2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 #include "libnet/libnet.h"
24 #include "librpc/gen_ndr/ndr_samr.h"
25 #include "lib/crypto/crypto.h"
28 * do a password change using DCERPC/SAMR calls
29 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
30 * 2. try samr_ChangePasswordUser3
31 * 3. try samr_ChangePasswordUser2
32 * 4. try samr_OemChangePasswordUser2
33 * (not yet: 5. try samr_ChangePasswordUser)
35 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
38 struct libnet_RpcConnect c;
40 struct policy_handle user_handle;
41 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
42 struct samr_ChangePasswordUser pw;
44 struct samr_OemChangePasswordUser2 oe2;
45 struct samr_ChangePasswordUser2 pw2;
46 struct samr_ChangePasswordUser3 pw3;
47 struct lsa_String server, account;
48 struct lsa_AsciiString a_server, a_account;
49 struct samr_CryptPassword nt_pass, lm_pass;
50 struct samr_Password nt_verifier, lm_verifier;
51 uint8_t old_nt_hash[16], new_nt_hash[16];
52 uint8_t old_lm_hash[16], new_lm_hash[16];
54 /* prepare connect to the SAMR pipe of the users domain PDC */
55 c.level = LIBNET_RPC_CONNECT_PDC;
56 c.in.domain_name = r->samr.in.domain_name;
57 c.in.dcerpc_iface = &dcerpc_table_samr;
59 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
60 status = libnet_RpcConnect(ctx, mem_ctx, &c);
61 if (!NT_STATUS_IS_OK(status)) {
62 r->samr.out.error_string = talloc_asprintf(mem_ctx,
63 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
64 r->samr.in.domain_name, nt_errstr(status));
68 /* prepare password change for account */
69 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
70 account.string = r->samr.in.account_name;
72 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
73 E_md4hash(r->samr.in.newpassword, new_nt_hash);
75 E_deshash(r->samr.in.oldpassword, old_lm_hash);
76 E_deshash(r->samr.in.newpassword, new_lm_hash);
78 /* prepare samr_ChangePasswordUser3 */
79 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
80 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
81 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
83 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
84 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
85 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
87 pw3.in.server = &server;
88 pw3.in.account = &account;
89 pw3.in.nt_password = &nt_pass;
90 pw3.in.nt_verifier = &nt_verifier;
92 pw3.in.lm_password = &lm_pass;
93 pw3.in.lm_verifier = &lm_verifier;
94 pw3.in.password3 = NULL;
96 /* 2. try samr_ChangePasswordUser3 */
97 status = dcerpc_samr_ChangePasswordUser3(c.out.dcerpc_pipe, mem_ctx, &pw3);
98 if (!NT_STATUS_IS_OK(status)) {
99 r->samr.out.error_string = talloc_asprintf(mem_ctx,
100 "samr_ChangePasswordUser3 failed: %s\n",
102 goto ChangePasswordUser2;
105 /* check result of samr_ChangePasswordUser3 */
106 if (!NT_STATUS_IS_OK(pw3.out.result)) {
107 r->samr.out.error_string = talloc_asprintf(mem_ctx,
108 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
109 r->samr.in.domain_name, r->samr.in.account_name,
110 nt_errstr(pw3.out.result));
111 /* TODO: give the reason of the reject */
112 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
113 status = pw3.out.result;
116 goto ChangePasswordUser2;
122 /* prepare samr_ChangePasswordUser2 */
123 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
124 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
125 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
127 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
128 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
129 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
131 pw2.in.server = &server;
132 pw2.in.account = &account;
133 pw2.in.nt_password = &nt_pass;
134 pw2.in.nt_verifier = &nt_verifier;
135 pw2.in.lm_change = 1;
136 pw2.in.lm_password = &lm_pass;
137 pw2.in.lm_verifier = &lm_verifier;
139 /* 3. try samr_ChangePasswordUser2 */
140 status = dcerpc_samr_ChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &pw2);
141 if (!NT_STATUS_IS_OK(status)) {
142 r->samr.out.error_string = talloc_asprintf(mem_ctx,
143 "samr_ChangePasswordUser2 failed: %s\n",
145 goto OemChangePasswordUser2;
148 /* check result of samr_ChangePasswordUser2 */
149 if (!NT_STATUS_IS_OK(pw2.out.result)) {
150 r->samr.out.error_string = talloc_asprintf(mem_ctx,
151 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
152 r->samr.in.domain_name, r->samr.in.account_name,
153 nt_errstr(pw2.out.result));
154 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
155 status = pw2.out.result;
158 goto OemChangePasswordUser2;
163 OemChangePasswordUser2:
164 /* prepare samr_OemChangePasswordUser2 */
165 a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
166 a_account.string = r->samr.in.account_name;
168 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
169 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
170 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
172 oe2.in.server = &a_server;
173 oe2.in.account = &a_account;
174 oe2.in.password = &lm_pass;
175 oe2.in.hash = &lm_verifier;
177 /* 4. try samr_OemChangePasswordUser2 */
178 status = dcerpc_samr_OemChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &oe2);
179 if (!NT_STATUS_IS_OK(status)) {
180 r->samr.out.error_string = talloc_asprintf(mem_ctx,
181 "samr_OemChangePasswordUser2 failed: %s\n",
183 goto ChangePasswordUser;
186 /* check result of samr_OemChangePasswordUser2 */
187 if (!NT_STATUS_IS_OK(oe2.out.result)) {
188 r->samr.out.error_string = talloc_asprintf(mem_ctx,
189 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
190 r->samr.in.domain_name, r->samr.in.account_name,
191 nt_errstr(oe2.out.result));
192 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
193 status = oe2.out.result;
196 goto ChangePasswordUser;
203 /* prepare samr_ChangePasswordUser */
204 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
205 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
206 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
207 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
208 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
209 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
211 /* TODO: ask for a user_handle */
212 pw.in.handle = &user_handle;
213 pw.in.lm_present = 1;
214 pw.in.old_lm_crypted = &hash1;
215 pw.in.new_lm_crypted = &hash2;
216 pw.in.nt_present = 1;
217 pw.in.old_nt_crypted = &hash3;
218 pw.in.new_nt_crypted = &hash4;
219 pw.in.cross1_present = 1;
220 pw.in.nt_cross = &hash5;
221 pw.in.cross2_present = 1;
222 pw.in.lm_cross = &hash6;
224 /* 5. try samr_ChangePasswordUser */
225 status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
226 if (!NT_STATUS_IS_OK(status)) {
227 r->samr.out.error_string = talloc_asprintf(mem_ctx,
228 "samr_ChangePasswordUser failed: %s\n",
233 /* check result of samr_ChangePasswordUser */
234 if (!NT_STATUS_IS_OK(pw.out.result)) {
235 r->samr.out.error_string = talloc_asprintf(mem_ctx,
236 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
237 r->samr.in.domain_name, r->samr.in.account_name,
238 nt_errstr(pw.out.result));
239 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
240 status = pw.out.result;
247 /* close connection */
248 talloc_free(c.out.dcerpc_pipe);
253 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
256 union libnet_ChangePassword r2;
258 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
259 r2.samr.in.account_name = r->generic.in.account_name;
260 r2.samr.in.domain_name = r->generic.in.domain_name;
261 r2.samr.in.oldpassword = r->generic.in.oldpassword;
262 r2.samr.in.newpassword = r->generic.in.newpassword;
264 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
266 r->generic.out.error_string = r2.samr.out.error_string;
271 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
273 switch (r->generic.level) {
274 case LIBNET_CHANGE_PASSWORD_GENERIC:
275 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
276 case LIBNET_CHANGE_PASSWORD_SAMR:
277 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
278 case LIBNET_CHANGE_PASSWORD_KRB5:
279 return NT_STATUS_NOT_IMPLEMENTED;
280 case LIBNET_CHANGE_PASSWORD_LDAP:
281 return NT_STATUS_NOT_IMPLEMENTED;
282 case LIBNET_CHANGE_PASSWORD_RAP:
283 return NT_STATUS_NOT_IMPLEMENTED;
286 return NT_STATUS_INVALID_LEVEL;
289 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
292 struct samr_SetUserInfo sui;
293 union samr_UserInfo u_info;
294 DATA_BLOB session_key;
295 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
296 uint8_t confounder[16];
297 struct MD5Context md5;
299 /* prepare samr_SetUserInfo level 26 */
301 encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
302 u_info.info26.pw_len = strlen(r->samr_handle.in.newpassword);
304 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
305 if (!NT_STATUS_IS_OK(status)) {
306 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
307 "dcerpc_fetch_session_key failed: %s\n",
312 generate_random_buffer((uint8_t *)confounder, 16);
315 MD5Update(&md5, confounder, 16);
316 MD5Update(&md5, session_key.data, session_key.length);
317 MD5Final(confounded_session_key.data, &md5);
319 arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
320 memcpy(&u_info.info26.password.data[516], confounder, 16);
322 sui.in.user_handle = r->samr_handle.in.user_handle;
323 sui.in.info = &u_info;
326 /* 7. try samr_SetUserInfo level 26 to set the password */
327 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
328 /* check result of samr_SetUserInfo level 26 */
329 if (!NT_STATUS_IS_OK(status)) {
330 r->samr_handle.out.error_string
331 = talloc_asprintf(mem_ctx,
332 "SetUserInfo level 26 for [%s] failed: %s\n",
333 r->samr_handle.in.account_name, nt_errstr(status));
338 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
341 struct samr_SetUserInfo sui;
342 union samr_UserInfo u_info;
343 DATA_BLOB session_key;
344 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
345 uint8_t confounder[16];
346 struct MD5Context md5;
348 /* prepare samr_SetUserInfo level 25 */
350 u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
351 encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
353 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
354 if (!NT_STATUS_IS_OK(status)) {
355 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
356 "dcerpc_fetch_session_key failed: %s\n",
361 generate_random_buffer((uint8_t *)confounder, 16);
364 MD5Update(&md5, confounder, 16);
365 MD5Update(&md5, session_key.data, session_key.length);
366 MD5Final(confounded_session_key.data, &md5);
368 arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
369 memcpy(&u_info.info25.password.data[516], confounder, 16);
371 sui.in.user_handle = r->samr_handle.in.user_handle;
372 sui.in.info = &u_info;
375 /* 8. try samr_SetUserInfo level 25 to set the password */
376 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
377 if (!NT_STATUS_IS_OK(status)) {
378 r->samr_handle.out.error_string
379 = talloc_asprintf(mem_ctx,
380 "SetUserInfo level 25 for [%s] failed: %s\n",
381 r->samr_handle.in.account_name, nt_errstr(status));
386 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
389 struct samr_SetUserInfo sui;
390 union samr_UserInfo u_info;
391 DATA_BLOB session_key;
393 /* prepare samr_SetUserInfo level 24 */
395 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
396 /* w2k3 ignores this length */
397 u_info.info24.pw_len = strlen_m(r->samr_handle.in.newpassword)*2;
399 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
400 if (!NT_STATUS_IS_OK(status)) {
401 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
402 "dcerpc_fetch_session_key failed: %s\n",
407 arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
409 sui.in.user_handle = r->samr_handle.in.user_handle;
410 sui.in.info = &u_info;
413 /* 9. try samr_SetUserInfo level 24 to set the password */
414 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
415 if (!NT_STATUS_IS_OK(status)) {
416 r->samr_handle.out.error_string
417 = talloc_asprintf(mem_ctx,
418 "SetUserInfo level 24 for [%s] failed: %s\n",
419 r->samr_handle.in.account_name, nt_errstr(status));
424 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
427 struct samr_SetUserInfo sui;
428 union samr_UserInfo u_info;
429 DATA_BLOB session_key;
431 /* prepare samr_SetUserInfo level 23 */
433 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
434 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
436 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
437 if (!NT_STATUS_IS_OK(status)) {
438 r->samr_handle.out.error_string
439 = talloc_asprintf(mem_ctx,
440 "dcerpc_fetch_session_key failed: %s\n",
445 arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
447 sui.in.user_handle = r->samr_handle.in.user_handle;
448 sui.in.info = &u_info;
451 /* 10. try samr_SetUserInfo level 23 to set the password */
452 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
453 if (!NT_STATUS_IS_OK(status)) {
454 r->samr_handle.out.error_string
455 = talloc_asprintf(mem_ctx,
456 "SetUserInfo level 23 for [%s] failed: %s\n",
457 r->samr_handle.in.account_name, nt_errstr(status));
463 * 1. try samr_SetUserInfo level 26 to set the password
464 * 2. try samr_SetUserInfo level 25 to set the password
465 * 3. try samr_SetUserInfo level 24 to set the password
466 * 4. try samr_SetUserInfo level 23 to set the password
468 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
471 enum libnet_SetPassword_level levels[] = {
472 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
473 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
474 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
475 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
479 for (i=0; i < ARRAY_SIZE(levels); i++) {
480 r->generic.level = levels[i];
481 status = libnet_SetPassword(ctx, mem_ctx, r);
482 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS) && !NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
490 * set a password with DCERPC/SAMR calls
491 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
492 * is it correct to contact the the pdc of the domain of the user who's password should be set?
493 * 2. do a samr_Connect to get a policy handle
494 * 3. do a samr_LookupDomain to get the domain sid
495 * 4. do a samr_OpenDomain to get a domain handle
496 * 5. do a samr_LookupNames to get the users rid
497 * 6. do a samr_OpenUser to get a user handle
498 * 7 call libnet_SetPassword_samr_handle to set the password
500 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
503 struct libnet_RpcConnect c;
504 struct samr_Connect sc;
505 struct policy_handle p_handle;
506 struct samr_LookupDomain ld;
507 struct lsa_String d_name;
508 struct samr_OpenDomain od;
509 struct policy_handle d_handle;
510 struct samr_LookupNames ln;
511 struct samr_OpenUser ou;
512 struct policy_handle u_handle;
513 union libnet_SetPassword r2;
515 /* prepare connect to the SAMR pipe of users domain PDC */
516 c.level = LIBNET_RPC_CONNECT_PDC;
517 c.in.domain_name = r->samr.in.domain_name;
518 c.in.dcerpc_iface = &dcerpc_table_samr;
520 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
521 status = libnet_RpcConnect(ctx, mem_ctx, &c);
522 if (!NT_STATUS_IS_OK(status)) {
523 r->samr.out.error_string = talloc_asprintf(mem_ctx,
524 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
525 r->samr.in.domain_name, nt_errstr(status));
529 /* prepare samr_Connect */
530 ZERO_STRUCT(p_handle);
531 sc.in.system_name = NULL;
532 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
533 sc.out.connect_handle = &p_handle;
535 /* 2. do a samr_Connect to get a policy handle */
536 status = dcerpc_samr_Connect(c.out.dcerpc_pipe, mem_ctx, &sc);
537 if (!NT_STATUS_IS_OK(status)) {
538 r->samr.out.error_string = talloc_asprintf(mem_ctx,
539 "samr_Connect failed: %s\n",
544 /* prepare samr_LookupDomain */
545 d_name.string = r->samr.in.domain_name;
546 ld.in.connect_handle = &p_handle;
547 ld.in.domain_name = &d_name;
549 /* 3. do a samr_LookupDomain to get the domain sid */
550 status = dcerpc_samr_LookupDomain(c.out.dcerpc_pipe, mem_ctx, &ld);
551 if (!NT_STATUS_IS_OK(status)) {
552 r->samr.out.error_string = talloc_asprintf(mem_ctx,
553 "samr_LookupDomain for [%s] failed: %s\n",
554 r->samr.in.domain_name, nt_errstr(status));
558 /* prepare samr_OpenDomain */
559 ZERO_STRUCT(d_handle);
560 od.in.connect_handle = &p_handle;
561 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
562 od.in.sid = ld.out.sid;
563 od.out.domain_handle = &d_handle;
565 /* 4. do a samr_OpenDomain to get a domain handle */
566 status = dcerpc_samr_OpenDomain(c.out.dcerpc_pipe, mem_ctx, &od);
567 if (!NT_STATUS_IS_OK(status)) {
568 r->samr.out.error_string = talloc_asprintf(mem_ctx,
569 "samr_OpenDomain for [%s] failed: %s\n",
570 r->samr.in.domain_name, nt_errstr(status));
574 /* prepare samr_LookupNames */
575 ln.in.domain_handle = &d_handle;
577 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
579 r->samr.out.error_string = "Out of Memory";
580 return NT_STATUS_NO_MEMORY;
582 ln.in.names[0].string = r->samr.in.account_name;
584 /* 5. do a samr_LookupNames to get the users rid */
585 status = dcerpc_samr_LookupNames(c.out.dcerpc_pipe, mem_ctx, &ln);
586 if (!NT_STATUS_IS_OK(status)) {
587 r->samr.out.error_string = talloc_asprintf(mem_ctx,
588 "samr_LookupNames for [%s] failed: %s\n",
589 r->samr.in.account_name, nt_errstr(status));
593 /* check if we got one RID for the user */
594 if (ln.out.rids.count != 1) {
595 r->samr.out.error_string = talloc_asprintf(mem_ctx,
596 "samr_LookupNames for [%s] returns %d RIDs\n",
597 r->samr.in.account_name, ln.out.rids.count);
598 status = NT_STATUS_INVALID_PARAMETER;
602 /* prepare samr_OpenUser */
603 ZERO_STRUCT(u_handle);
604 ou.in.domain_handle = &d_handle;
605 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
606 ou.in.rid = ln.out.rids.ids[0];
607 ou.out.user_handle = &u_handle;
609 /* 6. do a samr_OpenUser to get a user handle */
610 status = dcerpc_samr_OpenUser(c.out.dcerpc_pipe, mem_ctx, &ou);
611 if (!NT_STATUS_IS_OK(status)) {
612 r->samr.out.error_string = talloc_asprintf(mem_ctx,
613 "samr_OpenUser for [%s] failed: %s\n",
614 r->samr.in.account_name, nt_errstr(status));
618 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
619 r2.samr_handle.in.account_name = r->samr.in.account_name;
620 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
621 r2.samr_handle.in.user_handle = &u_handle;
622 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
624 status = libnet_SetPassword(ctx, mem_ctx, &r2);
626 r->generic.out.error_string = r2.samr_handle.out.error_string;
629 /* close connection */
630 talloc_free(c.out.dcerpc_pipe);
635 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
638 union libnet_SetPassword r2;
640 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
641 r2.samr.in.account_name = r->generic.in.account_name;
642 r2.samr.in.domain_name = r->generic.in.domain_name;
643 r2.samr.in.newpassword = r->generic.in.newpassword;
645 r->generic.out.error_string = "Unknown Error";
646 status = libnet_SetPassword(ctx, mem_ctx, &r2);
648 r->generic.out.error_string = r2.samr.out.error_string;
653 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
655 switch (r->generic.level) {
656 case LIBNET_SET_PASSWORD_GENERIC:
657 return libnet_SetPassword_generic(ctx, mem_ctx, r);
658 case LIBNET_SET_PASSWORD_SAMR:
659 return libnet_SetPassword_samr(ctx, mem_ctx, r);
660 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
661 return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
662 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
663 return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
664 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
665 return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
666 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
667 return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
668 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
669 return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
670 case LIBNET_SET_PASSWORD_KRB5:
671 return NT_STATUS_NOT_IMPLEMENTED;
672 case LIBNET_SET_PASSWORD_LDAP:
673 return NT_STATUS_NOT_IMPLEMENTED;
674 case LIBNET_SET_PASSWORD_RAP:
675 return NT_STATUS_NOT_IMPLEMENTED;
678 return NT_STATUS_INVALID_LEVEL;