source/rpcclient/cmd_samr.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    NT Domain Authentication SMB / MSRPC client
   5    Copyright (C) Andrew Tridgell 1994-1997
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-1997
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23
  24
  25 #ifdef SYSLOG
  26 #undef SYSLOG
  27 #endif
  28
  29 #include "includes.h"
  30 #include "nterr.h"
  31
  32 extern int DEBUGLEVEL;
  33
  34 #define DEBUG_TESTING
  35
  36 extern struct cli_state *smb_cli;
  37
  38 extern FILE* out_hnd;
  39
  40
  41 /****************************************************************************
  42 experimental SAM encryted rpc test connection
  43 ****************************************************************************/
  44 void cmd_sam_test(struct client_info *info)
  45 {
  46         fstring srv_name;
  47         fstring domain;
  48         fstring sid;
  49         BOOL res = True;
  50
  51         fstrcpy(sid   , info->dom.level5_sid);
  52         fstrcpy(domain, info->dom.level5_dom);
  53
  54         if (strlen(sid) == 0)
  55         {
  56                 fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
  57                 return;
  58         }
  59
  60         fstrcpy(srv_name, "\\\\");
  61         fstrcat(srv_name, info->myhostname);
  62         strupper(srv_name);
  63
  64
  65         fprintf(out_hnd, "SAM Encryption Test\n");
  66
  67         /* open SAMR session.  */
  68         res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, True) : False;
  69
  70         /* establish a connection. */
  71         res = res ? do_samr_unknown_38(smb_cli, srv_name) : False;
  72
  73         /* close the session */
  74         cli_nt_session_close(smb_cli);
  75
  76         if (res)
  77         {
  78                 DEBUG(5,("cmd_sam_test: succeeded\n"));
  79         }
  80         else
  81         {
  82                 DEBUG(5,("cmd_sam_test: failed\n"));
  83         }
  84 }
  85
  86
  87 /****************************************************************************
  88 experimental SAM users enum.
  89 ****************************************************************************/
  90 void cmd_sam_enum_users(struct client_info *info)
  91 {
  92         fstring srv_name;
  93         fstring domain;
  94         fstring sid;
  95         DOM_SID sid1;
  96         int user_idx;
  97         BOOL res = True;
  98         BOOL request_user_info  = False;
  99         BOOL request_group_info = False;
 100         uint16 num_entries = 0;
 101         uint16 unk_0 = 0x0;
 102         uint16 acb_mask = 0;
 103         uint16 unk_1 = 0x0;
 104         uint32 admin_rid = 0x304; /* absolutely no idea. */
 105         fstring tmp;
 106
 107         fstrcpy(sid   , info->dom.level5_sid);
 108         fstrcpy(domain, info->dom.level5_dom);
 109
 110         if (strlen(sid) == 0)
 111         {
 112                 fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
 113                 return;
 114         }
 115
 116         make_dom_sid(&sid1, sid);
 117
 118         fstrcpy(srv_name, "\\\\");
 119         fstrcat(srv_name, info->dest_host);
 120         strupper(srv_name);
 121
 122         /* a bad way to do token parsing... */
 123         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 124         {
 125                 request_user_info  |= strequal(tmp, "-u");
 126                 request_group_info |= strequal(tmp, "-g");
 127         }
 128
 129         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 130         {
 131                 request_user_info  |= strequal(tmp, "-u");
 132                 request_group_info |= strequal(tmp, "-g");
 133         }
 134
 135 #ifdef DEBUG_TESTING
 136         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 137         {
 138                 num_entries = (uint16)strtoul(tmp, (char**)NULL, 16);
 139         }
 140
 141         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 142         {
 143                 unk_0 = (uint16)strtoul(tmp, (char**)NULL, 16);
 144         }
 145
 146         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 147         {
 148                 acb_mask = (uint16)strtoul(tmp, (char**)NULL, 16);
 149         }
 150
 151         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 152         {
 153                 unk_1 = (uint16)strtoul(tmp, (char**)NULL, 16);
 154         }
 155 #endif
 156
 157         fprintf(out_hnd, "SAM Enumerate Users\n");
 158         fprintf(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
 159                           info->myhostname, srv_name, domain, sid);
 160
 161 #ifdef DEBUG_TESTING
 162         DEBUG(5,("Number of entries:%d unk_0:%04x acb_mask:%04x unk_1:%04x\n",
 163                   num_entries, unk_0, acb_mask, unk_1));
 164 #endif
 165
 166         /* open SAMR session.  negotiate credentials */
 167         res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, False) : False;
 168
 169         /* establish a connection. */
 170         res = res ? do_samr_connect(smb_cli,
 171                                 srv_name, 0x00000020,
 172                                 &info->dom.samr_pol_connect) : False;
 173
 174         /* connect to the domain */
 175         res = res ? do_samr_open_domain(smb_cli,
 176                     &info->dom.samr_pol_connect, admin_rid, &sid1,
 177                     &info->dom.samr_pol_open_domain) : False;
 178
 179         /* read some users */
 180         res = res ? do_samr_enum_dom_users(smb_cli,
 181                                 &info->dom.samr_pol_open_domain,
 182                     num_entries, unk_0, acb_mask, unk_1, 0xffff,
 183                                 &info->dom.sam, &info->dom.num_sam_entries) : False;
 184
 185         if (res && info->dom.num_sam_entries == 0)
 186         {
 187                 fprintf(out_hnd, "No users\n");
 188         }
 189
 190         if (request_user_info || request_group_info)
 191         {
 192                 /* query all the users */
 193                 user_idx = 0;
 194
 195                 while (res && user_idx < info->dom.num_sam_entries)
 196                 {
 197                         uint32 user_rid = info->dom.sam[user_idx].smb_userid;
 198                         SAM_USER_INFO_21 usr;
 199
 200                         fprintf(out_hnd, "User RID: %8x  User Name: %s\n",
 201                                           user_rid,
 202                                           info->dom.sam[user_idx].acct_name);
 203
 204                         if (request_user_info)
 205                         {
 206                                 /* send user info query, level 0x15 */
 207                                 if (get_samr_query_userinfo(smb_cli,
 208                                                         &info->dom.samr_pol_open_domain,
 209                                                         0x15, user_rid, &usr))
 210                                 {
 211                                         display_sam_user_info_21(out_hnd, ACTION_HEADER   , &usr);
 212                                         display_sam_user_info_21(out_hnd, ACTION_ENUMERATE, &usr);
 213                                         display_sam_user_info_21(out_hnd, ACTION_FOOTER   , &usr);
 214                                 }
 215                         }
 216
 217                         if (request_group_info)
 218                         {
 219                                 uint32 num_groups;
 220                                 DOM_GID gid[LSA_MAX_GROUPS];
 221
 222                                 /* send user group query */
 223                                 if (get_samr_query_usergroups(smb_cli,
 224                                                         &info->dom.samr_pol_open_domain,
 225                                                         user_rid, &num_groups, gid))
 226                                 {
 227                                         display_group_rid_info(out_hnd, ACTION_HEADER   , num_groups, gid);
 228                                         display_group_rid_info(out_hnd, ACTION_ENUMERATE, num_groups, gid);
 229                                         display_group_rid_info(out_hnd, ACTION_FOOTER   , num_groups, gid);
 230                                 }
 231                         }
 232
 233                         user_idx++;
 234                 }
 235         }
 236
 237         res = res ? do_samr_close(smb_cli,
 238                     &info->dom.samr_pol_open_domain) : False;
 239
 240         res = res ? do_samr_close(smb_cli,
 241                     &info->dom.samr_pol_connect) : False;
 242
 243         /* close the session */
 244         cli_nt_session_close(smb_cli);
 245
 246         if (info->dom.sam != NULL)
 247         {
 248                 free(info->dom.sam);
 249         }
 250
 251         if (res)
 252         {
 253                 DEBUG(5,("cmd_sam_enum_users: succeeded\n"));
 254         }
 255         else
 256         {
 257                 DEBUG(5,("cmd_sam_enum_users: failed\n"));
 258         }
 259 }
 260
 261
 262 /****************************************************************************
 263 experimental SAM user query.
 264 ****************************************************************************/
 265 void cmd_sam_query_user(struct client_info *info)
 266 {
 267         fstring srv_name;
 268         fstring domain;
 269         fstring sid;
 270         DOM_SID sid1;
 271         int user_idx = 0;  /* FIXME maybe ... */
 272         BOOL res = True;
 273         uint32 admin_rid = 0x304; /* absolutely no idea. */
 274         fstring rid_str ;
 275         fstring info_str;
 276         uint32 user_rid = 0;
 277         uint32 info_level = 0x15;
 278
 279         SAM_USER_INFO_21 usr;
 280
 281         fstrcpy(sid   , info->dom.level5_sid);
 282         fstrcpy(domain, info->dom.level5_dom);
 283
 284         if (strlen(sid) == 0)
 285         {
 286                 fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
 287                 return;
 288         }
 289
 290         make_dom_sid(&sid1, sid);
 291
 292         fstrcpy(srv_name, "\\\\");
 293         fstrcat(srv_name, info->dest_host);
 294         strupper(srv_name);
 295
 296         if (next_token(NULL, rid_str , NULL, sizeof(rid_str )) &&
 297             next_token(NULL, info_str, NULL, sizeof(info_str)))
 298         {
 299                 user_rid   = strtoul(rid_str , (char**)NULL, 16);
 300                 info_level = strtoul(info_str, (char**)NULL, 10);
 301         }
 302
 303         fprintf(out_hnd, "SAM Query User: rid %x info level %d\n",
 304                           user_rid, info_level);
 305         fprintf(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
 306                           info->myhostname, srv_name, domain, sid);
 307
 308         /* open SAMR session.  negotiate credentials */
 309         res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, False) : False;
 310
 311         /* establish a connection. */
 312         res = res ? do_samr_connect(smb_cli,
 313                                 srv_name, 0x00000020,
 314                                 &info->dom.samr_pol_connect) : False;
 315
 316         /* connect to the domain */
 317         res = res ? do_samr_open_domain(smb_cli,
 318                     &info->dom.samr_pol_connect, admin_rid, &sid1,
 319                     &info->dom.samr_pol_open_domain) : False;
 320
 321         fprintf(out_hnd, "User RID: %8x  User Name: %s\n",
 322                           user_rid,
 323                           info->dom.sam[user_idx].acct_name);
 324
 325         /* send user info query, level */
 326         if (get_samr_query_userinfo(smb_cli,
 327                                         &info->dom.samr_pol_open_domain,
 328                                         info_level, user_rid, &usr))
 329         {
 330                 if (info_level == 0x15)
 331                 {
 332                         display_sam_user_info_21(out_hnd, ACTION_HEADER   , &usr);
 333                         display_sam_user_info_21(out_hnd, ACTION_ENUMERATE, &usr);
 334                         display_sam_user_info_21(out_hnd, ACTION_FOOTER   , &usr);
 335                 }
 336         }
 337
 338         res = res ? do_samr_close(smb_cli,
 339                     &info->dom.samr_pol_connect) : False;
 340
 341         res = res ? do_samr_close(smb_cli,
 342                     &info->dom.samr_pol_open_domain) : False;
 343
 344         /* close the session */
 345         cli_nt_session_close(smb_cli);
 346
 347         if (res)
 348         {
 349                 DEBUG(5,("cmd_sam_query_user: succeeded\n"));
 350         }
 351         else
 352         {
 353                 DEBUG(5,("cmd_sam_query_user: failed\n"));
 354         }
 355 }
 356
 357
 358 /****************************************************************************
 359 experimental SAM groups query.
 360 ****************************************************************************/
 361 void cmd_sam_query_groups(struct client_info *info)
 362 {
 363         fstring srv_name;
 364         fstring domain;
 365         fstring sid;
 366         DOM_SID sid1;
 367         BOOL res = True;
 368         fstring info_str;
 369         uint32 switch_value = 2;
 370         uint32 admin_rid = 0x304; /* absolutely no idea. */
 371
 372         fstrcpy(sid   , info->dom.level5_sid);
 373         fstrcpy(domain, info->dom.level5_dom);
 374
 375         if (strlen(sid) == 0)
 376         {
 377                 fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
 378                 return;
 379         }
 380
 381         make_dom_sid(&sid1, sid);
 382
 383         fstrcpy(srv_name, "\\\\");
 384         fstrcat(srv_name, info->dest_host);
 385         strupper(srv_name);
 386
 387         if (next_token(NULL, info_str, NULL, sizeof(info_str)))
 388         {
 389                 switch_value = strtoul(info_str, (char**)NULL, 10);
 390         }
 391
 392         fprintf(out_hnd, "SAM Query Groups: info level %d\n", switch_value);
 393         fprintf(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
 394                           info->myhostname, srv_name, domain, sid);
 395
 396         /* open SAMR session.  negotiate credentials */
 397         res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, False) : False;
 398
 399         /* establish a connection. */
 400         res = res ? do_samr_connect(smb_cli,
 401                                 srv_name, 0x00000020,
 402                                 &info->dom.samr_pol_connect) : False;
 403
 404         /* connect to the domain */
 405         res = res ? do_samr_open_domain(smb_cli,
 406                     &info->dom.samr_pol_connect, admin_rid, &sid1,
 407                     &info->dom.samr_pol_open_domain) : False;
 408
 409         /* send a samr 0x8 command */
 410         res = res ? do_samr_unknown_8(smb_cli,
 411                     &info->dom.samr_pol_open_domain, switch_value) : False;
 412
 413         res = res ? do_samr_close(smb_cli,
 414                     &info->dom.samr_pol_connect) : False;
 415
 416         res = res ? do_samr_close(smb_cli,
 417                     &info->dom.samr_pol_open_domain) : False;
 418
 419         /* close the session */
 420         cli_nt_session_close(smb_cli);
 421
 422         if (res)
 423         {
 424                 DEBUG(5,("cmd_sam_query_groups: succeeded\n"));
 425         }
 426         else
 427         {
 428                 DEBUG(5,("cmd_sam_query_groups: failed\n"));
 429         }
 430 }
 431
 432
 433 /****************************************************************************
 434 experimental SAM aliases query.
 435 ****************************************************************************/
 436 void cmd_sam_enum_aliases(struct client_info *info)
 437 {
 438         fstring srv_name;
 439         fstring domain;
 440         fstring sid;
 441         DOM_SID sid1;
 442         BOOL res = True;
 443         BOOL request_user_info  = False;
 444         BOOL request_alias_info = False;
 445         uint32 admin_rid = 0x304; /* absolutely no idea. */
 446         fstring tmp;
 447
 448         uint32 num_aliases = 3;
 449         uint32 alias_rid[3] = { DOMAIN_GROUP_RID_ADMINS, DOMAIN_GROUP_RID_USERS, DOMAIN_GROUP_RID_GUESTS };
 450         fstring alias_names [3];
 451         uint32  num_als_usrs[3];
 452
 453         fstrcpy(sid   , info->dom.level5_sid);
 454         fstrcpy(domain, info->dom.level5_dom);
 455
 456         if (strlen(sid) == 0)
 457         {
 458                 fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
 459                 return;
 460         }
 461
 462         make_dom_sid(&sid1, sid);
 463
 464         fstrcpy(srv_name, "\\\\");
 465         fstrcat(srv_name, info->dest_host);
 466         strupper(srv_name);
 467
 468         /* a bad way to do token parsing... */
 469         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 470         {
 471                 request_user_info  |= strequal(tmp, "-u");
 472                 request_alias_info |= strequal(tmp, "-g");
 473         }
 474
 475         if (next_token(NULL, tmp, NULL, sizeof(tmp)))
 476         {
 477                 request_user_info  |= strequal(tmp, "-u");
 478                 request_alias_info |= strequal(tmp, "-g");
 479         }
 480
 481         fprintf(out_hnd, "SAM Enumerate Aliases\n");
 482         fprintf(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
 483                           info->myhostname, srv_name, domain, sid);
 484
 485         /* open SAMR session.  negotiate credentials */
 486         res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, False) : False;
 487
 488         /* establish a connection. */
 489         res = res ? do_samr_connect(smb_cli,
 490                                 srv_name, 0x00000020,
 491                                 &info->dom.samr_pol_connect) : False;
 492
 493         /* connect to the domain */
 494         res = res ? do_samr_open_domain(smb_cli,
 495                     &info->dom.samr_pol_connect, admin_rid, &sid1,
 496                     &info->dom.samr_pol_open_domain) : False;
 497
 498         /* send a query on the aliase */
 499         res = res ? do_samr_query_unknown_12(smb_cli,
 500                     &info->dom.samr_pol_open_domain, admin_rid, num_aliases, alias_rid,
 501                     &num_aliases, alias_names, num_als_usrs) : False;
 502
 503         if (res)
 504         {
 505                 display_alias_name_info(out_hnd, ACTION_HEADER   , num_aliases, alias_names, num_als_usrs);
 506                 display_alias_name_info(out_hnd, ACTION_ENUMERATE, num_aliases, alias_names, num_als_usrs);
 507                 display_alias_name_info(out_hnd, ACTION_FOOTER   , num_aliases, alias_names, num_als_usrs);
 508         }
 509
 510 #if 0
 511
 512         /* read some users */
 513         res = res ? do_samr_enum_dom_users(smb_cli,
 514                                 &info->dom.samr_pol_open_domain,
 515                     num_entries, unk_0, acb_mask, unk_1, 0xffff,
 516                                 info->dom.sam, &info->dom.num_sam_entries) : False;
 517
 518         if (res && info->dom.num_sam_entries == 0)
 519         {
 520                 fprintf(out_hnd, "No users\n");
 521         }
 522
 523         if (request_user_info || request_alias_info)
 524         {
 525                 /* query all the users */
 526                 user_idx = 0;
 527
 528                 while (res && user_idx < info->dom.num_sam_entries)
 529                 {
 530                         uint32 user_rid = info->dom.sam[user_idx].smb_userid;
 531                         SAM_USER_INFO_21 usr;
 532
 533                         fprintf(out_hnd, "User RID: %8x  User Name: %s\n",
 534                                           user_rid,
 535                                           info->dom.sam[user_idx].acct_name);
 536
 537                         if (request_user_info)
 538                         {
 539                                 /* send user info query, level 0x15 */
 540                                 if (get_samr_query_userinfo(smb_cli,
 541                                                         &info->dom.samr_pol_open_domain,
 542                                                         0x15, user_rid, &usr))
 543                                 {
 544                                         display_sam_user_info_21(out_hnd, ACTION_HEADER   , &usr);
 545                                         display_sam_user_info_21(out_hnd, ACTION_ENUMERATE, &usr);
 546                                         display_sam_user_info_21(out_hnd, ACTION_FOOTER   , &usr);
 547                                 }
 548                         }
 549
 550                         if (request_alias_info)
 551                         {
 552                                 uint32 num_aliases;
 553                                 DOM_GID gid[LSA_MAX_GROUPS];
 554
 555                                 /* send user aliase query */
 556                                 if (get_samr_query_useraliases(smb_cli,
 557                                                         &info->dom.samr_pol_open_domain,
 558                                                         user_rid, &num_aliases, gid))
 559                                 {
 560                                         display_alias_info(out_hnd, ACTION_HEADER   , num_aliases, gid);
 561                                         display_alias_info(out_hnd, ACTION_ENUMERATE, num_aliases, gid);
 562                                         display_alias_info(out_hnd, ACTION_FOOTER   , num_aliases, gid);
 563                                 }
 564                         }
 565
 566                         user_idx++;
 567                 }
 568         }
 569 #endif
 570
 571         res = res ? do_samr_close(smb_cli,
 572                     &info->dom.samr_pol_connect) : False;
 573
 574         res = res ? do_samr_close(smb_cli,
 575                     &info->dom.samr_pol_open_domain) : False;
 576
 577         /* close the session */
 578         cli_nt_session_close(smb_cli);
 579
 580         if (res)
 581         {
 582                 DEBUG(5,("cmd_sam_enum_users: succeeded\n"));
 583         }
 584         else
 585         {
 586                 DEBUG(5,("cmd_sam_enum_users: failed\n"));
 587         }
 588 }
 589
 590