source/rpcclient/cmd_samr.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    NT Domain Authentication SMB / MSRPC client
   5    Copyright (C) Andrew Tridgell              1994-2000,
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
   7    Copyright (C) Elrond                            2000
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24
  25
  26 #ifdef SYSLOG
  27 #undef SYSLOG
  28 #endif
  29
  30 #include "includes.h"
  31 #include "rpc_parse.h"
  32 #include "nterr.h"
  33 #include "rpcclient.h"
  34
  35 extern int DEBUGLEVEL;
  36
  37 #define DEBUG_TESTING
  38
  39 extern struct user_creds *usr_creds;
  40
  41 extern FILE *out_hnd;
  42
  43 static void sam_display_domain(const char *domain)
  44 {
  45         report(out_hnd, "Domain Name: %s\n", domain);
  46 }
  47
  48 static void sam_display_dom_info(const char *domain, const DOM_SID * sid,
  49                                  uint32 switch_value, SAM_UNK_CTR * ctr)
  50 {
  51         fstring sidstr;
  52         sid_to_string(sidstr, sid);
  53         report(out_hnd, "Domain Name:\t%s\tSID:\t%s\n", domain, sidstr);
  54         display_sam_unk_ctr(out_hnd, ACTION_HEADER, switch_value, ctr);
  55         display_sam_unk_ctr(out_hnd, ACTION_ENUMERATE, switch_value, ctr);
  56         display_sam_unk_ctr(out_hnd, ACTION_FOOTER, switch_value, ctr);
  57 }
  58
  59 static void sam_display_alias_info(const char *domain, const DOM_SID * sid,
  60                                    uint32 alias_rid,
  61                                    ALIAS_INFO_CTR * const ctr)
  62 {
  63         display_alias_info_ctr(out_hnd, ACTION_HEADER, ctr);
  64         display_alias_info_ctr(out_hnd, ACTION_ENUMERATE, ctr);
  65         display_alias_info_ctr(out_hnd, ACTION_FOOTER, ctr);
  66 }
  67
  68 static void sam_display_alias(const char *domain, const DOM_SID * sid,
  69                               uint32 alias_rid, const char *alias_name)
  70 {
  71         report(out_hnd, "Alias RID: %8x  Alias Name: %s\n",
  72                alias_rid, alias_name);
  73 }
  74
  75 static void sam_display_alias_members(const char *domain, const DOM_SID * sid,
  76                                       uint32 alias_rid,
  77                                       const char *alias_name,
  78                                       uint32 num_names,
  79                                       DOM_SID * const *const sids,
  80                                       char *const *const name,
  81                                       uint32 * const type)
  82 {
  83         display_alias_members(out_hnd, ACTION_HEADER, num_names, name, type);
  84         display_alias_members(out_hnd, ACTION_ENUMERATE, num_names, name,
  85                               type);
  86         display_alias_members(out_hnd, ACTION_FOOTER, num_names, name, type);
  87 }
  88
  89 static void sam_display_group_info(const char *domain, const DOM_SID * sid,
  90                                    uint32 group_rid,
  91                                    GROUP_INFO_CTR * const ctr)
  92 {
  93         display_group_info_ctr(out_hnd, ACTION_HEADER, ctr);
  94         display_group_info_ctr(out_hnd, ACTION_ENUMERATE, ctr);
  95         display_group_info_ctr(out_hnd, ACTION_FOOTER, ctr);
  96 }
  97
  98 static void sam_display_group(const char *domain, const DOM_SID * sid,
  99                               uint32 group_rid, const char *group_name)
 100 {
 101         report(out_hnd, "Group RID: %8x  Group Name: %s\n",
 102                group_rid, group_name);
 103 }
 104
 105 static void sam_display_group_members(const char *domain, const DOM_SID * sid,
 106                                       uint32 group_rid,
 107                                       const char *group_name,
 108                                       uint32 num_names,
 109                                       const uint32 * rid_mem,
 110                                       char *const *const name,
 111                                       uint32 * const type)
 112 {
 113         display_group_members(out_hnd, ACTION_HEADER, num_names, name, type);
 114         display_group_members(out_hnd, ACTION_ENUMERATE, num_names, name,
 115                               type);
 116         display_group_members(out_hnd, ACTION_FOOTER, num_names, name, type);
 117 }
 118
 119 static void sam_display_user_info(const char *domain, const DOM_SID * sid,
 120                                   uint32 user_rid,
 121                                   SAM_USERINFO_CTR * const ctr)
 122 {
 123         if (ctr->switch_value == 21)
 124         {
 125                 SAM_USER_INFO_21 *const usr = ctr->info.id21;
 126                 display_sam_user_info_21(out_hnd, ACTION_HEADER, usr);
 127                 display_sam_user_info_21(out_hnd, ACTION_ENUMERATE, usr);
 128                 display_sam_user_info_21(out_hnd, ACTION_FOOTER, usr);
 129         }
 130 }
 131
 132 static void sam_display_user(const char *domain, const DOM_SID * sid,
 133                              uint32 user_rid, const char *user_name)
 134 {
 135         report(out_hnd, "User RID: %8x  User Name: %s\n",
 136                user_rid, user_name);
 137 }
 138
 139
 140 /****************************************************************************
 141 SAM password change
 142 ****************************************************************************/
 143 void cmd_sam_ntchange_pwd(struct client_info *info, int argc, char *argv[])
 144 {
 145         fstring srv_name;
 146         char *new_passwd;
 147         char *new_passwd2;
 148         uchar nt_oldhash[16];
 149         uchar lm_oldhash[16];
 150         fstring acct_name;
 151
 152         fstrcpy(srv_name, "\\\\");
 153         fstrcat(srv_name, info->dest_host);
 154         strupper(srv_name);
 155
 156         report(out_hnd, "SAM NT Password Change\n");
 157
 158         if (argc >= 2)
 159         {
 160                 struct pwd_info old_pwd;
 161                 safe_strcpy(acct_name, argv[1], sizeof(acct_name));
 162                 pwd_read(&old_pwd, "Old Password:", True);
 163                 pwd_get_lm_nt_16(&old_pwd, lm_oldhash, nt_oldhash);
 164         }
 165         else
 166         {
 167                 safe_strcpy(acct_name, usr_creds->ntc.user_name,
 168                             sizeof(acct_name));
 169                 pwd_get_lm_nt_16(&(usr_creds->ntc.pwd), lm_oldhash,
 170                                  nt_oldhash);
 171         }
 172
 173         new_passwd = (char *)getpass("New Password: ");
 174         new_passwd2 = (char *)getpass("retype: ");
 175
 176         if ((new_passwd != NULL && new_passwd2 != NULL &&
 177              !strequal(new_passwd, new_passwd2)) ||
 178             (new_passwd != new_passwd2))
 179         {
 180                 report(out_hnd, "New passwords differ!\n");
 181                 return;
 182         }
 183
 184         /* establish a connection. */
 185         if (msrpc_sam_ntchange_pwd(srv_name, NULL, acct_name,
 186                                    lm_oldhash, nt_oldhash, new_passwd))
 187         {
 188                 report(out_hnd, "NT Password changed OK\n");
 189         }
 190         else
 191         {
 192                 report(out_hnd, "NT Password change FAILED\n");
 193         }
 194 }
 195
 196
 197 /****************************************************************************
 198 experimental SAM encryted rpc test connection
 199 ****************************************************************************/
 200 void cmd_sam_test(struct client_info *info, int argc, char *argv[])
 201 {
 202         struct cli_connection *con = NULL;
 203         fstring srv_name;
 204         fstring domain;
 205         fstring sid;
 206         BOOL res = True;
 207
 208         sid_to_string(sid, &info->dom.level5_sid);
 209         fstrcpy(domain, info->dom.level5_dom);
 210
 211         fstrcpy(srv_name, "\\\\");
 212         fstrcat(srv_name, info->dest_host);
 213         strupper(srv_name);
 214
 215         report(out_hnd, "SAM Encryption Test\n");
 216
 217         usr_creds->ntc.ntlmssp_flags = NTLMSSP_NEGOTIATE_UNICODE |
 218                 NTLMSSP_NEGOTIATE_OEM |
 219                 NTLMSSP_NEGOTIATE_SIGN |
 220                 NTLMSSP_NEGOTIATE_SEAL |
 221                 NTLMSSP_NEGOTIATE_LM_KEY |
 222                 NTLMSSP_NEGOTIATE_NTLM |
 223                 NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
 224                 NTLMSSP_NEGOTIATE_00001000 | NTLMSSP_NEGOTIATE_00002000;
 225
 226         /* open SAMR session.  */
 227         res = res ? cli_connection_init(srv_name, PIPE_SAMR, &con) : False;
 228
 229         /* close the session */
 230         cli_connection_unlink(con);
 231
 232         if (res)
 233         {
 234                 DEBUG(5, ("cmd_sam_test: succeeded\n"));
 235         }
 236         else
 237         {
 238                 DEBUG(5, ("cmd_sam_test: failed\n"));
 239         }
 240 }
 241
 242 /****************************************************************************
 243 Lookup domain in SAM server.
 244 ****************************************************************************/
 245 void cmd_sam_lookup_domain(struct client_info *info, int argc, char *argv[])
 246 {
 247         fstring srv_name;
 248         char *domain;
 249         fstring str_sid;
 250         DOM_SID dom_sid;
 251         BOOL res = True;
 252         POLICY_HND sam_pol;
 253
 254         fstrcpy(srv_name, "\\\\");
 255         fstrcat(srv_name, info->dest_host);
 256         strupper(srv_name);
 257
 258         if (argc < 2)
 259         {
 260                 report(out_hnd, "lookupdomain: <name>\n");
 261                 return;
 262         }
 263
 264         domain = argv[1];
 265         strupper(domain);
 266
 267         report(out_hnd, "Lookup Domain %s in SAM Server\n", domain);
 268
 269         /* establish a connection. */
 270         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
 271
 272         /* connect to the domain */
 273         res =
 274                 res ? samr_query_lookup_domain(&sam_pol, domain,
 275                                                &dom_sid) : False;
 276
 277         res = res ? samr_close(&sam_pol) : False;
 278
 279         if (res)
 280         {
 281                 DEBUG(5, ("cmd_sam_lookup_domain: succeeded\n"));
 282
 283                 sid_to_string(str_sid, &dom_sid);
 284                 report(out_hnd, "Domain:\t%s\tSID:\t%s\n", domain, str_sid);
 285         }
 286         else
 287         {
 288                 DEBUG(5, ("cmd_sam_lookup_domain: failed\n"));
 289                 report(out_hnd, "Lookup Domain: FAILED\n");
 290         }
 291 }
 292
 293 /****************************************************************************
 294 Lookup names in SAM server.
 295 ****************************************************************************/
 296 static void fill_domain_sid(const char *srv_name,
 297                             const char *new_domain, char *domain,
 298                             DOM_SID * sid)
 299 {
 300         uint32 ret;
 301         DOM_SID new_sid;
 302         fstring temp;
 303
 304         ret = lookup_sam_domainname(srv_name, new_domain, &new_sid);
 305
 306         if (ret != 0x0)
 307         {
 308                 report(out_hnd, "Domain %s: %s\n",
 309                        new_domain, get_nt_error_msg(ret));
 310         }
 311         else
 312         {
 313                 sid_copy(sid, &new_sid);
 314                 fstrcpy(domain, new_domain);
 315         }
 316
 317         sid_to_string(temp, sid);
 318         DEBUG(3, ("Using Domain-SID: %s\n", temp));
 319 }
 320
 321 /****************************************************************************
 322 Lookup names in SAM server.
 323 ****************************************************************************/
 324 void cmd_sam_lookup_names(struct client_info *info, int argc, char *argv[])
 325 {
 326         int opt;
 327         fstring srv_name;
 328         fstring domain;
 329         DOM_SID sid_dom;
 330         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
 331         BOOL res = True, res1 = True;
 332         POLICY_HND pol_sam;
 333         POLICY_HND pol_dom;
 334         int num_names;
 335         char **names;
 336         uint32 num_rids, i;
 337         uint32 *rids = NULL;
 338         uint32 *types = NULL;
 339
 340         sid_copy(&sid_dom, &info->dom.level5_sid);
 341         fstrcpy(domain, info->dom.level5_dom);
 342
 343         fstrcpy(srv_name, "\\\\");
 344         fstrcat(srv_name, info->dest_host);
 345         strupper(srv_name);
 346
 347         if (argc < 2)
 348         {
 349                 report(out_hnd,
 350                        "samlookupnames [-d <domain>] <name> [<name> ...]\n");
 351                 return;
 352         }
 353
 354         while ((opt = getopt(argc, argv, "d:")) != EOF)
 355         {
 356                 switch (opt)
 357                 {
 358                         case 'd':
 359                         {
 360                                 fill_domain_sid(srv_name, optarg,
 361                                                 domain, &sid_dom);
 362                                 break;
 363                         }
 364                 }
 365         }
 366
 367         if (sid_dom.num_auths == 0)
 368         {
 369                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid_dom) !=
 370                     0x0)
 371                 {
 372                         report(out_hnd,
 373                                "please use 'lsaquery' first, to ascertain the SID\n");
 374                         return;
 375                 }
 376         }
 377
 378         report(out_hnd, "SAM Lookup Names\n");
 379
 380         argc -= optind;
 381         argv += optind;
 382
 383         num_names = argc;
 384         names = (char **)argv;
 385
 386         if (num_names <= 0)
 387         {
 388                 report(out_hnd,
 389                        "samlookupnames [-d <domain>] <name> [<name> ...]\n");
 390                 return;
 391         }
 392
 393         /* establish a connection. */
 394         res = res ? samr_connect(srv_name, 0x02000000, &pol_sam) : False;
 395
 396         /* connect to the domain */
 397         res = res ? samr_open_domain(&pol_sam, ace_perms, &sid_dom,
 398                                      &pol_dom) : False;
 399
 400         res1 = res ? samr_query_lookup_names(&pol_dom, 0x000003e8,
 401                                              num_names, names,
 402                                              &num_rids, &rids,
 403                                              &types) : False;
 404
 405         res = res ? samr_close(&pol_dom) : False;
 406         res = res ? samr_close(&pol_sam) : False;
 407
 408         if (res1)
 409         {
 410                 DEBUG(5, ("cmd_sam_lookup_names: query succeeded\n"));
 411         }
 412         else
 413         {
 414                 DEBUG(5, ("cmd_sam_lookup_names: query failed\n"));
 415         }
 416
 417         if (res1)
 418         {
 419                 for (i = 0; i < num_rids; i++)
 420                 {
 421                         report(out_hnd, "RID: %s -> %d (%d: %s)\n",
 422                                names[i], rids[i], types[i],
 423                                get_sid_name_use_str(types[i]));
 424                 }
 425         }
 426
 427         safe_free(rids);
 428         safe_free(types);
 429 }
 430
 431 /****************************************************************************
 432 Lookup rids in SAM server.
 433 ****************************************************************************/
 434 void cmd_sam_lookup_rids(struct client_info *info, int argc, char *argv[])
 435 {
 436         int opt;
 437         fstring srv_name;
 438         fstring domain;
 439         DOM_SID sid_dom;
 440         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
 441         BOOL res = True, res1 = True;
 442         POLICY_HND pol_sam;
 443         POLICY_HND pol_dom;
 444         int num_names = 0;
 445         char **names = NULL;
 446         uint32 num_rids, i;
 447         uint32 *rids = NULL;
 448         uint32 *types = NULL;
 449
 450         sid_copy(&sid_dom, &info->dom.level5_sid);
 451         fstrcpy(domain, info->dom.level5_dom);
 452
 453         fstrcpy(srv_name, "\\\\");
 454         fstrcat(srv_name, info->dest_host);
 455         strupper(srv_name);
 456
 457         if (argc < 2)
 458         {
 459                 report(out_hnd,
 460                        "samlookupnames [-d <domain>] <name> [<name> ...]\n");
 461                 return;
 462         }
 463
 464         while ((opt = getopt(argc, argv, "d:")) != EOF)
 465         {
 466                 switch (opt)
 467                 {
 468                         case 'd':
 469                         {
 470                                 fill_domain_sid(srv_name, optarg,
 471                                                 domain, &sid_dom);
 472                                 break;
 473                         }
 474                 }
 475         }
 476
 477         if (sid_dom.num_auths == 0)
 478         {
 479                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid_dom) !=
 480                     0x0)
 481                 {
 482                         report(out_hnd,
 483                                "please use 'lsaquery' first, to ascertain the SID\n");
 484                         return;
 485                 }
 486         }
 487
 488         report(out_hnd, "SAM Lookup Rids\n");
 489
 490         argc -= optind;
 491         argv += optind;
 492
 493         if (argc <= 0)
 494         {
 495                 report(out_hnd,
 496                        "samlookuprids [-d <domain>] <rid> [<rid> ...]\n");
 497                 return;
 498         }
 499
 500         num_rids = 0;
 501
 502         while (num_rids < argc)
 503         {
 504                 rids = Realloc(rids, sizeof(rids[0]) * (num_rids + 1));
 505                 if (rids == NULL)
 506                 {
 507                         return;
 508                 }
 509                 rids[num_rids] = get_number(argv[num_rids]);
 510                 num_rids++;
 511         }
 512
 513         /* establish a connection. */
 514         res = res ? samr_connect(srv_name, 0x02000000, &pol_sam) : False;
 515
 516         /* connect to the domain */
 517         res = res ? samr_open_domain(&pol_sam, ace_perms, &sid_dom,
 518                                      &pol_dom) : False;
 519
 520         res1 = res ? samr_query_lookup_rids(&pol_dom, 0x000003e8,
 521                                             num_rids, rids,
 522                                             &num_names, &names,
 523                                             &types) : False;
 524
 525         res = res ? samr_close(&pol_dom) : False;
 526         res = res ? samr_close(&pol_sam) : False;
 527
 528         if (res1)
 529         {
 530                 DEBUG(5, ("cmd_sam_lookup_rids: query succeeded\n"));
 531         }
 532         else
 533         {
 534                 DEBUG(5, ("cmd_sam_lookup_rids: query failed\n"));
 535         }
 536
 537         if (res1)
 538         {
 539                 for (i = 0; i < num_names; i++)
 540                 {
 541                         report(out_hnd, "Name: %s -> %d (%d: %s)\n",
 542                                names[i], rids[i], types[i],
 543                                get_sid_name_use_str(types[i]));
 544                 }
 545         }
 546
 547         safe_free(rids);
 548         safe_free(types);
 549
 550         free_char_array(num_names, names);
 551 }
 552
 553 /****************************************************************************
 554 SAM delete alias member.
 555 ****************************************************************************/
 556 void cmd_sam_del_aliasmem(struct client_info *info, int argc, char *argv[])
 557 {
 558         fstring srv_name;
 559         fstring domain;
 560         fstring sid;
 561         DOM_SID sid1;
 562         POLICY_HND alias_pol;
 563         BOOL res = True;
 564         BOOL res1 = True;
 565         BOOL res2 = True;
 566         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
 567         DOM_SID member_sid;
 568         uint32 alias_rid;
 569         POLICY_HND sam_pol;
 570         POLICY_HND pol_dom;
 571
 572         fstrcpy(srv_name, "\\\\");
 573         fstrcat(srv_name, info->dest_host);
 574         strupper(srv_name);
 575
 576         sid_copy(&sid1, &info->dom.level5_sid);
 577         sid_to_string(sid, &sid1);
 578         fstrcpy(domain, info->dom.level5_dom);
 579
 580         if (sid1.num_auths == 0)
 581         {
 582                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
 583                     0x0)
 584                 {
 585                         report(out_hnd,
 586                                "please use 'lsaquery' first, to ascertain the SID\n");
 587                         return;
 588                 }
 589         }
 590
 591         if (argc < 2)
 592         {
 593                 report(out_hnd,
 594                        "delaliasmem: <alias rid> [member sid1] [member sid2] ...\n");
 595                 return;
 596         }
 597
 598         argc--;
 599         argv++;
 600
 601         alias_rid = get_number(argv[0]);
 602
 603         report(out_hnd, "SAM Domain Alias Member\n");
 604
 605         /* establish a connection. */
 606         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
 607
 608         /* connect to the domain */
 609         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
 610                                      &pol_dom) : False;
 611
 612         /* connect to the domain */
 613         res1 = res ? samr_open_alias(&pol_dom,
 614                                      0x000f001f, alias_rid,
 615                                      &alias_pol) : False;
 616
 617         while (argc > 0 && res2 && res1)
 618         {
 619                 argc--;
 620                 argv++;
 621                 /* get a sid, delete a member from the alias */
 622                 res2 = res2 ? string_to_sid(&member_sid, argv[0]) : False;
 623                 res2 =
 624                         res2 ? samr_del_aliasmem(&alias_pol,
 625                                                  &member_sid) : False;
 626
 627                 if (res2)
 628                 {
 629                         report(out_hnd, "SID deleted from Alias 0x%x: %s\n",
 630                                alias_rid, argv[0]);
 631                 }
 632         }
 633
 634         res1 = res1 ? samr_close(&alias_pol) : False;
 635         res = res ? samr_close(&pol_dom) : False;
 636         res = res ? samr_close(&sam_pol) : False;
 637
 638         if (res && res1 && res2)
 639         {
 640                 DEBUG(5, ("cmd_sam_del_aliasmem: succeeded\n"));
 641                 report(out_hnd, "Delete Domain Alias Member: OK\n");
 642         }
 643         else
 644         {
 645                 DEBUG(5, ("cmd_sam_del_aliasmem: failed\n"));
 646                 report(out_hnd, "Delete Domain Alias Member: FAILED\n");
 647         }
 648 }
 649
 650 /****************************************************************************
 651 SAM delete alias.
 652 ****************************************************************************/
 653 void cmd_sam_delete_dom_alias(struct client_info *info, int argc,
 654                               char *argv[])
 655 {
 656         fstring srv_name;
 657         fstring domain;
 658         char *name;
 659         fstring sid;
 660         DOM_SID sid1;
 661         POLICY_HND alias_pol;
 662         BOOL res = True;
 663         BOOL res1 = True;
 664         BOOL res2 = True;
 665         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
 666         uint32 alias_rid = 0;
 667         char *names[1];
 668         uint32 *rids;
 669         uint32 *types;
 670         uint32 num_rids;
 671         POLICY_HND sam_pol;
 672         POLICY_HND pol_dom;
 673
 674         fstrcpy(srv_name, "\\\\");
 675         fstrcat(srv_name, info->dest_host);
 676         strupper(srv_name);
 677
 678         sid_copy(&sid1, &info->dom.level5_sid);
 679         sid_to_string(sid, &sid1);
 680         fstrcpy(domain, info->dom.level5_dom);
 681
 682         if (sid1.num_auths == 0)
 683         {
 684                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
 685                     0x0)
 686                 {
 687                         report(out_hnd,
 688                                "please use 'lsaquery' first, to ascertain the SID\n");
 689                         return;
 690                 }
 691         }
 692
 693         if (argc < 2)
 694         {
 695                 report(out_hnd, "delalias <alias name>\n");
 696                 return;
 697         }
 698
 699         name = argv[1];
 700
 701         report(out_hnd, "SAM Delete Domain Alias\n");
 702
 703         /* establish a connection. */
 704         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
 705
 706         /* connect to the domain */
 707         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
 708                                      &pol_dom) : False;
 709
 710         names[0] = name;
 711
 712         res1 = res ? samr_query_lookup_names(&pol_dom, 0x000003e8,
 713                                              1, names,
 714                                              &num_rids, &rids,
 715                                              &types) : False;
 716
 717         if (res1 && num_rids == 1 && rids)
 718         {
 719                 alias_rid = rids[0];
 720         }
 721         if (rids)
 722         {
 723                 free(rids);
 724         }
 725         if (types)
 726         {
 727                 free(types);
 728         }
 729
 730         /* connect to the domain */
 731         res1 = res1 ? samr_open_alias(&pol_dom,
 732                                       0x00f001f, alias_rid,
 733                                       &alias_pol) : False;
 734
 735         res2 = res1 ? samr_delete_dom_alias(&alias_pol) : False;
 736
 737         res1 = res1 ? samr_close(&alias_pol) : False;
 738         res = res ? samr_close(&pol_dom) : False;
 739         res = res ? samr_close(&sam_pol) : False;
 740
 741         if (res && res1 && res2)
 742         {
 743                 DEBUG(5, ("cmd_sam_delete_dom_alias: succeeded\n"));
 744                 report(out_hnd, "Delete Domain Alias: OK\n");
 745         }
 746         else
 747         {
 748                 DEBUG(5, ("cmd_sam_delete_dom_alias: failed\n"));
 749                 report(out_hnd, "Delete Domain Alias: FAILED\n");
 750         }
 751 }
 752
 753 /****************************************************************************
 754 SAM add alias member.
 755 ****************************************************************************/
 756 void cmd_sam_add_aliasmem(struct client_info *info, int argc, char *argv[])
 757 {
 758         fstring srv_name;
 759         fstring domain;
 760         fstring tmp;
 761         fstring sid;
 762         DOM_SID sid1;
 763         POLICY_HND alias_pol;
 764         BOOL res = True;
 765         BOOL res1 = True;
 766         BOOL res2 = True;
 767         BOOL res3 = True;
 768         BOOL res4 = True;
 769         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
 770         uint32 alias_rid;
 771         char **names = NULL;
 772         int num_names = 0;
 773         DOM_SID *sids = NULL;
 774         int num_sids = 0;
 775         int i;
 776         POLICY_HND sam_pol;
 777         POLICY_HND pol_dom;
 778         POLICY_HND lsa_pol;
 779
 780         fstrcpy(srv_name, "\\\\");
 781         fstrcat(srv_name, info->dest_host);
 782         strupper(srv_name);
 783
 784         sid_copy(&sid1, &info->dom.level5_sid);
 785         sid_to_string(sid, &sid1);
 786         fstrcpy(domain, info->dom.level5_dom);
 787
 788         if (sid1.num_auths == 0)
 789         {
 790                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
 791                     0x0)
 792                 {
 793                         report(out_hnd,
 794                                "please use 'lsaquery' first, to ascertain the SID\n");
 795                         return;
 796                 }
 797         }
 798
 799         if (argc < 2)
 800         {
 801                 report(out_hnd,
 802                        "addaliasmem <group name> [member name1] [member name2] ...\n");
 803                 return;
 804         }
 805
 806         num_names = argc + 1;
 807         names = argv + 1;
 808
 809         report(out_hnd, "SAM Domain Alias Member\n");
 810
 811         /* lookup domain controller; receive a policy handle */
 812         res3 = res3 ? lsa_open_policy(srv_name,
 813                                       &lsa_pol, True, 0x02000000) : False;
 814
 815         /* send lsa lookup sids call */
 816         res4 = res3 ? lsa_lookup_names(&lsa_pol,
 817                                        num_names, names,
 818                                        &sids, NULL, &num_sids) : False;
 819
 820         res3 = res3 ? lsa_close(&lsa_pol) : False;
 821
 822         res4 = num_sids < 2 ? False : res4;
 823
 824         if (res4)
 825         {
 826                 /*
 827                  * accept domain sid or builtin sid
 828                  */
 829
 830                 DOM_SID sid_1_5_20;
 831                 string_to_sid(&sid_1_5_20, "S-1-5-32");
 832                 sid_split_rid(&sids[0], &alias_rid);
 833
 834                 if (sid_equal(&sids[0], &sid_1_5_20))
 835                 {
 836                         sid_copy(&sid1, &sid_1_5_20);
 837                 }
 838                 else if (!sid_equal(&sids[0], &sid1))
 839                 {
 840                         res4 = False;
 841                 }
 842         }
 843
 844         /* establish a connection. */
 845         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
 846
 847         /* connect to the domain */
 848         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
 849                                      &pol_dom) : False;
 850
 851         /* connect to the domain */
 852         res1 = res ? samr_open_alias(&pol_dom,
 853                                      0x000f001f, alias_rid,
 854                                      &alias_pol) : False;
 855
 856         for (i = 1; i < num_sids && res2 && res1; i++)
 857         {
 858                 /* add a member to the alias */
 859                 res2 = res2 ? samr_add_aliasmem(&alias_pol, &sids[i]) : False;
 860
 861                 if (res2)
 862                 {
 863                         sid_to_string(tmp, &sids[i]);
 864                         report(out_hnd, "SID added to Alias 0x%x: %s\n",
 865                                alias_rid, tmp);
 866                 }
 867         }
 868
 869         res1 = res1 ? samr_close(&alias_pol) : False;
 870         res = res ? samr_close(&pol_dom) : False;
 871         res = res ? samr_close(&sam_pol) : False;
 872
 873         if (sids != NULL)
 874         {
 875                 free(sids);
 876         }
 877
 878         free_char_array(num_names, names);
 879
 880         if (res && res1 && res2)
 881         {
 882                 DEBUG(5, ("cmd_sam_add_aliasmem: succeeded\n"));
 883                 report(out_hnd, "Add Domain Alias Member: OK\n");
 884         }
 885         else
 886         {
 887                 DEBUG(5, ("cmd_sam_add_aliasmem: failed\n"));
 888                 report(out_hnd, "Add Domain Alias Member: FAILED\n");
 889         }
 890 }
 891
 892
 893 #if 0
 894 /****************************************************************************
 895 SAM create domain user.
 896 ****************************************************************************/
 897 void cmd_sam_create_dom_trusting(struct client_info *info, int argc,
 898                                  char *argv[])
 899 {
 900         fstring local_domain;
 901         fstring local_pdc;
 902
 903         char *trusting_domain;
 904         char *trusting_pdc;
 905         fstring password;
 906
 907         fstring sid;
 908         DOM_SID sid1;
 909         uint32 user_rid;
 910
 911         fstrcpy(srv_name, "\\\\");
 912         fstrcat(srv_name, info->dest_host);
 913         strupper(srv_name);
 914
 915         sid_copy(&sid1, &info->dom.level5_sid);
 916         sid_to_string(sid, &sid1);
 917         fstrcpy(domain, info->dom.level5_dom);
 918
 919         if (sid1.num_auths == 0)
 920         {
 921                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
 922                     0x0)
 923                 {
 924                         report(out_hnd,
 925                                "please use 'lsaquery' first, to ascertain the SID\n");
 926                         return;
 927                 }
 928         }
 929
 930         if (argc < 3)
 931         {
 932                 report(out_hnd,
 933                        "createtrusting: <Domain Name> <PDC Name> [password]\n");
 934                 return;
 935         }
 936
 937         argc--;
 938         argv++;
 939
 940         trusting_domain = argv[0];
 941
 942         argc--;
 943         argv++;
 944
 945         trusting_pdc = argv[0];
 946
 947         argc--;
 948         argv++;
 949
 950         if (argc > 0)
 951         {
 952                 safe_strcpy(password, argv[0], sizeof(password) - 1);
 953         }
 954         else
 955         {
 956                 fstring pass_str;
 957                 char *pass;
 958                 slprintf(pass_str, sizeof(pass_str) - 1,
 959                          "Enter %s's Password:", user_name);
 960                 pass = (char *)getpass(pass_str);
 961
 962                 if (pass != NULL)
 963                 {
 964                         safe_strcpy(password, pass, sizeof(password) - 1);
 965                         set_passwd = True;
 966                 }
 967         }
 968         report(out_hnd, "SAM Create Domain Trusting Account\n");
 969
 970         if (msrpc_sam_create_dom_user(srv_name,
 971                                       acct_name, ACB_WSTRUST, &user_rid))
 972         {
 973                 report(out_hnd, "Create Domain User: OK\n");
 974         }
 975         else
 976         {
 977                 report(out_hnd, "Create Domain User: FAILED\n");
 978         }
 979 }
 980 #endif
 981
 982 /****************************************************************************
 983 SAM create domain user.
 984 ****************************************************************************/
 985 void cmd_sam_create_dom_user(struct client_info *info, int argc, char *argv[])
 986 {
 987         fstring domain;
 988         fstring acct_name;
 989         fstring sec_name;
 990         fstring name;
 991         fstring sid;
 992         DOM_SID sid1;
 993         uint32 user_rid;
 994         uint16 acb_info = ACB_NORMAL;
 995         BOOL join_domain = False;
 996         fstring join_dom_name;
 997         int opt;
 998         char *password = NULL;
 999         pstring upwb;
1000         int plen = 0;
1001         int len = 0;
1002         UNISTR2 upw;
1003
1004         BOOL res = True;
1005         POLICY_HND lsa_pol;
1006
1007         fstring wks_name;
1008
1009         fstring srv_name;
1010         fstrcpy(srv_name, "\\\\");
1011         fstrcat(srv_name, info->dest_host);
1012         strupper(srv_name);
1013
1014         sid_copy(&sid1, &info->dom.level5_sid);
1015         sid_to_string(sid, &sid1);
1016         fstrcpy(domain, info->dom.level5_dom);
1017
1018         if (sid1.num_auths == 0)
1019         {
1020                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1021                     0x0)
1022                 {
1023                         report(out_hnd,
1024                                "please use 'lsaquery' first, to ascertain the SID\n");
1025                         return;
1026                 }
1027         }
1028
1029         if (argc < 2)
1030         {
1031                 report(out_hnd,
1032                        "createuser: <acct name> [-i] [-s] [-j] domain_name [-p password]\n");
1033                 return;
1034         }
1035
1036         argc--;
1037         argv++;
1038
1039         safe_strcpy(acct_name, argv[0], sizeof(acct_name));
1040         len = strlen(acct_name) - 1;
1041         if (acct_name[len] == '$')
1042         {
1043                 safe_strcpy(name, argv[0], sizeof(name));
1044                 name[len] = 0;
1045                 acb_info = ACB_WSTRUST;
1046         }
1047
1048         while ((opt = getopt(argc, argv, "isj:p:w:")) != EOF)
1049         {
1050                 switch (opt)
1051                 {
1052                         case 'i':
1053                         {
1054                                 acb_info = ACB_DOMTRUST;
1055                                 break;
1056                         }
1057                         case 's':
1058                         {
1059                                 acb_info = ACB_SVRTRUST;
1060                                 break;
1061                         }
1062                         case 'j':
1063                         {
1064                                 join_domain = True;
1065                                 fstrcpy(join_dom_name, optarg);
1066                                 break;
1067                         }
1068                         case 'p':
1069                         {
1070                                 fstring pwd;
1071                                 safe_strcpy(pwd, optarg, sizeof(pwd) - 1);
1072                                 make_unistr2(&upw, pwd, strlen(pwd));
1073                                 ascii_to_unibuf(upwb, pwd, strlen(pwd) * 2);
1074                                 password = upwb;
1075                                 plen = upw.uni_str_len * 2;
1076                                 memset(pwd, 0, sizeof(pwd));
1077                                 break;
1078                         }
1079                 }
1080         }
1081
1082         switch (acb_info)
1083         {
1084                 case ACB_DOMTRUST:
1085                 {
1086                         fstrcpy(sec_name, "G$$");
1087                         fstrcat(sec_name, join_dom_name);
1088                         break;
1089                 }
1090                 case ACB_SVRTRUST:
1091                 case ACB_WSTRUST:
1092                 {
1093                         fstrcpy(sec_name, "$MACHINE.ACC");
1094                         break;
1095                 }
1096                 default:
1097                 {
1098                         break;
1099                 }
1100         }
1101         /*
1102          * sort out the workstation name.  if it's ourselves, and we're
1103          * on MSRPC local loopback, must _also_ connect to workstation
1104          * local-loopback.
1105          */
1106
1107         DEBUG(10, ("create_dom_user: myhostname: %s server: %s\n",
1108                    info->myhostname, name));
1109
1110         fstrcpy(wks_name, "\\\\");
1111         if (strequal(srv_name, "\\\\.") && strequal(name, info->myhostname))
1112         {
1113                 fstrcat(wks_name, ".");
1114         }
1115         else
1116         {
1117                 fstrcat(wks_name, name);
1118         }
1119         strupper(wks_name);
1120
1121         report(out_hnd, "SAM Create Domain User\n");
1122         if (join_domain && acb_info == ACB_NORMAL)
1123         {
1124                 report(out_hnd, "can only join trust accounts to a domain\n");
1125                 return;
1126         }
1127
1128         report(out_hnd, "Domain: %s Name: %s ACB: %s\n",
1129                domain, acct_name,
1130                pwdb_encode_acct_ctrl(acb_info,
1131                                      NEW_PW_FORMAT_SPACE_PADDED_LEN));
1132
1133         if (acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)
1134         {
1135 #if 0
1136                 uint8 rnd_data[512];
1137                 int i, j;
1138 #endif
1139
1140                 if (password != NULL)
1141                 {
1142                         report(out_hnd,
1143                                ("Workstation and Server Trust Accounts are randomly auto-generated\n"));
1144                         memset(&upw, 0, sizeof(upw));
1145                         return;
1146                 }
1147
1148                 upw.uni_str_len = 0xc;
1149                 upw.uni_max_len = 0xc;
1150 #if 0
1151                 upw.uni_str_len = 0x78;
1152                 upw.uni_max_len = 0x78;
1153                 generate_random_buffer(rnd_data, sizeof(rnd_data), True);
1154                 for (j = 0, i = 0; i < 0x78 && j < sizeof(rnd_data); j++, i++)
1155                 {
1156                         for (; j < sizeof(rnd_data) && rnd_data[j] == 0; j++)
1157                         {
1158                         }
1159
1160                         upw.buffer[i] = rnd_data[j];
1161                 }
1162 #endif
1163                 password = (char *)upw.buffer;
1164                 plen = upw.uni_str_len * 2;
1165                 generate_random_buffer(password, plen, True);
1166         }
1167
1168         if (join_domain)
1169         {
1170                 /*
1171                  * ok.  this looks really weird, but if you don't open
1172                  * the connection to the workstation first, then the
1173                  * set trust account on the SAM database may get the
1174                  * local copy-of trust account out-of-sync with the
1175                  * remote one, and you're stuffed!
1176                  */
1177                 res = lsa_open_policy(wks_name, &lsa_pol, True, 0x02000000);
1178
1179                 if (!res)
1180                 {
1181                         report(out_hnd, "Connection to %s FAILED\n",
1182                                wks_name);
1183                         report(out_hnd,
1184                                "(Do a \"use \\\\%s -U localadmin\")\n",
1185                                wks_name);
1186                 }
1187         }
1188
1189         if (res && msrpc_sam_create_dom_user(srv_name, &sid1,
1190                                              acct_name, acb_info, password,
1191                                              plen, &user_rid))
1192         {
1193                 report(out_hnd, "Create Domain User: OK\n");
1194
1195                 if (join_domain)
1196                 {
1197                         POLICY_HND pol_sec;
1198                         BOOL res1;
1199                         BOOL res2 = False;
1200
1201                         uchar ntpw[16];
1202
1203                         nt_owf_genW(&upw, ntpw);
1204
1205                         strupper(domain);
1206                         strupper(name);
1207
1208                         report(out_hnd, "Join %s to Domain %s\n", name,
1209                                domain);
1210
1211                         /* attempt to create, and if already exist, open */
1212                         res1 = lsa_create_secret(&lsa_pol, "$MACHINE.ACC",
1213                                                  0x020003, &pol_sec);
1214
1215                         if (res1)
1216                         {
1217                                 report(out_hnd, "Create $MACHINE.ACC: OK\n");
1218                         }
1219                         else
1220                         {
1221                                 res1 = lsa_open_secret(&lsa_pol,
1222                                                        "$MACHINE.ACC",
1223                                                        0x020003, &pol_sec);
1224
1225                         }
1226
1227                         /* valid pol_sec on $MACHINE.ACC, set trust passwd */
1228                         if (res1)
1229                         {
1230                                 STRING2 secret;
1231                                 secret_store_data(&secret, password, plen);
1232
1233                                 res2 = lsa_set_secret(&pol_sec, &secret) ==
1234                                         NT_STATUS_NOPROBLEMO;
1235
1236                         }
1237
1238                         if (res2)
1239                         {
1240                                 report(out_hnd, "Set $MACHINE.ACC: OK\n");
1241                         }
1242                         else
1243                         {
1244                                 report(out_hnd, "Set $MACHINE.ACC: FAILED\n");
1245                         }
1246
1247                         res1 = res1 ? lsa_close(&pol_sec) : False;
1248                         res = res ? lsa_close(&lsa_pol) : False;
1249
1250                         memset(ntpw, 0, sizeof(ntpw));
1251                 }
1252         }
1253         else
1254         {
1255                 report(out_hnd, "Create Domain User: FAILED\n");
1256         }
1257
1258         memset(&upw, 0, sizeof(upw));
1259 }
1260
1261
1262 /****************************************************************************
1263 SAM create domain alias.
1264 ****************************************************************************/
1265 void cmd_sam_create_dom_alias(struct client_info *info, int argc,
1266                               char *argv[])
1267 {
1268         fstring srv_name;
1269         fstring domain;
1270         char *acct_name;
1271         fstring acct_desc;
1272         fstring sid;
1273         DOM_SID sid1;
1274         BOOL res = True;
1275         BOOL res1 = True;
1276         uint32 ace_perms = 0x02000000;  /* permissions */
1277         uint32 alias_rid;
1278         POLICY_HND sam_pol;
1279         POLICY_HND pol_dom;
1280
1281         fstrcpy(srv_name, "\\\\");
1282         fstrcat(srv_name, info->dest_host);
1283         strupper(srv_name);
1284
1285         sid_copy(&sid1, &info->dom.level5_sid);
1286         sid_to_string(sid, &sid1);
1287         fstrcpy(domain, info->dom.level5_dom);
1288
1289         if (sid1.num_auths == 0)
1290         {
1291                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1292                     0x0)
1293                 {
1294                         report(out_hnd,
1295                                "please use 'lsaquery' first, to ascertain the SID\n");
1296                         return;
1297                 }
1298         }
1299
1300
1301         if (argc < 2)
1302         {
1303                 report(out_hnd,
1304                        "createalias: <acct name> [acct description]\n");
1305         }
1306
1307         acct_name = argv[1];
1308
1309         if (argc < 3)
1310         {
1311                 acct_desc[0] = 0;
1312         }
1313         else
1314         {
1315                 safe_strcpy(acct_desc, argv[2], sizeof(acct_desc) - 1);
1316         }
1317
1318         report(out_hnd, "SAM Create Domain Alias\n");
1319         report(out_hnd, "Domain: %s Name: %s Description: %s\n",
1320                domain, acct_name, acct_desc);
1321
1322         /* establish a connection. */
1323         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1324
1325         /* connect to the domain */
1326         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
1327                                      &pol_dom) : False;
1328
1329         /* create a domain alias */
1330         res1 = res ? create_samr_domain_alias(&pol_dom,
1331                                               acct_name, acct_desc,
1332                                               &alias_rid) : False;
1333
1334         res = res ? samr_close(&pol_dom) : False;
1335         res = res ? samr_close(&sam_pol) : False;
1336
1337         if (res && res1)
1338         {
1339                 DEBUG(5, ("cmd_sam_create_dom_alias: succeeded\n"));
1340                 report(out_hnd, "Create Domain Alias: OK\n");
1341         }
1342         else
1343         {
1344                 DEBUG(5, ("cmd_sam_create_dom_alias: failed\n"));
1345                 report(out_hnd, "Create Domain Alias: FAILED\n");
1346         }
1347 }
1348
1349
1350 /****************************************************************************
1351 SAM delete group member.
1352 ****************************************************************************/
1353 void cmd_sam_del_groupmem(struct client_info *info, int argc, char *argv[])
1354 {
1355         fstring srv_name;
1356         fstring domain;
1357         fstring sid;
1358         DOM_SID sid1;
1359         POLICY_HND pol_grp;
1360         BOOL res = True;
1361         BOOL res1 = True;
1362         BOOL res2 = True;
1363         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
1364         uint32 member_rid;
1365         uint32 group_rid;
1366         POLICY_HND sam_pol;
1367         POLICY_HND pol_dom;
1368
1369         fstrcpy(srv_name, "\\\\");
1370         fstrcat(srv_name, info->dest_host);
1371         strupper(srv_name);
1372
1373         sid_copy(&sid1, &info->dom.level5_sid);
1374         sid_to_string(sid, &sid1);
1375         fstrcpy(domain, info->dom.level5_dom);
1376
1377         if (sid1.num_auths == 0)
1378         {
1379                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1380                     0x0)
1381                 {
1382                         report(out_hnd,
1383                                "please use 'lsaquery' first, to ascertain the SID\n");
1384                         return;
1385                 }
1386         }
1387
1388         if (argc < 2)
1389         {
1390                 report(out_hnd,
1391                        "delgroupmem: <group rid> [member rid1] [member rid2] ...\n");
1392                 return;
1393         }
1394
1395         argc--;
1396         argv++;
1397
1398         group_rid = get_number(argv[0]);
1399
1400         report(out_hnd, "SAM Add Domain Group member\n");
1401
1402         /* establish a connection. */
1403         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1404
1405         /* connect to the domain */
1406         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
1407                                      &pol_dom) : False;
1408
1409         /* connect to the domain */
1410         res1 = res ? samr_open_group(&pol_dom,
1411                                      0x0000001f, group_rid, &pol_grp) : False;
1412
1413         while (argc > 0 && res2 && res1)
1414         {
1415                 argc--;
1416                 argv++;
1417
1418                 /* get a rid, delete a member from the group */
1419                 member_rid = get_number(argv[0]);
1420                 res2 = res2 ? samr_del_groupmem(&pol_grp, member_rid) : False;
1421
1422                 if (res2)
1423                 {
1424                         report(out_hnd, "RID deleted from Group 0x%x: 0x%x\n",
1425                                group_rid, member_rid);
1426                 }
1427         }
1428
1429         res1 = res1 ? samr_close(&pol_grp) : False;
1430         res = res ? samr_close(&pol_dom) : False;
1431         res = res ? samr_close(&sam_pol) : False;
1432
1433         if (res && res1 && res2)
1434         {
1435                 DEBUG(5, ("cmd_sam_del_groupmem: succeeded\n"));
1436                 report(out_hnd, "Add Domain Group Member: OK\n");
1437         }
1438         else
1439         {
1440                 DEBUG(5, ("cmd_sam_del_groupmem: failed\n"));
1441                 report(out_hnd, "Add Domain Group Member: FAILED\n");
1442         }
1443 }
1444
1445
1446 /****************************************************************************
1447 SAM delete user.
1448 ****************************************************************************/
1449 void cmd_sam_delete_dom_user(struct client_info *info, int argc, char *argv[])
1450 {
1451         fstring srv_name;
1452         fstring domain;
1453         char *name;
1454         fstring sid;
1455         DOM_SID sid1;
1456         DOM_SID sid_usr;
1457         POLICY_HND pol_usr;
1458         BOOL res = True;
1459         BOOL res1 = True;
1460         BOOL res2 = True;
1461         uint32 user_rid = 0;
1462         char *names[1];
1463         uint32 *rids;
1464         uint32 *types;
1465         uint32 num_rids;
1466         POLICY_HND sam_pol;
1467         POLICY_HND pol_dom;
1468
1469         fstrcpy(srv_name, "\\\\");
1470         fstrcat(srv_name, info->dest_host);
1471         strupper(srv_name);
1472
1473         sid_copy(&sid1, &info->dom.level5_sid);
1474         sid_to_string(sid, &sid1);
1475         fstrcpy(domain, info->dom.level5_dom);
1476
1477         if (sid1.num_auths == 0)
1478         {
1479                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1480                     0x0)
1481                 {
1482                         report(out_hnd,
1483                                "please use 'lsaquery' first, to ascertain the SID\n");
1484                         return;
1485                 }
1486         }
1487
1488         if (argc < 2)
1489         {
1490                 report(out_hnd, "deluser <user name>\n");
1491                 return;
1492         }
1493
1494         name = argv[1];
1495
1496         report(out_hnd, "SAM Delete Domain User\n");
1497
1498         /* establish a connection. */
1499         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1500
1501         /* connect to the domain */
1502         res = res ? samr_open_domain(&sam_pol, 0x0200, &sid1,
1503                                      &pol_dom) : False;
1504
1505         names[0] = name;
1506
1507         res1 = res ? samr_query_lookup_names(&pol_dom, 0x000003e8,
1508                                              1, names,
1509                                              &num_rids, &rids,
1510                                              &types) : False;
1511
1512         if (res1 && num_rids == 1 && rids)
1513         {
1514                 user_rid = rids[0];
1515                 sid_copy(&sid_usr, &sid1);
1516                 if (!sid_append_rid(&sid_usr, user_rid))
1517                 {
1518                         res1 = False;
1519                 }
1520
1521         }
1522         else
1523         {
1524                 res1 = False;
1525         }
1526         safe_free(rids);
1527         safe_free(types);
1528
1529         /* connect to the domain */
1530         res1 = res1 ? samr_open_user(&pol_dom,
1531                                      0x010000, user_rid, &pol_usr) : False;
1532
1533         res2 = res1 ? samr_unknown_2d(&pol_dom, &sid_usr) : False;
1534         res2 = res2 ? samr_delete_dom_user(&pol_usr) : False;
1535         res2 = res2 ? samr_unknown_2d(&pol_dom, &sid_usr) : False;
1536
1537         res = res ? samr_close(&pol_dom) : False;
1538         res = res ? samr_close(&sam_pol) : False;
1539
1540         if (res && res1 && res2)
1541         {
1542                 DEBUG(5, ("cmd_sam_delete_dom_user: succeeded\n"));
1543                 report(out_hnd, "Delete Domain User: OK\n");
1544         }
1545         else
1546         {
1547                 DEBUG(5, ("cmd_sam_delete_dom_user: failed\n"));
1548                 report(out_hnd, "Delete Domain User: FAILED\n");
1549         }
1550 }
1551
1552
1553 /****************************************************************************
1554 SAM delete group.
1555 ****************************************************************************/
1556 void cmd_sam_delete_dom_group(struct client_info *info, int argc,
1557                               char *argv[])
1558 {
1559         fstring srv_name;
1560         fstring domain;
1561         char *name;
1562         fstring sid;
1563         DOM_SID sid1;
1564         POLICY_HND pol_grp;
1565         BOOL res = True;
1566         BOOL res1 = True;
1567         BOOL res2 = True;
1568         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
1569         uint32 group_rid = 0;
1570         char *names[1];
1571         uint32 *rids;
1572         uint32 *types;
1573         uint32 num_rids;
1574         POLICY_HND sam_pol;
1575         POLICY_HND pol_dom;
1576
1577         fstrcpy(srv_name, "\\\\");
1578         fstrcat(srv_name, info->dest_host);
1579         strupper(srv_name);
1580
1581         sid_copy(&sid1, &info->dom.level5_sid);
1582         sid_to_string(sid, &sid1);
1583         fstrcpy(domain, info->dom.level5_dom);
1584
1585         if (sid1.num_auths == 0)
1586         {
1587                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1588                     0x0)
1589                 {
1590                         report(out_hnd,
1591                                "please use 'lsaquery' first, to ascertain the SID\n");
1592                         return;
1593                 }
1594         }
1595
1596         if (argc < 2)
1597         {
1598                 report(out_hnd, "delgroup <group name>\n");
1599                 return;
1600         }
1601
1602         name = argv[1];
1603
1604         report(out_hnd, "SAM Delete Domain Group\n");
1605
1606         /* establish a connection. */
1607         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1608
1609         /* connect to the domain */
1610         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
1611                                      &pol_dom) : False;
1612
1613         names[0] = name;
1614
1615         res1 = res ? samr_query_lookup_names(&pol_dom, 0x000003e8,
1616                                              1, names,
1617                                              &num_rids, &rids,
1618                                              &types) : False;
1619
1620         if (res1 && num_rids == 1 && rids)
1621         {
1622                 group_rid = rids[0];
1623         }
1624         if (rids)
1625         {
1626                 free(rids);
1627         }
1628         if (types)
1629         {
1630                 free(types);
1631         }
1632
1633         /* connect to the domain */
1634         res1 = res1 ? samr_open_group(&pol_dom,
1635                                       0x0000001f, group_rid,
1636                                       &pol_grp) : False;
1637
1638         res2 = res1 ? samr_delete_dom_group(&pol_grp) : False;
1639
1640         res1 = res1 ? samr_close(&pol_grp) : False;
1641         res = res ? samr_close(&pol_dom) : False;
1642         res = res ? samr_close(&sam_pol) : False;
1643
1644         if (res && res1 && res2)
1645         {
1646                 DEBUG(5, ("cmd_sam_delete_dom_group: succeeded\n"));
1647                 report(out_hnd, "Delete Domain Group: OK\n");
1648         }
1649         else
1650         {
1651                 DEBUG(5, ("cmd_sam_delete_dom_group: failed\n"));
1652                 report(out_hnd, "Delete Domain Group: FAILED\n");
1653         }
1654 }
1655
1656
1657 /****************************************************************************
1658 SAM add group member.
1659 ****************************************************************************/
1660 void cmd_sam_add_groupmem(struct client_info *info, int argc, char *argv[])
1661 {
1662         fstring srv_name;
1663         fstring domain;
1664         fstring sid;
1665         DOM_SID sid1;
1666         POLICY_HND pol_grp;
1667         BOOL res = True;
1668         BOOL res1 = True;
1669         BOOL res2 = True;
1670         BOOL res3 = True;
1671         BOOL res4 = True;
1672         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
1673         uint32 *group_rids;
1674         uint32 *group_types;
1675         char **names = NULL;
1676         uint32 num_names = 0;
1677         fstring group_name;
1678         char *group_names[1];
1679         uint32 *rids;
1680         uint32 *types;
1681         uint32 num_rids;
1682         uint32 num_group_rids;
1683         uint32 i;
1684         DOM_SID sid_1_5_20;
1685         POLICY_HND sam_pol;
1686         POLICY_HND pol_dom;
1687         POLICY_HND pol_blt;
1688
1689         string_to_sid(&sid_1_5_20, "S-1-5-32");
1690
1691         fstrcpy(srv_name, "\\\\");
1692         fstrcat(srv_name, info->dest_host);
1693         strupper(srv_name);
1694
1695         sid_copy(&sid1, &info->dom.level5_sid);
1696         sid_to_string(sid, &sid1);
1697         fstrcpy(domain, info->dom.level5_dom);
1698
1699         if (sid1.num_auths == 0)
1700         {
1701                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1702                     0x0)
1703                 {
1704                         report(out_hnd,
1705                                "please use 'lsaquery' first, to ascertain the SID\n");
1706                         return;
1707                 }
1708         }
1709
1710         if (argc < 3)
1711         {
1712                 report(out_hnd,
1713                        "addgroupmem <group name> [member name1] [member name2] ...\n");
1714                 return;
1715         }
1716
1717         argc--;
1718         argv++;
1719
1720         group_names[0] = argv[0];
1721
1722         argc--;
1723         argv++;
1724
1725         num_names = argc;
1726         names = (char **)argv;
1727
1728         report(out_hnd, "SAM Add Domain Group member\n");
1729
1730         /* establish a connection. */
1731         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1732
1733         /* connect to the domain */
1734         res4 = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
1735                                       &pol_dom) : False;
1736
1737         /* connect to the domain */
1738         res3 = res ? samr_open_domain(&sam_pol, ace_perms, &sid_1_5_20,
1739                                       &pol_blt) : False;
1740
1741         res2 = res4 ? samr_query_lookup_names(&pol_dom, 0x000003e8,
1742                                               1, group_names,
1743                                               &num_group_rids, &group_rids,
1744                                               &group_types) : False;
1745
1746         /* open the group */
1747         res2 = res2 ? samr_open_group(&pol_dom,
1748                                       0x0000001f, group_rids[0],
1749                                       &pol_grp) : False;
1750
1751         if (!res2
1752             || (group_types != NULL && group_types[0] == SID_NAME_UNKNOWN))
1753         {
1754                 if (group_rids != NULL)
1755                 {
1756                         free(group_rids);
1757                 }
1758                 if (group_types != NULL)
1759                 {
1760                         free(group_types);
1761                 }
1762
1763                 res2 = res3 ? samr_query_lookup_names(&pol_blt, 0x000003e8,
1764                                                       1, group_names,
1765                                                       &num_group_rids,
1766                                                       &group_rids,
1767                                                       &group_types) : False;
1768
1769                 /* open the group */
1770                 res2 = res2 ? samr_open_group(&pol_blt,
1771                                               0x0000001f, group_rids[0],
1772                                               &pol_grp) : False;
1773         }
1774
1775         if (res2 && group_types[0] == SID_NAME_ALIAS)
1776         {
1777                 report(out_hnd,
1778                        "%s is a local alias, not a group.  Use addaliasmem command instead\n",
1779                        group_name);
1780                 if (group_rids != NULL)
1781                 {
1782                         free(group_rids);
1783                 }
1784                 if (group_types != NULL)
1785                 {
1786                         free(group_types);
1787                 }
1788                 return;
1789         }
1790         res1 = res2 ? samr_query_lookup_names(&pol_dom, 0x000003e8,
1791                                               num_names, names,
1792                                               &num_rids, &rids,
1793                                               &types) : False;
1794
1795         if (num_rids == 0)
1796         {
1797                 report(out_hnd, "Member names not known\n");
1798         }
1799         for (i = 0; i < num_rids && res2 && res1; i++)
1800         {
1801                 if (types[i] == SID_NAME_UNKNOWN)
1802                 {
1803                         report(out_hnd, "Name %s unknown\n", names[i]);
1804                 }
1805                 else
1806                 {
1807                         if (samr_add_groupmem(&pol_grp, rids[i]))
1808                         {
1809                                 report(out_hnd,
1810                                        "RID added to Group 0x%x: 0x%x\n",
1811                                        group_rids[0], rids[i]);
1812                         }
1813                 }
1814         }
1815
1816         res1 = res ? samr_close(&pol_grp) : False;
1817         res1 = res3 ? samr_close(&pol_blt) : False;
1818         res1 = res4 ? samr_close(&pol_dom) : False;
1819         res = res ? samr_close(&sam_pol) : False;
1820
1821 #if 0
1822         free_char_array(num_names, names);
1823 #endif
1824
1825         if (res && res1 && res2)
1826         {
1827                 DEBUG(5, ("cmd_sam_add_groupmem: succeeded\n"));
1828                 report(out_hnd, "Add Domain Group Member: OK\n");
1829         }
1830         else
1831         {
1832                 DEBUG(5, ("cmd_sam_add_groupmem: failed\n"));
1833                 report(out_hnd, "Add Domain Group Member: FAILED\n");
1834         }
1835         if (group_rids != NULL)
1836         {
1837                 free(group_rids);
1838         }
1839         if (group_types != NULL)
1840         {
1841                 free(group_types);
1842         }
1843         if (rids != NULL)
1844         {
1845                 free(rids);
1846         }
1847         if (types != NULL)
1848         {
1849                 free(types);
1850         }
1851 }
1852
1853
1854 /****************************************************************************
1855 SAM create domain group.
1856 ****************************************************************************/
1857 void cmd_sam_create_dom_group(struct client_info *info, int argc,
1858                               char *argv[])
1859 {
1860         fstring srv_name;
1861         fstring domain;
1862         char *acct_name;
1863         fstring acct_desc;
1864         fstring sid;
1865         DOM_SID sid1;
1866         BOOL res = True;
1867         BOOL res1 = True;
1868         uint32 ace_perms = 0x02000000;  /* absolutely no idea. */
1869         uint32 group_rid;
1870         POLICY_HND sam_pol;
1871         POLICY_HND pol_dom;
1872
1873         fstrcpy(srv_name, "\\\\");
1874         fstrcat(srv_name, info->dest_host);
1875         strupper(srv_name);
1876
1877         sid_copy(&sid1, &info->dom.level5_sid);
1878         sid_to_string(sid, &sid1);
1879         fstrcpy(domain, info->dom.level5_dom);
1880
1881         if (sid1.num_auths == 0)
1882         {
1883                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1884                     0x0)
1885                 {
1886                         report(out_hnd,
1887                                "please use 'lsaquery' first, to ascertain the SID\n");
1888                         return;
1889                 }
1890         }
1891
1892
1893         if (argc < 2)
1894         {
1895                 report(out_hnd,
1896                        "creategroup: <acct name> [acct description]\n");
1897         }
1898
1899         acct_name = argv[1];
1900
1901         if (argc < 3)
1902         {
1903                 acct_desc[0] = 0;
1904         }
1905         else
1906         {
1907                 safe_strcpy(acct_desc, argv[2], sizeof(acct_desc) - 1);
1908         }
1909
1910
1911         report(out_hnd, "SAM Create Domain Group\n");
1912         report(out_hnd, "Domain: %s Name: %s Description: %s\n",
1913                domain, acct_name, acct_desc);
1914
1915         /* establish a connection. */
1916         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
1917
1918         /* connect to the domain */
1919         res = res ? samr_open_domain(&sam_pol, ace_perms, &sid1,
1920                                      &pol_dom) : False;
1921
1922         /* read some users */
1923         res1 = res ? create_samr_domain_group(&pol_dom,
1924                                               acct_name, acct_desc,
1925                                               &group_rid) : False;
1926
1927         res = res ? samr_close(&pol_dom) : False;
1928         res = res ? samr_close(&sam_pol) : False;
1929
1930         if (res && res1)
1931         {
1932                 DEBUG(5, ("cmd_sam_create_dom_group: succeeded\n"));
1933                 report(out_hnd, "Create Domain Group: OK\n");
1934         }
1935         else
1936         {
1937                 DEBUG(5, ("cmd_sam_create_dom_group: failed\n"));
1938                 report(out_hnd, "Create Domain Group: FAILED\n");
1939         }
1940 }
1941
1942 /****************************************************************************
1943 experimental SAM users enum.
1944 ****************************************************************************/
1945 void cmd_sam_enum_users(struct client_info *info, int argc, char *argv[])
1946 {
1947         BOOL request_user_info = False;
1948         BOOL request_group_info = False;
1949         BOOL request_alias_info = False;
1950         struct acct_info *sam = NULL;
1951         uint32 num_sam_entries = 0;
1952         int opt;
1953
1954         fstring srv_name;
1955         fstring domain;
1956         fstring sid;
1957         DOM_SID sid1;
1958
1959         fstrcpy(srv_name, "\\\\");
1960         fstrcat(srv_name, info->dest_host);
1961         strupper(srv_name);
1962
1963         sid_copy(&sid1, &info->dom.level5_sid);
1964         sid_to_string(sid, &sid1);
1965         fstrcpy(domain, info->dom.level5_dom);
1966
1967         if (sid1.num_auths == 0)
1968         {
1969                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
1970                     0x0)
1971                 {
1972                         report(out_hnd,
1973                                "please use 'lsaquery' first, to ascertain the SID\n");
1974                         return;
1975                 }
1976         }
1977
1978         while ((opt = getopt(argc, argv, "uga")) != EOF)
1979         {
1980                 switch (opt)
1981                 {
1982                         case 'u':
1983                         {
1984                                 request_user_info = True;
1985                                 break;
1986                         }
1987                         case 'g':
1988                         {
1989                                 request_group_info = True;
1990                                 break;
1991                         }
1992                         case 'a':
1993                         {
1994                                 request_alias_info = True;
1995                                 break;
1996                         }
1997                 }
1998         }
1999
2000         report(out_hnd, "SAM Enumerate Users\n");
2001
2002         msrpc_sam_enum_users(srv_name, domain, &sid1,
2003                              &sam, &num_sam_entries,
2004                              sam_display_user,
2005                              request_user_info ? sam_display_user_info : NULL,
2006                              request_group_info ? sam_display_group_members :
2007                              NULL,
2008                              request_alias_info ? sam_display_group_members :
2009                              NULL);
2010
2011         if (sam != NULL)
2012         {
2013                 free(sam);
2014         }
2015 }
2016
2017
2018 /****************************************************************************
2019 experimental SAM group query members.
2020 ****************************************************************************/
2021 void cmd_sam_query_groupmem(struct client_info *info, int argc, char *argv[])
2022 {
2023         fstring srv_name;
2024         fstring domain;
2025         fstring sid_str;
2026         DOM_SID sid;
2027         BOOL res = True;
2028         BOOL res1 = True;
2029
2030         char *group_name;
2031         char *names[1];
2032         uint32 num_rids;
2033         uint32 *rids;
2034         uint32 *types;
2035         POLICY_HND sam_pol;
2036         POLICY_HND pol_dom;
2037
2038         fstrcpy(srv_name, "\\\\");
2039         fstrcat(srv_name, info->dest_host);
2040         strupper(srv_name);
2041
2042         fstrcpy(domain, info->dom.level5_dom);
2043         sid_copy(&sid, &info->dom.level5_sid);
2044
2045         if (sid.num_auths == 0)
2046         {
2047                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2048                 {
2049                         report(out_hnd,
2050                                "please use 'lsaquery' first, to ascertain the SID\n");
2051                         return;
2052                 }
2053         }
2054
2055         if (argc < 2)
2056         {
2057                 report(out_hnd, "samgroupmem <name>\n");
2058                 return;
2059         }
2060
2061         group_name = argv[1];
2062
2063         sid_to_string(sid_str, &sid);
2064
2065         report(out_hnd, "SAM Query Group: %s\n", group_name);
2066         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
2067                info->myhostname, srv_name, domain, sid_str);
2068
2069         /* establish a connection. */
2070         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2071
2072         /* connect to the domain */
2073         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
2074
2075         /* look up group rid */
2076         names[0] = group_name;
2077         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2078                                              1, names,
2079                                              &num_rids, &rids,
2080                                              &types) : False;
2081
2082         if (res1 && num_rids == 1)
2083         {
2084                 res1 = req_groupmem_info(&pol_dom,
2085                                          domain,
2086                                          &sid,
2087                                          rids[0],
2088                                          group_name,
2089                                          sam_display_group_members);
2090         }
2091
2092         res = res ? samr_close(&pol_dom) : False;
2093         res = res ? samr_close(&sam_pol) : False;
2094
2095         if (res1)
2096         {
2097                 DEBUG(5, ("cmd_sam_query_group: succeeded\n"));
2098         }
2099         else
2100         {
2101                 DEBUG(5, ("cmd_sam_query_group: failed\n"));
2102         }
2103         if (rids != NULL)
2104         {
2105                 free(rids);
2106         }
2107         if (types != NULL)
2108         {
2109                 free(types);
2110         }
2111 }
2112
2113
2114 /****************************************************************************
2115 experimental SAM group query.
2116 ****************************************************************************/
2117 void cmd_sam_query_group(struct client_info *info, int argc, char *argv[])
2118 {
2119         fstring srv_name;
2120         fstring domain;
2121         fstring sid_str;
2122         DOM_SID sid;
2123         BOOL res = True;
2124         BOOL res1 = True;
2125
2126         char *group_name;
2127         char *names[1];
2128         uint32 num_rids;
2129         uint32 *rids;
2130         uint32 *types;
2131         POLICY_HND sam_pol;
2132         POLICY_HND pol_dom;
2133
2134         fstrcpy(srv_name, "\\\\");
2135         fstrcat(srv_name, info->dest_host);
2136         strupper(srv_name);
2137
2138         fstrcpy(domain, info->dom.level5_dom);
2139         sid_copy(&sid, &info->dom.level5_sid);
2140
2141         if (sid.num_auths == 0)
2142         {
2143                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2144                 {
2145                         report(out_hnd,
2146                                "please use 'lsaquery' first, to ascertain the SID\n");
2147                         return;
2148                 }
2149         }
2150
2151         if (argc < 2)
2152         {
2153                 report(out_hnd, "samgroup <name>\n");
2154                 return;
2155         }
2156
2157         group_name = argv[1];
2158
2159         sid_to_string(sid_str, &sid);
2160
2161         report(out_hnd, "SAM Query Group: %s\n", group_name);
2162         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
2163                info->myhostname, srv_name, domain, sid_str);
2164
2165         /* establish a connection. */
2166         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2167
2168         /* connect to the domain */
2169         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
2170
2171         /* look up group rid */
2172         names[0] = group_name;
2173         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2174                                              1, names,
2175                                              &num_rids, &rids,
2176                                              &types) : False;
2177
2178         if (res1 && num_rids == 1)
2179         {
2180                 res1 = query_groupinfo(&pol_dom,
2181                                        domain,
2182                                        &sid, rids[0], sam_display_group_info);
2183         }
2184
2185         res = res ? samr_close(&pol_dom) : False;
2186         res = res ? samr_close(&sam_pol) : False;
2187
2188         if (res1)
2189         {
2190                 DEBUG(5, ("cmd_sam_query_group: succeeded\n"));
2191         }
2192         else
2193         {
2194                 DEBUG(5, ("cmd_sam_query_group: failed\n"));
2195         }
2196         if (rids != NULL)
2197         {
2198                 free(rids);
2199         }
2200         if (types != NULL)
2201         {
2202                 free(types);
2203         }
2204
2205 }
2206
2207
2208 /****************************************************************************
2209 experimental SAM query security object.
2210 ****************************************************************************/
2211 void cmd_sam_query_sec_obj(struct client_info *info, int argc, char *argv[])
2212 {
2213         fstring srv_name;
2214         fstring domain;
2215         fstring sid_str;
2216         DOM_SID sid;
2217         BOOL res = True;
2218         BOOL res1 = True;
2219
2220         char *user_name;
2221         char *names[1];
2222         uint32 num_rids;
2223         uint32 *rids;
2224         uint32 *types;
2225         POLICY_HND sam_pol;
2226         POLICY_HND pol_dom;
2227
2228         fstrcpy(srv_name, "\\\\");
2229         fstrcat(srv_name, info->dest_host);
2230         strupper(srv_name);
2231
2232         fstrcpy(domain, info->dom.level5_dom);
2233         sid_copy(&sid, &info->dom.level5_sid);
2234
2235         if (sid.num_auths == 0)
2236         {
2237                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2238                 {
2239                         report(out_hnd,
2240                                "please use 'lsaquery' first, to ascertain the SID\n");
2241                         return;
2242                 }
2243         }
2244
2245         if (argc < 2)
2246         {
2247                 report(out_hnd, "samsecquery <name>\n");
2248                 return;
2249         }
2250
2251         user_name = argv[1];
2252
2253         argc--;
2254         argv++;
2255
2256         sid_to_string(sid_str, &sid);
2257
2258         report(out_hnd, "SAM Query User: %s\n", user_name);
2259         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
2260                info->myhostname, srv_name, domain, sid_str);
2261
2262         /* establish a connection. */
2263         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2264
2265         /* connect to the domain */
2266         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
2267
2268         /* look up user rid */
2269         names[0] = user_name;
2270         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2271                                              1, names,
2272                                              &num_rids, &rids,
2273                                              &types) : False;
2274
2275         /* send user info query */
2276         if (res1 && num_rids == 1)
2277         {
2278                 POLICY_HND pol_usr;
2279                 BOOL ret = True;
2280                 SEC_DESC_BUF buf;
2281
2282                 /* send open domain (on user sid) */
2283                 ret = samr_open_user(&pol_dom, 0x02011b, rids[0], &pol_usr);
2284                 res1 = ret ? samr_query_sec_obj(&pol_usr, 0x04, &buf) : False;
2285                 ret = ret ? samr_close(&pol_usr) : False;
2286
2287                 if (buf.sec != NULL)
2288                 {
2289                         display_sec_desc(out_hnd, ACTION_HEADER, buf.sec);
2290                         display_sec_desc(out_hnd, ACTION_ENUMERATE, buf.sec);
2291                         display_sec_desc(out_hnd, ACTION_FOOTER, buf.sec);
2292                 }
2293
2294                 free_sec_desc_buf(&buf);
2295         }
2296         else
2297         {
2298                 res1 = False;
2299         }
2300
2301         res = res ? samr_close(&pol_dom) : False;
2302         res = res ? samr_close(&sam_pol) : False;
2303
2304         if (res1)
2305         {
2306                 DEBUG(5, ("cmd_sam_query_sec_obj: succeeded\n"));
2307         }
2308         else
2309         {
2310                 DEBUG(5, ("cmd_sam_query_sec_obj: failed\n"));
2311         }
2312         if (rids != NULL)
2313         {
2314                 free(rids);
2315         }
2316         if (types != NULL)
2317         {
2318                 free(types);
2319         }
2320 }
2321
2322 /****************************************************************************
2323 experimental SAM user query.
2324 ****************************************************************************/
2325 void cmd_sam_query_user(struct client_info *info, int argc, char *argv[])
2326 {
2327         fstring srv_name;
2328         fstring domain;
2329         fstring sid_str;
2330         DOM_SID sid;
2331         BOOL res = True;
2332         BOOL res1 = True;
2333         int opt;
2334
2335         char *user_name;
2336         char *names[1];
2337         uint32 num_rids;
2338         uint32 *rids;
2339         uint32 *types;
2340         POLICY_HND sam_pol;
2341         POLICY_HND pol_dom;
2342         uint16 info_level = 0x15;
2343
2344         BOOL request_user_info = False;
2345         BOOL request_group_info = False;
2346         BOOL request_alias_info = False;
2347
2348         fstrcpy(srv_name, "\\\\");
2349         fstrcat(srv_name, info->dest_host);
2350         strupper(srv_name);
2351
2352         fstrcpy(domain, info->dom.level5_dom);
2353         sid_copy(&sid, &info->dom.level5_sid);
2354
2355         if (sid.num_auths == 0)
2356         {
2357                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2358                 {
2359                         report(out_hnd,
2360                                "please use 'lsaquery' first, to ascertain the SID\n");
2361                         return;
2362                 }
2363         }
2364
2365         if (argc < 2)
2366         {
2367                 report(out_hnd, "samuser <name> [-u] [-g] [-a]\n");
2368                 return;
2369         }
2370
2371         user_name = argv[1];
2372
2373         argc--;
2374         argv++;
2375
2376         while ((opt = getopt(argc, argv, "ugai:")) != EOF)
2377         {
2378                 switch (opt)
2379                 {
2380                         case 'u':
2381                         {
2382                                 request_user_info = True;
2383                                 break;
2384                         }
2385                         case 'g':
2386                         {
2387                                 request_group_info = True;
2388                                 break;
2389                         }
2390                         case 'a':
2391                         {
2392                                 request_alias_info = True;
2393                                 break;
2394                         }
2395                         case 'i':
2396                         {
2397                                 info_level = get_number(optarg);
2398                                 break;
2399                         }
2400                 }
2401         }
2402
2403         sid_to_string(sid_str, &sid);
2404
2405         report(out_hnd, "SAM Query User: %s\n", user_name);
2406         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
2407                info->myhostname, srv_name, domain, sid_str);
2408
2409         /* establish a connection. */
2410         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2411
2412         /* connect to the domain */
2413         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
2414
2415         /* look up user rid */
2416         names[0] = user_name;
2417         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2418                                              1, names,
2419                                              &num_rids, &rids,
2420                                              &types) : False;
2421
2422         /* send user info query */
2423         if (res1 && num_rids == 1)
2424         {
2425                 msrpc_sam_user(&pol_dom, NULL,
2426                                domain,
2427                                &sid, NULL,
2428                                rids[0], info_level, user_name,
2429                                sam_display_user,
2430                                request_user_info ? sam_display_user_info :
2431                                NULL,
2432                                request_group_info ? sam_display_group_members
2433                                : NULL,
2434                                request_alias_info ? sam_display_group_members
2435                                : NULL);
2436         }
2437         else
2438         {
2439                 res1 = False;
2440         }
2441
2442         res = res ? samr_close(&pol_dom) : False;
2443         res = res ? samr_close(&sam_pol) : False;
2444
2445         if (res1)
2446         {
2447                 DEBUG(5, ("cmd_sam_query_user: succeeded\n"));
2448         }
2449         else
2450         {
2451                 DEBUG(5, ("cmd_sam_query_user: failed\n"));
2452         }
2453         if (rids != NULL)
2454         {
2455                 free(rids);
2456         }
2457         if (types != NULL)
2458         {
2459                 free(types);
2460         }
2461 }
2462
2463
2464 /****************************************************************************
2465 experimental SAM user set.
2466 ****************************************************************************/
2467 void cmd_sam_set_userinfo2(struct client_info *info, int argc, char *argv[])
2468 {
2469         fstring srv_name;
2470         fstring domain;
2471         fstring sid_str;
2472         DOM_SID sid;
2473         BOOL res = True;
2474         BOOL res1 = True;
2475         int opt;
2476         BOOL set_acb_bits = False;
2477         BOOL clr_acb_bits = False;
2478
2479         fstring user_name;
2480
2481         char *names[1];
2482         uint32 num_rids;
2483         uint32 *rids;
2484         uint32 *types;
2485         POLICY_HND sam_pol;
2486         POLICY_HND pol_dom;
2487         SAM_USERINFO_CTR ctr;
2488         uint16 acb_set = 0x0;
2489         uint16 acb_clr = 0x0;
2490
2491         BOOL set_passwd = False;
2492
2493         fstring password;
2494
2495         fstrcpy(srv_name, "\\\\");
2496         fstrcat(srv_name, info->dest_host);
2497         strupper(srv_name);
2498
2499         fstrcpy(domain, info->dom.level5_dom);
2500         sid_copy(&sid, &info->dom.level5_sid);
2501
2502         if (sid.num_auths == 0)
2503         {
2504                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2505                 {
2506                         report(out_hnd,
2507                                "please use 'lsaquery' first, to ascertain the SID\n");
2508                         return;
2509                 }
2510         }
2511
2512         if (argc < 2)
2513         {
2514                 report(out_hnd,
2515                        "samuserset2 <name> [-s <acb_bits>] [-c <acb_bits]\n");
2516                 return;
2517         }
2518
2519         argc--;
2520         argv++;
2521
2522         safe_strcpy(user_name, argv[0], sizeof(user_name));
2523
2524         while ((opt = getopt(argc, argv, "s:c:p:")) != EOF)
2525         {
2526                 switch (opt)
2527                 {
2528                         case 'p':
2529                         {
2530                                 set_passwd = True;
2531                                 safe_strcpy(password, optarg,
2532                                             sizeof(password) - 1);
2533                                 break;
2534                         }
2535                         case 's':
2536                         {
2537                                 set_acb_bits = True;
2538                                 acb_set = get_number(optarg);
2539                                 break;
2540                         }
2541                         case 'c':
2542                         {
2543                                 clr_acb_bits = True;
2544                                 acb_clr = get_number(optarg);
2545                                 break;
2546                         }
2547                 }
2548         }
2549
2550         sid_to_string(sid_str, &sid);
2551
2552         report(out_hnd, "SAM Set User Info: %s\n", user_name);
2553
2554         /* establish a connection. */
2555         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2556
2557         /* connect to the domain */
2558         res = res ? samr_open_domain(&sam_pol, 0x02000000, &sid,
2559                                      &pol_dom) : False;
2560
2561         /* look up user rid */
2562         names[0] = user_name;
2563         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2564                                              1, names,
2565                                              &num_rids, &rids,
2566                                              &types) : False;
2567
2568
2569         if (set_passwd && res1 && num_rids == 1)
2570         {
2571                 void *usr = NULL;
2572                 uint32 switch_value = 0;
2573
2574                 SAM_USER_INFO_12 *p =
2575                         (SAM_USER_INFO_12 *) malloc(sizeof(SAM_USER_INFO_12));
2576                 usr = (void *)p;
2577                 switch_value = 0x12;
2578
2579                 if (usr != NULL)
2580                 {
2581                         nt_lm_owf_gen(password, p->nt_pwd, p->lm_pwd);
2582                         p->lm_pwd_active = 1;
2583                         p->nt_pwd_active = 1;
2584                         res1 = set_samr_set_userinfo2(&pol_dom,
2585                                                       switch_value, rids[0],
2586                                                       usr);
2587                 }
2588         }
2589
2590         /* send set user info */
2591         if ((!set_passwd) && res1 && num_rids == 1 &&
2592             get_samr_query_userinfo(&pol_dom, 0x10, rids[0], &ctr))
2593         {
2594                 void *usr = NULL;
2595                 uint32 switch_value = 0;
2596
2597                 if (True)
2598                 {
2599                         SAM_USER_INFO_10 *p =
2600                                 (SAM_USER_INFO_10 *)
2601                                 malloc(sizeof(SAM_USER_INFO_10));
2602                         p->acb_info = ctr.info.id10->acb_info;
2603                         DEBUG(10, ("acb_info: %x\n", p->acb_info));
2604                         if (set_acb_bits)
2605                         {
2606                                 p->acb_info |= acb_set;
2607                         }
2608
2609                         if (clr_acb_bits)
2610                         {
2611                                 p->acb_info &= (~acb_clr);
2612                         }
2613
2614                         DEBUG(10, ("acb_info: %x\n", p->acb_info));
2615
2616                         usr = (void *)p;
2617                         switch_value = 16;
2618                 }
2619
2620                 if (usr != NULL)
2621                 {
2622                         res1 = set_samr_set_userinfo2(&pol_dom,
2623                                                       switch_value, rids[0],
2624                                                       usr);
2625                 }
2626         }
2627
2628         res = res ? samr_close(&pol_dom) : False;
2629         res = res ? samr_close(&sam_pol) : False;
2630
2631         if (res1)
2632         {
2633                 report(out_hnd, "Set User Info: OK\n");
2634                 DEBUG(5, ("cmd_sam_query_user: succeeded\n"));
2635         }
2636         else
2637         {
2638                 report(out_hnd, "Set User Info: Failed\n");
2639                 DEBUG(5, ("cmd_sam_query_user: failed\n"));
2640         }
2641         safe_free(rids);
2642         safe_free(types);
2643         free_samr_userinfo_ctr(&ctr);
2644 }
2645
2646 /****************************************************************************
2647 experimental SAM user set.
2648 ****************************************************************************/
2649 void cmd_sam_set_userinfo(struct client_info *info, int argc, char *argv[])
2650 {
2651         fstring srv_name;
2652         fstring domain;
2653         fstring sid_str;
2654         DOM_SID sid;
2655         BOOL res = True;
2656         BOOL res1 = True;
2657         int opt;
2658         BOOL set_passwd = False;
2659
2660         fstring user_name;
2661         fstring password;
2662
2663         char *names[1];
2664         uint32 num_rids;
2665         uint32 *rids;
2666         uint32 *types;
2667         POLICY_HND sam_pol;
2668         POLICY_HND pol_dom;
2669         SAM_USERINFO_CTR ctr;
2670
2671         ZERO_STRUCT(ctr);
2672
2673         fstrcpy(srv_name, "\\\\");
2674         fstrcat(srv_name, info->dest_host);
2675         strupper(srv_name);
2676
2677         fstrcpy(domain, info->dom.level5_dom);
2678         sid_copy(&sid, &info->dom.level5_sid);
2679
2680         if (sid.num_auths == 0)
2681         {
2682                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2683                 {
2684                         report(out_hnd,
2685                                "please use 'lsaquery' first, to ascertain the SID\n");
2686                         return;
2687                 }
2688         }
2689
2690         argc--;
2691         argv++;
2692
2693         if (argc == 0)
2694         {
2695                 report(out_hnd, "samuserset <name> [-p password]\n");
2696                 return;
2697         }
2698
2699         safe_strcpy(user_name, argv[0], sizeof(user_name));
2700
2701         if (argc == 1)
2702         {
2703                 fstring pass_str;
2704                 char *pass;
2705                 slprintf(pass_str, sizeof(pass_str) - 1,
2706                          "Enter %s's Password:", user_name);
2707                 pass = (char *)getpass(pass_str);
2708
2709                 if (pass != NULL)
2710                 {
2711                         safe_strcpy(password, pass, sizeof(password) - 1);
2712                         set_passwd = True;
2713                 }
2714         }
2715         else
2716         {
2717                 while ((opt = getopt(argc, argv, "p:")) != EOF)
2718                 {
2719                         switch (opt)
2720                         {
2721                                 case 'p':
2722                                 {
2723                                         set_passwd = True;
2724                                         safe_strcpy(password, optarg,
2725                                                     sizeof(password) - 1);
2726                                         break;
2727                                 }
2728                         }
2729                 }
2730         }
2731
2732         sid_to_string(sid_str, &sid);
2733
2734         report(out_hnd, "SAM Set User Info: %s\n", user_name);
2735         report(out_hnd, "Password: %s\n", password);
2736
2737         /* establish a connection. */
2738         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
2739
2740         /* connect to the domain */
2741         res = res ? samr_open_domain(&sam_pol, 0x02000000, &sid,
2742                                      &pol_dom) : False;
2743
2744         /* look up user rid */
2745         names[0] = user_name;
2746         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
2747                                              1, names,
2748                                              &num_rids, &rids,
2749                                              &types) : False;
2750
2751         /* send set user info */
2752         if (res1 && num_rids == 1 && get_samr_query_userinfo(&pol_dom,
2753                                                              0x15, rids[0],
2754                                                              &ctr))
2755         {
2756                 void *usr = NULL;
2757                 uint32 switch_value = 0;
2758                 char pwbuf[516];
2759
2760                 if (set_passwd)
2761                 {
2762                         encode_pw_buffer(pwbuf, password,
2763                                          strlen(password), True);
2764                 }
2765
2766                 if (True)
2767                 {
2768                         SAM_USER_INFO_24 *p =
2769                                 (SAM_USER_INFO_24 *)
2770                                 malloc(sizeof(SAM_USER_INFO_24));
2771                         make_sam_user_info24(p, pwbuf, strlen(password));
2772
2773                         usr = p;
2774                         switch_value = 24;
2775                 }
2776
2777                 if (False)
2778                 {
2779                         SAM_USER_INFO_21 *usr21 = ctr.info.id21;
2780                         SAM_USER_INFO_23 *p =
2781                                 (SAM_USER_INFO_23 *)
2782                                 malloc(sizeof(SAM_USER_INFO_23));
2783                         /* send user info query, level 0x15 */
2784                         make_sam_user_info23W(p,
2785                                               &usr21->logon_time,
2786                                               &usr21->logoff_time,
2787                                               &usr21->kickoff_time,
2788                                               &usr21->pass_last_set_time,
2789                                               &usr21->pass_can_change_time,
2790                                               &usr21->pass_must_change_time,
2791                                               &usr21->uni_user_name,
2792                                               &usr21->uni_full_name,
2793                                               &usr21->uni_home_dir,
2794                                               &usr21->uni_dir_drive,
2795                                               &usr21->uni_logon_script,
2796                                               &usr21->uni_profile_path,
2797                                               &usr21->uni_acct_desc,
2798                                               &usr21->uni_workstations,
2799                                               &usr21->uni_unknown_str,
2800                                               &usr21->uni_munged_dial,
2801                                               0x0,
2802                                               usr21->group_rid,
2803                                               usr21->acb_info,
2804                                               0x09f827fa,
2805                                               usr21->logon_divs,
2806                                               &usr21->logon_hrs,
2807                                               usr21->unknown_5,
2808                                               pwbuf, usr21->unknown_6);
2809
2810                         usr = p;
2811                         switch_value = 23;
2812                 }
2813                 if (usr != NULL)
2814                 {
2815                         res1 = set_samr_set_userinfo(&pol_dom,
2816                                                      switch_value, rids[0],
2817                                                      usr);
2818                 }
2819         }
2820
2821         free_samr_userinfo_ctr(&ctr);
2822
2823         res = res ? samr_close(&pol_dom) : False;
2824         res = res ? samr_close(&sam_pol) : False;
2825
2826         if (res1)
2827         {
2828                 report(out_hnd, "Set User Info: OK\n");
2829                 DEBUG(5, ("cmd_sam_query_user: succeeded\n"));
2830         }
2831         else
2832         {
2833                 report(out_hnd, "Set User Info: Failed\n");
2834                 DEBUG(5, ("cmd_sam_query_user: failed\n"));
2835         }
2836         if (rids != NULL)
2837         {
2838                 free(rids);
2839         }
2840         if (types != NULL)
2841         {
2842                 free(types);
2843         }
2844         free_samr_userinfo_ctr(&ctr);
2845 }
2846
2847 static void sam_display_disp_info(const char *domain, const DOM_SID * sid,
2848                                   uint16 info, uint32 num,
2849                                   SAM_DISPINFO_CTR * ctr)
2850 {
2851         report(out_hnd, "SAM Display Info for Domain %s\n", domain);
2852
2853         display_sam_disp_info_ctr(out_hnd, ACTION_HEADER, info, num, ctr);
2854         display_sam_disp_info_ctr(out_hnd, ACTION_ENUMERATE, info, num, ctr);
2855         display_sam_disp_info_ctr(out_hnd, ACTION_FOOTER, info, num, ctr);
2856 }
2857
2858 /****************************************************************************
2859 experimental SAM query display info.
2860 ****************************************************************************/
2861 void cmd_sam_query_dispinfo(struct client_info *info, int argc, char *argv[])
2862 {
2863         fstring srv_name;
2864         fstring domain;
2865         fstring sid;
2866         DOM_SID sid1;
2867         uint16 switch_value = 1;
2868         SAM_DISPINFO_CTR ctr;
2869         SAM_DISPINFO_1 inf1;
2870         uint32 num_entries;
2871
2872         fstrcpy(srv_name, "\\\\");
2873         fstrcat(srv_name, info->dest_host);
2874         strupper(srv_name);
2875
2876         sid_to_string(sid, &info->dom.level5_sid);
2877         fstrcpy(domain, info->dom.level5_dom);
2878
2879         string_to_sid(&sid1, sid);
2880
2881         if (sid1.num_auths == 0)
2882         {
2883                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
2884                     0x0)
2885                 {
2886                         fprintf(out_hnd,
2887                                 "please use 'lsaquery' first, to ascertain the SID\n");
2888                         return;
2889                 }
2890         }
2891
2892         if (argc > 1)
2893         {
2894                 switch_value = strtoul(argv[1], (char **)NULL, 10);
2895         }
2896
2897         ctr.sam.info1 = &inf1;
2898
2899         if (msrpc_sam_query_dispinfo(srv_name, domain, &sid1,
2900                                      switch_value,
2901                                      &num_entries, &ctr,
2902                                      sam_display_disp_info))
2903         {
2904
2905                 DEBUG(5, ("cmd_sam_query_dispinfo: succeeded\n"));
2906         }
2907         else
2908         {
2909                 DEBUG(5, ("cmd_sam_query_dispinfo: failed\n"));
2910         }
2911 }
2912
2913 /****************************************************************************
2914 experimental SAM domain info query.
2915 ****************************************************************************/
2916 void cmd_sam_query_dominfo(struct client_info *info, int argc, char *argv[])
2917 {
2918         fstring domain;
2919         fstring sid;
2920         DOM_SID sid1;
2921         uint32 switch_value = 2;
2922         SAM_UNK_CTR ctr;
2923         fstring srv_name;
2924         fstrcpy(srv_name, "\\\\");
2925         fstrcat(srv_name, info->dest_host);
2926         strupper(srv_name);
2927
2928         sid_to_string(sid, &info->dom.level5_sid);
2929         fstrcpy(domain, info->dom.level5_dom);
2930
2931         string_to_sid(&sid1, sid);
2932
2933         if (sid1.num_auths == 0)
2934         {
2935                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
2936                     0x0)
2937                 {
2938                         report(out_hnd,
2939                                "please use 'lsaquery' first, to ascertain the SID\n");
2940                         return;
2941                 }
2942         }
2943
2944         if (argc > 1)
2945         {
2946                 switch_value = strtoul(argv[1], (char **)NULL, 10);
2947         }
2948
2949         if (sam_query_dominfo(srv_name, &sid1, switch_value, &ctr))
2950         {
2951                 DEBUG(5, ("cmd_sam_query_dominfo: succeeded\n"));
2952                 sam_display_dom_info(domain, &sid1, switch_value, &ctr);
2953         }
2954         else
2955         {
2956                 DEBUG(5, ("cmd_sam_query_dominfo: failed\n"));
2957         }
2958 }
2959
2960 /****************************************************************************
2961 experimental SAM alias query members.
2962 ****************************************************************************/
2963 void cmd_sam_query_aliasmem(struct client_info *info, int argc, char *argv[])
2964 {
2965         fstring srv_name;
2966         fstring domain;
2967         fstring sid_str;
2968         DOM_SID sid;
2969         BOOL res = True;
2970         BOOL res1 = True;
2971
2972         char *alias_name;
2973         char *names[1];
2974         uint32 num_rids;
2975         uint32 *rids;
2976         uint32 *types;
2977         POLICY_HND sam_pol;
2978         POLICY_HND pol_dom;
2979
2980         fstrcpy(srv_name, "\\\\");
2981         fstrcat(srv_name, info->dest_host);
2982         strupper(srv_name);
2983
2984         fstrcpy(domain, info->dom.level5_dom);
2985         sid_copy(&sid, &info->dom.level5_sid);
2986
2987         if (sid.num_auths == 0)
2988         {
2989                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
2990                 {
2991                         report(out_hnd,
2992                                "please use 'lsaquery' first, to ascertain the SID\n");
2993                         return;
2994                 }
2995         }
2996
2997         if (argc < 2)
2998         {
2999                 report(out_hnd, "samaliasmem <name>\n");
3000                 return;
3001         }
3002
3003         alias_name = argv[1];
3004
3005         sid_to_string(sid_str, &sid);
3006
3007         report(out_hnd, "SAM Query Alias: %s\n", alias_name);
3008         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
3009                info->myhostname, srv_name, domain, sid_str);
3010
3011         /* establish a connection. */
3012         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
3013
3014         /* connect to the domain */
3015         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
3016
3017         /* look up alias rid */
3018         names[0] = alias_name;
3019         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
3020                                              1, names,
3021                                              &num_rids, &rids,
3022                                              &types) : False;
3023
3024         if (res1 && num_rids == 1)
3025         {
3026                 res1 = req_aliasmem_info(srv_name,
3027                                          &pol_dom,
3028                                          domain,
3029                                          &sid,
3030                                          rids[0],
3031                                          alias_name,
3032                                          sam_display_alias_members);
3033         }
3034
3035         res = res ? samr_close(&pol_dom) : False;
3036         res = res ? samr_close(&sam_pol) : False;
3037
3038         if (res1)
3039         {
3040                 DEBUG(5, ("cmd_sam_query_alias: succeeded\n"));
3041         }
3042         else
3043         {
3044                 DEBUG(5, ("cmd_sam_query_alias: failed\n"));
3045         }
3046         if (rids != NULL)
3047         {
3048                 free(rids);
3049         }
3050         if (types != NULL)
3051         {
3052                 free(types);
3053         }
3054 }
3055
3056
3057 /****************************************************************************
3058 experimental SAM alias query.
3059 ****************************************************************************/
3060 void cmd_sam_query_alias(struct client_info *info, int argc, char *argv[])
3061 {
3062         fstring srv_name;
3063         fstring domain;
3064         fstring sid_str;
3065         DOM_SID sid;
3066         BOOL res = True;
3067         BOOL res1 = True;
3068
3069         char *alias_name;
3070         char *names[1];
3071         uint32 num_rids;
3072         uint32 *rids;
3073         uint32 *types;
3074         POLICY_HND sam_pol;
3075         POLICY_HND pol_dom;
3076
3077         fstrcpy(srv_name, "\\\\");
3078         fstrcat(srv_name, info->dest_host);
3079         strupper(srv_name);
3080
3081         fstrcpy(domain, info->dom.level5_dom);
3082         sid_copy(&sid, &info->dom.level5_sid);
3083
3084         if (sid.num_auths == 0)
3085         {
3086                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid) != 0x0)
3087                 {
3088                         report(out_hnd,
3089                                "please use 'lsaquery' first, to ascertain the SID\n");
3090                         return;
3091                 }
3092         }
3093
3094         if (argc < 2)
3095         {
3096                 report(out_hnd, "samalias <name>\n");
3097                 return;
3098         }
3099
3100         alias_name = argv[1];
3101
3102         sid_to_string(sid_str, &sid);
3103
3104         report(out_hnd, "SAM Query Alias: %s\n", alias_name);
3105         report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n",
3106                info->myhostname, srv_name, domain, sid_str);
3107
3108         /* establish a connection. */
3109         res = res ? samr_connect(srv_name, 0x02000000, &sam_pol) : False;
3110
3111         /* connect to the domain */
3112         res = res ? samr_open_domain(&sam_pol, 0x304, &sid, &pol_dom) : False;
3113
3114         /* look up alias rid */
3115         names[0] = alias_name;
3116         res1 = res ? samr_query_lookup_names(&pol_dom, 0x3e8,
3117                                              1, names,
3118                                              &num_rids, &rids,
3119                                              &types) : False;
3120
3121         if (res1 && num_rids == 1)
3122         {
3123                 res1 = query_aliasinfo(&pol_dom,
3124                                        domain,
3125                                        &sid, rids[0], sam_display_alias_info);
3126         }
3127
3128         res = res ? samr_close(&pol_dom) : False;
3129         res = res ? samr_close(&sam_pol) : False;
3130
3131         if (res1)
3132         {
3133                 DEBUG(5, ("cmd_sam_query_alias: succeeded\n"));
3134         }
3135         else
3136         {
3137                 DEBUG(5, ("cmd_sam_query_alias: failed\n"));
3138         }
3139         if (rids != NULL)
3140         {
3141                 free(rids);
3142         }
3143         if (types != NULL)
3144         {
3145                 free(types);
3146         }
3147 }
3148
3149
3150 /****************************************************************************
3151 SAM aliases query.
3152 ****************************************************************************/
3153 void cmd_sam_enum_aliases(struct client_info *info, int argc, char *argv[])
3154 {
3155         BOOL request_member_info = False;
3156         BOOL request_alias_info = False;
3157         struct acct_info *sam = NULL;
3158         uint32 num_sam_entries = 0;
3159         int opt;
3160
3161         fstring domain;
3162         fstring srv_name;
3163         fstring sid;
3164         DOM_SID sid1;
3165
3166         fstrcpy(srv_name, "\\\\");
3167         fstrcat(srv_name, info->dest_host);
3168         strupper(srv_name);
3169
3170         sid_copy(&sid1, &info->dom.level5_sid);
3171         sid_to_string(sid, &sid1);
3172         fstrcpy(domain, info->dom.level5_dom);
3173
3174         while ((opt = getopt(argc, argv, "mad:")) != EOF)
3175         {
3176                 switch (opt)
3177                 {
3178                         case 'd':
3179                         {
3180                                 fill_domain_sid(srv_name, optarg,
3181                                                 domain, &sid1);
3182                                 break;
3183                         }
3184                         case 'm':
3185                         {
3186                                 request_member_info = True;
3187                                 break;
3188                         }
3189                         case 'a':
3190                         {
3191                                 request_alias_info = True;
3192                                 break;
3193                         }
3194                 }
3195         }
3196
3197         if (sid1.num_auths == 0)
3198         {
3199                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
3200                     0x0)
3201                 {
3202                         report(out_hnd,
3203                                "please use 'lsaquery' first, to ascertain the SID\n");
3204                         return;
3205                 }
3206         }
3207
3208         report(out_hnd, "SAM Enumerate Aliases\n");
3209
3210         msrpc_sam_enum_aliases(srv_name, domain, &sid1,
3211                                &sam, &num_sam_entries,
3212                                sam_display_alias,
3213                                request_alias_info ? sam_display_alias_info :
3214                                NULL,
3215                                request_member_info ? sam_display_alias_members
3216                                : NULL);
3217
3218         if (sam != NULL)
3219         {
3220                 free(sam);
3221         }
3222 }
3223
3224 /****************************************************************************
3225 experimental SAM groups enum.
3226 ****************************************************************************/
3227 void cmd_sam_enum_groups(struct client_info *info, int argc, char *argv[])
3228 {
3229         BOOL request_member_info = False;
3230         BOOL request_group_info = False;
3231         struct acct_info *sam = NULL;
3232         uint32 num_sam_entries = 0;
3233         int opt;
3234
3235         fstring srv_name;
3236         fstring domain;
3237         fstring sid;
3238         DOM_SID sid1;
3239
3240         fstrcpy(srv_name, "\\\\");
3241         fstrcat(srv_name, info->dest_host);
3242         strupper(srv_name);
3243
3244         sid_copy(&sid1, &info->dom.level5_sid);
3245         sid_to_string(sid, &sid1);
3246         fstrcpy(domain, info->dom.level5_dom);
3247
3248         if (sid1.num_auths == 0)
3249         {
3250                 if (msrpc_sam_get_first_domain(srv_name, domain, &sid1) !=
3251                     0x0)
3252                 {
3253                         report(out_hnd,
3254                                "please use 'lsaquery' first, to ascertain the SID\n");
3255                         return;
3256                 }
3257         }
3258
3259         while ((opt = getopt(argc, argv, "mg")) != EOF)
3260         {
3261                 switch (opt)
3262                 {
3263                         case 'm':
3264                         {
3265                                 request_member_info = True;
3266                                 break;
3267                         }
3268                         case 'g':
3269                         {
3270                                 request_group_info = True;
3271                                 break;
3272                         }
3273                 }
3274         }
3275
3276         report(out_hnd, "SAM Enumerate Groups\n");
3277
3278         msrpc_sam_enum_groups(srv_name, domain, &sid1,
3279                               &sam, &num_sam_entries,
3280                               sam_display_group,
3281                               request_group_info ? sam_display_group_info :
3282                               NULL,
3283                               request_member_info ? sam_display_group_members
3284                               : NULL);
3285
3286         if (sam != NULL)
3287         {
3288                 free(sam);
3289         }
3290 }
3291
3292 /****************************************************************************
3293 experimental SAM domains enum.
3294 ****************************************************************************/
3295 void cmd_sam_enum_domains(struct client_info *info, int argc, char *argv[])
3296 {
3297         BOOL request_domain_info = False;
3298         struct acct_info *sam = NULL;
3299         uint32 num_sam_entries = 0;
3300         int opt;
3301
3302         fstring srv_name;
3303
3304         fstrcpy(srv_name, "\\\\");
3305         fstrcat(srv_name, info->dest_host);
3306         strupper(srv_name);
3307
3308         while ((opt = getopt(argc, argv, "i")) != EOF)
3309         {
3310                 switch (opt)
3311                 {
3312                         case 'i':
3313                         {
3314                                 request_domain_info = True;
3315                                 break;
3316                         }
3317                 }
3318         }
3319
3320         report(out_hnd, "SAM Enumerate Domains\n");
3321
3322         msrpc_sam_enum_domains(srv_name,
3323                                &sam, &num_sam_entries,
3324                                request_domain_info ? NULL :
3325                                sam_display_domain,
3326                                request_domain_info ? sam_display_dom_info :
3327                                NULL);
3328
3329         if (sam != NULL)
3330         {
3331                 free(sam);
3332         }
3333 }