source/libnet/libnet_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22 #include "librpc/gen_ndr/ndr_samr.h"
  23
  24 /*
  25  * do a password change using DCERPC/SAMR calls
  26  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
  27  * 2. try samr_ChangePasswordUser3
  28  * 3. try samr_ChangePasswordUser2
  29  * 4. try samr_OemChangePasswordUser2
  30  * (not yet: 5. try samr_ChangePasswordUser)
  31  */
  32 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
  33 {
  34         NTSTATUS status;
  35         union libnet_rpc_connect c;
  36 #if 0
  37         struct policy_handle user_handle;
  38         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
  39         struct samr_ChangePasswordUser pw;
  40 #endif
  41         struct samr_OemChangePasswordUser2 oe2;
  42         struct samr_ChangePasswordUser2 pw2;
  43         struct samr_ChangePasswordUser3 pw3;
  44         struct samr_Name server, account;
  45         struct samr_AsciiName a_server, a_account;
  46         struct samr_CryptPassword nt_pass, lm_pass;
  47         struct samr_Password nt_verifier, lm_verifier;
  48         uint8_t old_nt_hash[16], new_nt_hash[16];
  49         uint8_t old_lm_hash[16], new_lm_hash[16];
  50
  51         /* prepare connect to the SAMR pipe of the users domain PDC */
  52         c.pdc.level                     = LIBNET_RPC_CONNECT_PDC;
  53         c.pdc.in.domain_name            = r->samr.in.domain_name;
  54         c.pdc.in.dcerpc_iface_name      = DCERPC_SAMR_NAME;
  55         c.pdc.in.dcerpc_iface_uuid      = DCERPC_SAMR_UUID;
  56         c.pdc.in.dcerpc_iface_version   = DCERPC_SAMR_VERSION;
  57
  58         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
  59         status = libnet_rpc_connect(ctx, mem_ctx, &c);
  60         if (!NT_STATUS_IS_OK(status)) {
  61                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
  62                                                 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
  63                                                 r->samr.in.domain_name, nt_errstr(status));
  64                 return status;
  65         }
  66
  67         /* prepare password change for account */
  68         server.name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
  69         account.name = r->samr.in.account_name;
  70
  71         E_md4hash(r->samr.in.oldpassword, old_nt_hash);
  72         E_md4hash(r->samr.in.newpassword, new_nt_hash);
  73
  74         E_deshash(r->samr.in.oldpassword, old_lm_hash);
  75         E_deshash(r->samr.in.newpassword, new_lm_hash);
  76
  77         /* prepare samr_ChangePasswordUser3 */
  78         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
  79         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
  80         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
  81
  82         encode_pw_buffer(nt_pass.data,  r->samr.in.newpassword, STR_UNICODE);
  83         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
  84         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
  85
  86         pw3.in.server = &server;
  87         pw3.in.account = &account;
  88         pw3.in.nt_password = &nt_pass;
  89         pw3.in.nt_verifier = &nt_verifier;
  90         pw3.in.lm_change = 1;
  91         pw3.in.lm_password = &lm_pass;
  92         pw3.in.lm_verifier = &lm_verifier;
  93         pw3.in.password3 = NULL;
  94
  95         /* 2. try samr_ChangePasswordUser3 */
  96         status = dcerpc_samr_ChangePasswordUser3(c.pdc.out.dcerpc_pipe, mem_ctx, &pw3);
  97         if (!NT_STATUS_IS_OK(status)) {
  98                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
  99                                                 "samr_ChangePasswordUser3 failed: %s\n",
 100                                                 nt_errstr(status));
 101                 goto ChangePasswordUser2;
 102         }
 103
 104         /* check result of samr_ChangePasswordUser3 */
 105         if (!NT_STATUS_IS_OK(pw3.out.result)) {
 106                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 107                                                 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
 108                                                 r->samr.in.domain_name, r->samr.in.account_name,
 109                                                 nt_errstr(pw3.out.result));
 110                                                 /* TODO: give the reason of the reject */
 111                 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 112                         status = pw3.out.result;
 113                         goto disconnect;
 114                 }
 115                 goto ChangePasswordUser2;
 116         }
 117
 118         goto disconnect;
 119
 120 ChangePasswordUser2:
 121         /* prepare samr_ChangePasswordUser2 */
 122         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
 123         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 124         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 125
 126         encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
 127         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
 128         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
 129
 130         pw2.in.server = &server;
 131         pw2.in.account = &account;
 132         pw2.in.nt_password = &nt_pass;
 133         pw2.in.nt_verifier = &nt_verifier;
 134         pw2.in.lm_change = 1;
 135         pw2.in.lm_password = &lm_pass;
 136         pw2.in.lm_verifier = &lm_verifier;
 137
 138         /* 3. try samr_ChangePasswordUser2 */
 139         status = dcerpc_samr_ChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &pw2);
 140         if (!NT_STATUS_IS_OK(status)) {
 141                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 142                                                 "samr_ChangePasswordUser2 failed: %s\n",
 143                                                 nt_errstr(status));
 144                 goto OemChangePasswordUser2;
 145         }
 146
 147         /* check result of samr_ChangePasswordUser2 */
 148         if (!NT_STATUS_IS_OK(pw2.out.result)) {
 149                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 150                                                 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
 151                                                 r->samr.in.domain_name, r->samr.in.account_name,
 152                                                 nt_errstr(pw2.out.result));
 153                 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 154                         status = pw2.out.result;
 155                         goto disconnect;
 156                 }
 157                 goto OemChangePasswordUser2;
 158         }
 159
 160         goto disconnect;
 161
 162 OemChangePasswordUser2:
 163         /* prepare samr_OemChangePasswordUser2 */
 164         a_server.name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
 165         a_account.name = r->samr.in.account_name;
 166
 167         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
 168         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 169         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 170
 171         oe2.in.server = &a_server;
 172         oe2.in.account = &a_account;
 173         oe2.in.password = &lm_pass;
 174         oe2.in.hash = &lm_verifier;
 175
 176         /* 4. try samr_OemChangePasswordUser2 */
 177         status = dcerpc_samr_OemChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &oe2);
 178         if (!NT_STATUS_IS_OK(status)) {
 179                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 180                                                 "samr_OemChangePasswordUser2 failed: %s\n",
 181                                                 nt_errstr(status));
 182                 goto ChangePasswordUser;
 183         }
 184
 185         /* check result of samr_OemChangePasswordUser2 */
 186         if (!NT_STATUS_IS_OK(oe2.out.result)) {
 187                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 188                                                 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
 189                                                 r->samr.in.domain_name, r->samr.in.account_name,
 190                                                 nt_errstr(oe2.out.result));
 191                 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 192                         status = oe2.out.result;
 193                         goto disconnect;
 194                 }
 195                 goto ChangePasswordUser;
 196         }
 197
 198         goto disconnect;
 199
 200 ChangePasswordUser:
 201 #if 0
 202         /* prepare samr_ChangePasswordUser */
 203         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
 204         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
 205         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
 206         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
 207         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
 208         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
 209
 210         /* TODO: ask for a user_handle */
 211         pw.in.handle = &user_handle;
 212         pw.in.lm_present = 1;
 213         pw.in.old_lm_crypted = &hash1;
 214         pw.in.new_lm_crypted = &hash2;
 215         pw.in.nt_present = 1;
 216         pw.in.old_nt_crypted = &hash3;
 217         pw.in.new_nt_crypted = &hash4;
 218         pw.in.cross1_present = 1;
 219         pw.in.nt_cross = &hash5;
 220         pw.in.cross2_present = 1;
 221         pw.in.lm_cross = &hash6;
 222
 223         /* 5. try samr_ChangePasswordUser */
 224         status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
 225         if (!NT_STATUS_IS_OK(status)) {
 226                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 227                                                 "samr_ChangePasswordUser failed: %s\n",
 228                                                 nt_errstr(status));
 229                 goto disconnect;
 230         }
 231
 232         /* check result of samr_ChangePasswordUser */
 233         if (!NT_STATUS_IS_OK(pw.out.result)) {
 234                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 235                                                 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
 236                                                 r->samr.in.domain_name, r->samr.in.account_name,
 237                                                 nt_errstr(pw.out.result));
 238                 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 239                         status = pw.out.result;
 240                         goto disconnect;
 241                 }
 242                 goto disconnect;
 243         }
 244 #endif
 245 disconnect:
 246         /* close connection */
 247         dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
 248
 249         return status;
 250 }
 251
 252 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 253 {
 254         NTSTATUS status;
 255         union libnet_ChangePassword r2;
 256
 257         r2.samr.level           = LIBNET_CHANGE_PASSWORD_SAMR;
 258         r2.samr.in.account_name = r->generic.in.account_name;
 259         r2.samr.in.domain_name  = r->generic.in.domain_name;
 260         r2.samr.in.oldpassword  = r->generic.in.oldpassword;
 261         r2.samr.in.newpassword  = r->generic.in.newpassword;
 262
 263         status = libnet_ChangePassword(ctx, mem_ctx, &r2);
 264
 265         r->generic.out.error_string = r2.samr.out.error_string;
 266
 267         return status;
 268 }
 269
 270 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 271 {
 272         switch (r->generic.level) {
 273                 case LIBNET_CHANGE_PASSWORD_GENERIC:
 274                         return libnet_ChangePassword_generic(ctx, mem_ctx, r);
 275                 case LIBNET_CHANGE_PASSWORD_SAMR:
 276                         return libnet_ChangePassword_samr(ctx, mem_ctx, r);
 277                 case LIBNET_CHANGE_PASSWORD_KRB5:
 278                         return NT_STATUS_NOT_IMPLEMENTED;
 279                 case LIBNET_CHANGE_PASSWORD_LDAP:
 280                         return NT_STATUS_NOT_IMPLEMENTED;
 281                 case LIBNET_CHANGE_PASSWORD_RAP:
 282                         return NT_STATUS_NOT_IMPLEMENTED;
 283         }
 284
 285         return NT_STATUS_INVALID_LEVEL;
 286 }
 287
 288 /*
 289  * set a password with DCERPC/SAMR calls
 290  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
 291  *    is it correct to contact the the pdc of the domain of the user who's password should be set?
 292  * 2. do a samr_Connect to get a policy handle
 293  * 3. do a samr_LookupDomain to get the domain sid
 294  * 4. do a samr_OpenDomain to get a domain handle
 295  * 5. do a samr_LookupNames to get the users rid
 296  * 6. do a samr_OpenUser to get a user handle
 297  * 7. try samr_SetUserInfo level 26 to set the password
 298  * 8. try samr_SetUserInfo level 25 to set the password
 299  * 8. try samr_SetUserInfo level 24 to set the password
 300  *10. try samr_SetUserInfo level 23 to set the password
 301  */
 302 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 303 {
 304         NTSTATUS status;
 305         union libnet_rpc_connect c;
 306         struct samr_Connect sc;
 307         struct policy_handle p_handle;
 308         struct samr_LookupDomain ld;
 309         struct samr_Name d_name;
 310         struct samr_OpenDomain od;
 311         struct policy_handle d_handle;
 312         struct samr_LookupNames ln;
 313         struct samr_OpenUser ou;
 314         struct policy_handle u_handle;
 315         struct samr_SetUserInfo sui;
 316         union samr_UserInfo u_info;
 317         DATA_BLOB session_key;
 318         DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 319         uint8_t confounder[16];
 320         struct MD5Context md5;
 321
 322         /* prepare connect to the SAMR pipe of users domain PDC */
 323         c.pdc.level                     = LIBNET_RPC_CONNECT_PDC;
 324         c.pdc.in.domain_name            = r->samr.in.domain_name;
 325         c.pdc.in.dcerpc_iface_name      = DCERPC_SAMR_NAME;
 326         c.pdc.in.dcerpc_iface_uuid      = DCERPC_SAMR_UUID;
 327         c.pdc.in.dcerpc_iface_version   = DCERPC_SAMR_VERSION;
 328
 329         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
 330         status = libnet_rpc_connect(ctx, mem_ctx, &c);
 331         if (!NT_STATUS_IS_OK(status)) {
 332                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 333                                                 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
 334                                                 r->samr.in.domain_name, nt_errstr(status));
 335                 return status;
 336         }
 337
 338         /* prepare samr_Connect */
 339         ZERO_STRUCT(p_handle);
 340         sc.in.system_name = NULL;
 341         sc.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 342         sc.out.connect_handle = &p_handle;
 343
 344         /* 2. do a samr_Connect to get a policy handle */
 345         status = dcerpc_samr_Connect(c.pdc.out.dcerpc_pipe, mem_ctx, &sc);
 346         if (!NT_STATUS_IS_OK(status)) {
 347                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 348                                                 "samr_Connect failed: %s\n",
 349                                                 nt_errstr(status));
 350                 goto disconnect;
 351         }
 352
 353         /* check result of samr_Connect */
 354         if (!NT_STATUS_IS_OK(sc.out.result)) {
 355                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 356                                                 "samr_Connect failed: %s\n",
 357                                                 nt_errstr(sc.out.result));
 358                 status = sc.out.result;
 359                 goto disconnect;
 360         }
 361
 362         /* prepare samr_LookupDomain */
 363         d_name.name = r->samr.in.domain_name;
 364         ld.in.connect_handle = &p_handle;
 365         ld.in.domain = &d_name;
 366
 367         /* 3. do a samr_LookupDomain to get the domain sid */
 368         status = dcerpc_samr_LookupDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &ld);
 369         if (!NT_STATUS_IS_OK(status)) {
 370                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 371                                                 "samr_LookupDomain for [%s] failed: %s\n",
 372                                                 r->samr.in.domain_name, nt_errstr(status));
 373                 goto disconnect;
 374         }
 375
 376         /* check result of samr_LookupDomain */
 377         if (!NT_STATUS_IS_OK(ld.out.result)) {
 378                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 379                                                 "samr_LookupDomain for [%s] failed: %s\n",
 380                                                 r->samr.in.domain_name, nt_errstr(ld.out.result));
 381                 status = ld.out.result;
 382                 goto disconnect;
 383         }
 384
 385         /* prepare samr_OpenDomain */
 386         ZERO_STRUCT(d_handle);
 387         od.in.connect_handle = &p_handle;
 388         od.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 389         od.in.sid = ld.out.sid;
 390         od.out.domain_handle = &d_handle;
 391
 392         /* 4. do a samr_OpenDomain to get a domain handle */
 393         status = dcerpc_samr_OpenDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &od);
 394         if (!NT_STATUS_IS_OK(status)) {
 395                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 396                                                 "samr_OpenDomain for [%s] failed: %s\n",
 397                                                 r->samr.in.domain_name, nt_errstr(status));
 398                 goto disconnect;
 399         }
 400
 401         /* check result of samr_OpenDomain */
 402         if (!NT_STATUS_IS_OK(od.out.result)) {
 403                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 404                                                 "samr_OpenDomain for [%s] failed: %s\n",
 405                                                 r->samr.in.domain_name, nt_errstr(od.out.result));
 406                 status = od.out.result;
 407                 goto disconnect;
 408         }
 409
 410         /* prepare samr_LookupNames */
 411         ln.in.domain_handle = &d_handle;
 412         ln.in.num_names = 1;
 413         ln.in.names = talloc_array_p(mem_ctx, struct samr_Name, 1);
 414         if (!ln.in.names) {
 415                 r->samr.out.error_string = "Out of Memory";
 416                 return NT_STATUS_NO_MEMORY;
 417         }
 418         ln.in.names[0].name = r->samr.in.account_name;
 419
 420         /* 5. do a samr_LookupNames to get the users rid */
 421         status = dcerpc_samr_LookupNames(c.pdc.out.dcerpc_pipe, mem_ctx, &ln);
 422         if (!NT_STATUS_IS_OK(status)) {
 423                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 424                                                 "samr_LookupNames for [%s] failed: %s\n",
 425                                                 r->samr.in.account_name, nt_errstr(status));
 426                 goto disconnect;
 427         }
 428
 429         /* check result of samr_LookupNames */
 430         if (!NT_STATUS_IS_OK(ln.out.result)) {
 431                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 432                                                 "samr_LookupNames for [%s] failed: %s\n",
 433                                                 r->samr.in.account_name, nt_errstr(ln.out.result));
 434                 status = ln.out.result;
 435                 goto disconnect;
 436         }
 437
 438         /* check if we got one RID for the user */
 439         if (ln.out.rids.count != 1) {
 440                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 441                                                 "samr_LookupNames for [%s] returns %d RIDs\n",
 442                                                 r->samr.in.account_name, ln.out.rids.count);
 443                 status = NT_STATUS_INVALID_PARAMETER;
 444                 goto disconnect;
 445         }
 446
 447         /* prepare samr_OpenUser */
 448         ZERO_STRUCT(u_handle);
 449         ou.in.domain_handle = &d_handle;
 450         ou.in.access_mask = SEC_RIGHTS_MAXIMUM_ALLOWED;
 451         ou.in.rid = ln.out.rids.ids[0];
 452         ou.out.user_handle = &u_handle;
 453
 454         /* 6. do a samr_OpenUser to get a user handle */
 455         status = dcerpc_samr_OpenUser(c.pdc.out.dcerpc_pipe, mem_ctx, &ou);
 456         if (!NT_STATUS_IS_OK(status)) {
 457                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 458                                                 "samr_OpenUser for [%s] failed: %s\n",
 459                                                 r->samr.in.account_name, nt_errstr(status));
 460                 goto disconnect;
 461         }
 462
 463         /* check result of samr_OpenUser */
 464         if (!NT_STATUS_IS_OK(ou.out.result)) {
 465                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 466                                                 "samr_OpenUser for [%s] failed: %s\n",
 467                                                 r->samr.in.account_name, nt_errstr(ou.out.result));
 468                 status = ou.out.result;
 469                 goto disconnect;
 470         }
 471
 472         /* prepare samr_SetUserInfo level 26 */
 473         ZERO_STRUCT(u_info);
 474         encode_pw_buffer(u_info.info26.password.data, r->samr.in.newpassword, STR_UNICODE);
 475         u_info.info26.pw_len = strlen(r->samr.in.newpassword);
 476
 477         status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
 478         if (!NT_STATUS_IS_OK(status)) {
 479                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 480                                                 "dcerpc_fetch_session_key failed: %s\n",
 481                                                 nt_errstr(status));
 482                 goto disconnect;
 483         }
 484
 485         generate_random_buffer((uint8_t *)confounder, 16);
 486
 487         MD5Init(&md5);
 488         MD5Update(&md5, confounder, 16);
 489         MD5Update(&md5, session_key.data, session_key.length);
 490         MD5Final(confounded_session_key.data, &md5);
 491
 492         arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
 493         memcpy(&u_info.info26.password.data[516], confounder, 16);
 494
 495         sui.in.user_handle = &u_handle;
 496         sui.in.info = &u_info;
 497         sui.in.level = 26;
 498
 499         /* 7. try samr_SetUserInfo level 26 to set the password */
 500         status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
 501         if (!NT_STATUS_IS_OK(status)) {
 502                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 503                                                 "SetUserInfo level 26 for [%s] failed: %s\n",
 504                                                 r->samr.in.account_name, nt_errstr(status));
 505                 goto UserInfo25;
 506         }
 507
 508         /* check result of samr_SetUserInfo level 26 */
 509         if (!NT_STATUS_IS_OK(sui.out.result)) {
 510                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 511                                                 "SetUserInfo level 26 for [%s] failed: %s\n",
 512                                                 r->samr.in.account_name, nt_errstr(sui.out.result));
 513                 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
 514                         status = sui.out.result;
 515                         goto disconnect;
 516                 }
 517                 goto UserInfo25;
 518         }
 519
 520         goto disconnect;
 521
 522 UserInfo25:
 523         /* prepare samr_SetUserInfo level 25 */
 524         ZERO_STRUCT(u_info);
 525         u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
 526         encode_pw_buffer(u_info.info25.password.data, r->samr.in.newpassword, STR_UNICODE);
 527
 528         status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
 529         if (!NT_STATUS_IS_OK(status)) {
 530                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 531                                                 "dcerpc_fetch_session_key failed: %s\n",
 532                                                 nt_errstr(status));
 533                 goto disconnect;
 534         }
 535
 536         generate_random_buffer((uint8_t *)confounder, 16);
 537
 538         MD5Init(&md5);
 539         MD5Update(&md5, confounder, 16);
 540         MD5Update(&md5, session_key.data, session_key.length);
 541         MD5Final(confounded_session_key.data, &md5);
 542
 543         arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
 544         memcpy(&u_info.info25.password.data[516], confounder, 16);
 545
 546         sui.in.user_handle = &u_handle;
 547         sui.in.info = &u_info;
 548         sui.in.level = 25;
 549
 550         /* 8. try samr_SetUserInfo level 25 to set the password */
 551         status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
 552         if (!NT_STATUS_IS_OK(status)) {
 553                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 554                                                 "SetUserInfo level 25 for [%s] failed: %s\n",
 555                                                 r->samr.in.account_name, nt_errstr(status));
 556                 goto UserInfo24;
 557         }
 558
 559         /* check result of samr_SetUserInfo level 25 */
 560         if (!NT_STATUS_IS_OK(sui.out.result)) {
 561                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 562                                                 "SetUserInfo level 25 for [%s] failed: %s\n",
 563                                                 r->samr.in.account_name, nt_errstr(sui.out.result));
 564                 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
 565                         status = sui.out.result;
 566                         goto disconnect;
 567                 }
 568                 goto UserInfo24;
 569         }
 570
 571         goto disconnect;
 572
 573 UserInfo24:
 574         /* prepare samr_SetUserInfo level 24 */
 575         ZERO_STRUCT(u_info);
 576         encode_pw_buffer(u_info.info24.password.data, r->samr.in.newpassword, STR_UNICODE);
 577         /* w2k3 ignores this length */
 578         u_info.info24.pw_len = strlen_m(r->samr.in.newpassword)*2;
 579
 580         status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
 581         if (!NT_STATUS_IS_OK(status)) {
 582                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 583                                                 "dcerpc_fetch_session_key failed: %s\n",
 584                                                 nt_errstr(status));
 585                 goto disconnect;
 586         }
 587
 588         arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
 589
 590         sui.in.user_handle = &u_handle;
 591         sui.in.info = &u_info;
 592         sui.in.level = 24;
 593
 594         /* 9. try samr_SetUserInfo level 24 to set the password */
 595         status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
 596         if (!NT_STATUS_IS_OK(status)) {
 597                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 598                                                 "SetUserInfo level 24 for [%s] failed: %s\n",
 599                                                 r->samr.in.account_name, nt_errstr(status));
 600                 goto UserInfo23;
 601         }
 602
 603         /* check result of samr_SetUserInfo level 24 */
 604         if (!NT_STATUS_IS_OK(sui.out.result)) {
 605                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 606                                                 "SetUserInfo level 24 for [%s] failed: %s\n",
 607                                                 r->samr.in.account_name, nt_errstr(sui.out.result));
 608                 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
 609                         status = sui.out.result;
 610                         goto disconnect;
 611                 }
 612                 goto UserInfo23;
 613         }
 614
 615         goto disconnect;
 616
 617 UserInfo23:
 618         /* prepare samr_SetUserInfo level 23 */
 619         ZERO_STRUCT(u_info);
 620         u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
 621         encode_pw_buffer(u_info.info23.password.data, r->samr.in.newpassword, STR_UNICODE);
 622
 623         status = dcerpc_fetch_session_key(c.pdc.out.dcerpc_pipe, &session_key);
 624         if (!NT_STATUS_IS_OK(status)) {
 625                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 626                                                 "dcerpc_fetch_session_key failed: %s\n",
 627                                                 nt_errstr(status));
 628                 goto disconnect;
 629         }
 630
 631         arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
 632
 633         sui.in.user_handle = &u_handle;
 634         sui.in.info = &u_info;
 635         sui.in.level = 23;
 636
 637         /* 10. try samr_SetUserInfo level 23 to set the password */
 638         status = dcerpc_samr_SetUserInfo(c.pdc.out.dcerpc_pipe, mem_ctx, &sui);
 639         if (!NT_STATUS_IS_OK(status)) {
 640                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 641                                                 "SetUserInfo level 23 for [%s] failed: %s\n",
 642                                                 r->samr.in.account_name, nt_errstr(status));
 643                 goto disconnect;
 644         }
 645
 646         /* check result of samr_SetUserInfo level 23 */
 647         if (!NT_STATUS_IS_OK(sui.out.result)) {
 648                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 649                                                 "SetUserInfo level 23 for [%s] failed: %s\n",
 650                                                 r->samr.in.account_name, nt_errstr(sui.out.result));
 651                 if (NT_STATUS_EQUAL(sui.out.result, NT_STATUS_WRONG_PASSWORD)) {
 652                         status = sui.out.result;
 653                         goto disconnect;
 654                 }
 655                 goto disconnect;
 656         }
 657
 658         goto disconnect;
 659
 660 disconnect:
 661         /* close connection */
 662         dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
 663
 664         return status;
 665 }
 666
 667 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 668 {
 669         NTSTATUS status;
 670         union libnet_SetPassword r2;
 671
 672         r2.samr.level           = LIBNET_SET_PASSWORD_SAMR;
 673         r2.samr.in.account_name = r->generic.in.account_name;
 674         r2.samr.in.domain_name  = r->generic.in.domain_name;
 675         r2.samr.in.newpassword  = r->generic.in.newpassword;
 676
 677         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 678
 679         r->generic.out.error_string = r2.samr.out.error_string;
 680
 681         return status;
 682 }
 683
 684 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 685 {
 686         switch (r->generic.level) {
 687                 case LIBNET_SET_PASSWORD_GENERIC:
 688                         return libnet_SetPassword_generic(ctx, mem_ctx, r);
 689                 case LIBNET_SET_PASSWORD_SAMR:
 690                         return libnet_SetPassword_samr(ctx, mem_ctx, r);
 691                 case LIBNET_SET_PASSWORD_KRB5:
 692                         return NT_STATUS_NOT_IMPLEMENTED;
 693                 case LIBNET_SET_PASSWORD_LDAP:
 694                         return NT_STATUS_NOT_IMPLEMENTED;
 695                 case LIBNET_SET_PASSWORD_RAP:
 696                         return NT_STATUS_NOT_IMPLEMENTED;
 697         }
 698
 699         return NT_STATUS_INVALID_LEVEL;
 700 }