asprintf(mem_ctx,
396 "samr_OpenDomain for [%s] failed: %s\n",
397 r->samr.in.domain_name, nt_errstr(status));
401 /* check result of samr_OpenDomain */
402 if (!NT_STATUS_IS_OK(od.out.result)) {
403 r->samr.out.error_string = talloc_asprintf(mem_ctx,
404 "samr_OpenDomain for [%s] failed: %s\n",
405 r->samr.in.domain_name, nt_errstr(od.out.result));
406 status = od.out.result;
410 /* prepare samr_LookupNames */
411 ln.in.domain_handle = &d_handle;
413 ln.in.names = talloc_array_p(mem_ctx, struct samr_Name, 1);
415 r->samr.out.error_string = "Out of Memory";
416 return NT_STATUS_NO_MEMORY;
418 ln.in.names[0].name = r->samr.in.account_name;
420 /* 5. do a samr_LookupNames to get the users rid */
421 status = dcerpc_samr_LookupNames(c.pdc.out.dcerpc_pipe, mem_ctx, &ln);
422 if (!NT_STATUS_IS_OK(status)) {
423 r->samr.out.error_string = talloc_asprintf(mem_ctx,
424 "samr_LookupNames for [%s] failed: %s\n",
425 r->samr.in.account_name, nt_errstr(status));
429 /* check result of samr_LookupNames */
430 if (!NT_STATUS_IS_OK(ln.out.result)) {
431 r->samr.out.error_string = talloc_asprintf(mem_ctx,
432 "samr_LookupNames for [%s] failed: %s\n",
433 r->samr.in.account_name, nt_errstr(ln.out.result));
434 status = ln.out.result;
438 /* check if we got one RID for the user */
439 if (ln.out.rids.count != 1) {
440 r->samr.out.error_string = talloc_asprintf(mem_ctx,
441 "samr_LookupNames for [%s] returns %d RIDs\n",
442 r->samr.in.account_name, ln.out.rids.count);
443 status = NT_STATUS_INVALID_PARAMETER;
447 /* prepare samr_OpenUser */
448 ZERO_STRUCT(u_handle);
449 ou.in.domain_handle = &d_handle;
450 ou.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
451 ou.in.rid = ln.out.rids.ids[0];
452 ou.out.user_handle = &u_handle;
454 /* 6. do a samr_OpenUser to get a user handle */
455 status = dcerpc_samr_OpenUser(c.pdc.out.dcerpc_pipe, mem_ctx, &ou);
456 if (!NT_STATUS_IS_OK(status)) {
457 r->samr.out.error_string = talloc_asprintf(mem_ctx,
458 "samr_OpenUser for [%s] failed: %s\n",
459 r->samr.in.account_name, nt_errstr(status));
463 /* check result of samr_OpenUser */
464 if (!NT_STATUS_IS_OK(ou.out.result)) {
465 r->samr.out.error_string = talloc_asprintf(mem_ctx,
466 "samr_OpenUser for [%s] failed: %s\n",
467 r->samr.in.account_name, nt_errstr(ou.out.result));
468 status = ou.out.result;
472 /* prepare samr_SetUserInfo level 26 */
474 encode_pw_buffer(u_info.info26.password.data, r->samr.in.newpassword, STR_UNICODE);
475 u_info.info26.pw_len = strlen(r->samr.in.newpassword);
477 status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
478 if (!NT_STATUS_IS_OK(status)) {
479 r->samr.out.error_string = talloc_asprintf(mem_ctx,
480 "dcerpc_fetch_session_key failed: %s\n",
485 generate_random_buffer((uint8_t *)confounder, 16);
488 MD5Update(&md5, confounder, 16);
489 MD5Update(&md5, session_key.data, session_key.length);
490 MD5Final(confounded_session_key.data, &md5);
492 arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
493 memcpy(&u_info.info26.password.data[516], confounder, 16);
495 sui.in.user_handle = &u_handle;
496 sui.in.info = &u_info;
499 /* 7. try samr_SetUserInfo level 26 to set the password */
500 status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
501 if (!NT_STATUS_IS_OK(status)) {
502 r->samr.out.error_string = talloc_asprintf(mem_ctx,
503 "SetUserInfo level 26 for [%s] failed: %s\n",
504 r->samr.in.account_name, nt_errstr(status));
508 /* check result of samr_SetUserInfo level 26 */
509 if (!NT_STATUS_IS_OK(sui.out.result)) {
510 r->samr.out.error_string = talloc_asprintf(mem_ctx,
511 "SetUserInfo level 26 for [%s] failed: %s\n",
512 r->samr.in.account_name, nt_errstr(sui.out.result));
513 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
514 status = sui.out.result;
523 /* prepare samr_SetUserInfo level 25 */
525 u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
526 encode_pw_buffer(u_info.info25.password.data, r->samr.in.newpassword, STR_UNICODE);
528 status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
529 if (!NT_STATUS_IS_OK(status)) {
530 r->samr.out.error_string = talloc_asprintf(mem_ctx,
531 "dcerpc_fetch_session_key failed: %s\n",
536 generate_random_buffer((uint8_t *)confounder, 16);
539 MD5Update(&md5, confounder, 16);
540 MD5Update(&md5, session_key.data, session_key.length);
541 MD5Final(confounded_session_key.data, &md5);
543 arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
544 memcpy(&u_info.info25.password.data[516], confounder, 16);
546 sui.in.user_handle = &u_handle;
547 sui.in.info = &u_info;
550 /* 8. try samr_SetUserInfo level 25 to set the password */
551 status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
552 if (!NT_STATUS_IS_OK(status)) {
553 r->samr.out.error_string = talloc_asprintf(mem_ctx,
554 "SetUserInfo level 25 for [%s] failed: %s\n",
555 r->samr.in.account_name, nt_errstr(status));
559 /* check result of samr_SetUserInfo level 25 */
560 if (!NT_STATUS_IS_OK(sui.out.result)) {
561 r->samr.out.error_string = talloc_asprintf(mem_ctx,
562 "SetUserInfo level 25 for [%s] failed: %s\n",
563 r->samr.in.account_name, nt_errstr(sui.out.result));
564 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
565 status = sui.out.result;
574 /* prepare samr_SetUserInfo level 24 */
576 encode_pw_buffer(u_info.info24.password.data, r->samr.in.newpassword, STR_UNICODE);
577 /* w2k3 ignores this length */
578 u_info.info24.pw_len = strlen_m(r->samr.in.newpassword)*2;
580 status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
581 if (!NT_STATUS_IS_OK(status)) {
582 r->samr.out.error_string = talloc_asprintf(mem_ctx,
583 "dcerpc_fetch_session_key failed: %s\n",
588 arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
590 sui.in.user_handle = &u_handle;
591 sui.in.info = &u_info;
594 /* 9. try samr_SetUserInfo level 24 to set the password */
595 status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
596 if (!NT_STATUS_IS_OK(status)) {
597 r->samr.out.error_string = talloc_asprintf(mem_ctx,
598 "SetUserInfo level 24 for [%s] failed: %s\n",
599 r->samr.in.account_name, nt_errstr(status));
603 /* check result of samr_SetUserInfo level 24 */
604 if (!NT_STATUS_IS_OK(sui.out.result)) {
605 r->samr.out.error_string = talloc_asprintf(mem_ctx,
606 "SetUserInfo level 24 for [%s] failed: %s\n",
607 r->samr.in.account_name, nt_errstr(sui.out.result));
608 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
609 status = sui.out.result;
618 /* prepare samr_SetUserInfo level 23 */
620 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
621 encode_pw_buffer(u_info.info23.password.data, r->samr.in.newpassword, STR_UNICODE);
623 status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
624 if (!NT_STATUS_IS_OK(status)) {
625 r->samr.out.error_string = talloc_asprintf(mem_ctx,
626 "dcerpc_fetch_session_key failed: %s\n",
631 arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
633 sui.in.user_handle = &u_handle;
634 sui.in.info = &u_info;
637 /* 10. try samr_SetUserInfo level 23 to set the password */
638 status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
639 if (!NT_STATUS_IS_OK(status)) {
640 r->samr.out.error_string = talloc_asprintf(mem_ctx,
641 "SetUserInfo level 23 for [%s] failed: %s\n",
642 r->samr.in.account_name, nt_errstr(status));
646 /* check result of samr_SetUserInfo level 23 */
647 if (!NT_STATUS_IS_OK(sui.out.result)) {
648 r->samr.out.error_string = talloc_asprintf(mem_ctx,
649 "SetUserInfo level 23 for [%s] failed: %s\n",
650 r->samr.in.account_name, nt_errstr(sui.out.result));
651 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
652 status = sui.out.result;
661 /* close connection */
662 dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
667 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
670 union libnet_SetPassword r2;
672 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
673 r2.samr.in.account_name = r->generic.in.account_name;
674 r2.samr.in.domain_name = r->generic.in.domain_name;
675 r2.samr.in.newpassword = r->generic.in.newpassword;
677 status = libnet_SetPassword(ctx, mem_ctx, &r2);
679 r->generic.out.error_string = r2.samr.out.error_string;
684 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
686 switch (r->generic.level) {
687 case LIBNET_SET_PASSWORD_GENERIC:
688 return libnet_SetPassword_generic(ctx, mem_ctx, r);
689 case LIBNET_SET_PASSWORD_SAMR:
690 return libnet_SetPassword_samr(ctx, mem_ctx, r);
691 case LIBNET_SET_PASSWORD_KRB5:
692 return NT_STATUS_NOT_IMPLEMENTED;
693 case LIBNET_SET_PASSWORD_LDAP:
694 return NT_STATUS_NOT_IMPLEMENTED;
695 case LIBNET_SET_PASSWORD_RAP:
696 return NT_STATUS_NOT_IMPLEMENTED;
699 return NT_STATUS_INVALID_LEVEL;