finally getting somewhere with querysecret, setsecret

diff --git a/source/include/proto.h b/source/include/proto.h
index 6833319a4676d3c36a094f5e98f982c0fb1537ae..6c86c32fdc87fd06b2a1bddc23c4f04a3cc0dc70 100644 (file)
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -2545,7 +2545,7 @@ uint32 lookup_lsa_sid(const char *domain,
                                DOM_SID *sid, char *name, uint32 *type);
 BOOL msrpc_lsa_set_secret(const char* srv_name,
                                const char* secret_name,
-                               const STRING2 *secret);
+                               const char* data, int len);
 BOOL msrpc_lsa_query_secret(const char* srv_name,
                                const char* secret_name,
                                STRING2 *secret,

diff --git a/source/include/rpc_client_proto.h b/source/include/rpc_client_proto.h
index 79b2404e67f3c3e094e48d6fb2b54ed2cc71cfb3..ff2d07f07d74afd49b53ae0b6cbf8bb0dbc657c0 100644 (file)
--- a/source/include/rpc_client_proto.h
+++ b/source/include/rpc_client_proto.h
@@ -486,7 +486,7 @@ uint32 lookup_lsa_sid(const char *domain,
                                DOM_SID *sid, char *name, uint32 *type);
 BOOL msrpc_lsa_set_secret(const char* srv_name,
                                const char* secret_name,
-                               const STRING2 *secret);
+                               const char* data, int len);
 BOOL msrpc_lsa_query_secret(const char* srv_name,
                                const char* secret_name,
                                STRING2 *secret,

diff --git a/source/include/rpc_lsa.h b/source/include/rpc_lsa.h
index e24918dfaffbbff39763ad5a3e3d3ac7c64d05a3..bc989e8b776284142af69343580c5a3326a8964d 100644 (file)
--- a/source/include/rpc_lsa.h
+++ b/source/include/rpc_lsa.h
@@ -47,8 +47,8 @@ enum SID_NAME_USE
 #define LSA_OPENPOLICY         0x06
 #define LSA_OPENPOLICY2        0x2c
 #define LSA_OPENSECRET         0x1c
+#define LSA_SETSECRET          0x1d
 #define LSA_QUERYSECRET        0x1e
-#define LSA_SETSECRET        0x1f
 
 #define LSA_MAX_GROUPS 32
 #define LSA_MAX_SIDS 32
@@ -216,8 +216,8 @@ typedef struct lsa_q_set_secret_info
 {
        POLICY_HND pol;
 
-       uint32 ptr_value;
        LSA_SECRET_VALUE value;
+       uint32 unknown;
 
 } LSA_Q_SET_SECRET;
 

diff --git a/source/libsmb/pwd_cache.c b/source/libsmb/pwd_cache.c
index 9ad3881c064f124f3f2272420409ad4ed27dd000..2c3352ea6c695d92f23ad965e2d66c50259d97b1 100644 (file)
--- a/source/libsmb/pwd_cache.c
+++ b/source/libsmb/pwd_cache.c
@@ -334,7 +334,7 @@ void pwd_make_lm_nt_owf2(struct pwd_info *pwd, const uchar srv_key[8],
        dump_data(100, pwd->smb_lm_pwd, sizeof(pwd->smb_lm_pwd));
 
        DEBUG(100,("session key:\n"));
-       dump_data(100, sess_key, sizeof(sess_key));
+       dump_data(100, sess_key, 16);
 #endif
        pwd->crypted = True;
 
@@ -379,7 +379,7 @@ void pwd_make_lm_nt_owf(struct pwd_info *pwd, uchar cryptkey[8],
        dump_data(100, pwd->smb_lm_pwd, sizeof(pwd->smb_lm_pwd));
 
        DEBUG(100,("session key:\n"));
-       dump_data(100, sess_key, sizeof(sess_key));
+       dump_data(100, sess_key, 16);
 #endif
 
        pwd->crypted = True;

diff --git a/source/libsmb/smbencrypt.c b/source/libsmb/smbencrypt.c
index d9d53f8038a858f4b2a9ffc4cd6887b3919d3624..ae936f5409e92eab479182617d861e0a7a66a022 100644 (file)
--- a/source/libsmb/smbencrypt.c
+++ b/source/libsmb/smbencrypt.c
@@ -454,28 +454,21 @@ BOOL make_oem_passwd_hash(uchar data[516],
 
 BOOL nt_encrypt_string2(STRING2 *out, const STRING2 *in, const uchar *key)
 {
-       uchar bufhdr[8];
-       int datalen;
-
        const uchar *keyptr = key;
        const uchar *keyend = key + 16;
+       int datalen = in->str_str_len;
 
        uchar *outbuf = (uchar *)out->buffer;
        const uchar *inbuf = (const uchar *)in->buffer;
        const uchar *inbufend;
 
-       smbhash(bufhdr, inbuf, keyptr, 1);
-       datalen = IVAL(inbuf, 0);
+       out->str_max_len = in->str_max_len;
+       out->str_str_len = in->str_str_len;
+       out->undoc = 0;
 
-       if ((datalen > in->str_str_len) || (datalen > MAX_STRINGLEN))
-       {
-               DEBUG(0, ("nt_decrypt_string2: failed\n"));
-               return False;
-       }
-
-       out->str_max_len = out->str_str_len = datalen;
-       inbuf += 8;
        inbufend = inbuf + datalen;
+       
+       dump_data_pw("nt_encrypt_string2\n", inbuf, datalen);
 
        while (inbuf < inbufend)
        {
@@ -533,6 +526,9 @@ BOOL nt_decrypt_string2(STRING2 *out, const STRING2 *in, const uchar *key)
                outbuf += 8;
        }
 
+       dump_data_pw("nt_decrypt_string2\n", bufhdr, 8);
+       dump_data_pw("nt_decrypt_string2\n", out->buffer, datalen);
+
        return True;
 }
 

diff --git a/source/rpc_client/cli_connect.c b/source/rpc_client/cli_connect.c
index 359e984cfc8c87e99244cd43a9aa5d6cbe40ab23..a80928173869514b7736f263fd99d1be8dc8fa5f 100644 (file)
--- a/source/rpc_client/cli_connect.c
+++ b/source/rpc_client/cli_connect.c
@@ -189,6 +189,7 @@ static struct cli_connection *cli_con_get(const char* srv_name,
                                        cli_connection_free(con);
                                        return NULL;
                                }
+                               dump_data_pw("sess key:", con->msrpc.smb->cli->nt.usr_sess_key, 16);
                        }
                        else
                        {
@@ -434,6 +435,7 @@ BOOL cli_pol_link(POLICY_HND *to, const POLICY_HND *from)
 
        if (!cli_connection_get(from, &con))
        {
+               DEBUG(0,("cli_pol_link: no connection\n"));
                return False;
        }
 
@@ -457,14 +459,17 @@ BOOL cli_get_usr_sesskey(const POLICY_HND *pol, uchar usr_sess_key[16])
        }
        if (con == NULL)
        {
+               DEBUG(0,("cli_get_usr_sesskey: no connection\n"));
                return False;
        }
        nt = cli_conn_get_ntinfo(con);
-       if (nt != NULL)
+       if (nt == NULL)
        {
-               memcpy(usr_sess_key,nt->usr_sess_key,sizeof(nt->usr_sess_key));
+               DEBUG(0,("cli_get_usr_sesskey: no ntdom_info\n"));
+               return False;
        }
-
+       
+       memcpy(usr_sess_key,nt->usr_sess_key,sizeof(nt->usr_sess_key));
 
        return True;
 }
@@ -584,6 +589,8 @@ BOOL cli_get_con_sesskey(struct cli_connection *con, uchar sess_key[16])
        nt = cli_conn_get_ntinfo(con);
        memcpy(sess_key, nt->sess_key, sizeof(nt->sess_key));
 
+       dump_data_pw("sess_key:", sess_key, 16);
+
        return True;
 }
 

diff --git a/source/rpc_client/cli_lsarpc.c b/source/rpc_client/cli_lsarpc.c
index 047eb3adbbda01b85e9bbbad4e7703c869d092ac..0bbe667c3c269df28ed810e0fa29dca8dbdc5cc4 100644 (file)
--- a/source/rpc_client/cli_lsarpc.c
+++ b/source/rpc_client/cli_lsarpc.c
@@ -317,7 +317,7 @@ BOOL lsa_open_policy2( const char *system_name, POLICY_HND *hnd,
        lsa_io_q_open_pol2("", &q_o, &buf, 0);
 
        /* send the data on \PIPE\ */
-       if (rpc_con_pipe_req(con, LSA_OPENPOLICY, &buf, &rbuf))
+       if (rpc_con_pipe_req(con, LSA_OPENPOLICY2, &buf, &rbuf))
        {
                LSA_R_OPEN_POL2 r_o;
                BOOL p;
@@ -399,7 +399,7 @@ BOOL lsa_open_secret( const POLICY_HND *hnd,
                {
                        /* ok, at last: we're happy. return the policy handle */
                        memcpy(hnd_secret, r_o.pol.data, sizeof(hnd_secret->data));
-                       valid_pol = True;
+                       valid_pol = cli_pol_link(hnd_secret, hnd);
                }
        }
 
@@ -431,11 +431,12 @@ uint32 lsa_set_secret(POLICY_HND *hnd, const STRING2 *secret)
        DEBUG(4,("LSA Set Secret\n"));
 
        memcpy(&q_q.pol, hnd, sizeof(q_q.pol));
-       q_q.ptr_value = 1;
+       q_q.unknown = 0x0;
+       q_q.value.ptr_secret = 0x1;
        make_strhdr2(&q_q.value.hdr_secret, secret->str_str_len,
                                            secret->str_max_len, 1);
 
-       if (!cli_get_sesskey(hnd, sess_key))
+       if (!cli_get_usr_sesskey(hnd, sess_key))
        {
                return NT_STATUS_INVALID_PARAMETER;
        }
@@ -528,13 +529,11 @@ BOOL lsa_query_secret(POLICY_HND *hnd, STRING2 *secret,
                        STRING2 enc_secret;
                        memcpy(&enc_secret,  &(r_q.info.value.enc_secret), sizeof(STRING2));
                        memcpy(last_update, &(r_q.info.last_update),      sizeof(NTTIME));
-                       if (!cli_get_sesskey(hnd, sess_key))
+                       if (!cli_get_usr_sesskey(hnd, sess_key))
                        {
                                return False;
                        }
-#ifdef DEBUG_PASSWORD
-                       dump_data(100, sess_key, 16);
-#endif
+                       dump_data_pw("sess key:", sess_key, 16);
                        valid_info = nt_decrypt_string2(secret, &enc_secret,
                                     sess_key);
                }

diff --git a/source/rpc_client/msrpc_lsarpc.c b/source/rpc_client/msrpc_lsarpc.c
index 7e69aaadb3823b8a9627edfe342339f4db97f136..acb5d059e5676a460d5038f2a96cb68dd2e4ef39 100644 (file)
--- a/source/rpc_client/msrpc_lsarpc.c
+++ b/source/rpc_client/msrpc_lsarpc.c
@@ -192,7 +192,7 @@ nt lsa query secret
 ****************************************************************************/
 BOOL msrpc_lsa_set_secret(const char* srv_name,
                                const char* secret_name,
-                               const STRING2 *secret)
+                               const char* data, int len)
 {
        BOOL res = True;
        BOOL res1;
@@ -200,16 +200,25 @@ BOOL msrpc_lsa_set_secret(const char* srv_name,
 
        POLICY_HND pol_sec;
        POLICY_HND lsa_pol;
+       STRING2 secret;
+
+       secret.str_max_len = len+8;
+       secret.undoc       = 0;
+       secret.str_str_len = len+8;
+
+       SIVAL(secret.buffer, 0, len+8);
+       SIVAL(secret.buffer, 4, len+8);
+       memcpy(secret.buffer+8, data, len);
 
        /* lookup domain controller; receive a policy handle */
        res = res ? lsa_open_policy2( srv_name,
-                               &lsa_pol, False, 0x02000000) : False;
+                               &lsa_pol, True, 0x02000000) : False;
 
        /* lookup domain controller; receive a policy handle */
        res1 = res ? lsa_open_secret( &lsa_pol,
-                               secret_name, 0x02000000, &pol_sec) : False;
+                               secret_name, 0x020003, &pol_sec) : False;
 
-       res2 = res1 ? (lsa_set_secret(&pol_sec, secret) == NT_STATUS_NOPROBLEMO) : False;
+       res2 = res1 ? (lsa_set_secret(&pol_sec, &secret) == NT_STATUS_NOPROBLEMO) : False;
 
        res1 = res1 ? lsa_close(&pol_sec) : False;
 

diff --git a/source/rpc_parse/parse_lsa.c b/source/rpc_parse/parse_lsa.c
index 68e339f34aca891ab7dd124d363418060e43d4ea..6980500701fdfa72ebbae9671061373b8034fbe8 100644 (file)
--- a/source/rpc_parse/parse_lsa.c
+++ b/source/rpc_parse/parse_lsa.c
@@ -411,6 +411,8 @@ BOOL lsa_io_q_open_pol2(char *desc,  LSA_Q_OPEN_POL2 *r_q, prs_struct *ps, int d
        prs_uint32("ptr       ", ps, depth, &(r_q->ptr       ));
 
        smb_io_unistr2 ("", &(r_q->uni_server_name), r_q->ptr, ps, depth);
+       prs_align(ps);
+
        lsa_io_obj_attr("", &(r_q->attr           ), ps, depth);
 
        if (r_q->attr.ptr_sec_qos == 0)
@@ -664,12 +666,8 @@ BOOL lsa_io_q_set_secret(char *desc, LSA_Q_SET_SECRET *q_q, prs_struct *ps, int
 
        smb_io_pol_hnd("", &(q_q->pol), ps, depth);
 
-       prs_uint32("ptr_value ", ps, depth, &(q_q->ptr_value ));
-
-       if (q_q->ptr_value != 0)
-       {
-               lsa_io_secret_value("", &(q_q->value), ps, depth);
-       }
+       lsa_io_secret_value("", &(q_q->value), ps, depth);
+       prs_uint32("unknown", ps, depth, &(q_q->unknown));
 
        return True;
 }

diff --git a/source/rpcclient/cmd_lsarpc.c b/source/rpcclient/cmd_lsarpc.c
index 27797e8fa53f9cf686e24d3906f65cae5903741a..38fff9f9c2e27cb388235f261caae7f1f29c15e5 100644 (file)
--- a/source/rpcclient/cmd_lsarpc.c
+++ b/source/rpcclient/cmd_lsarpc.c
@@ -339,8 +339,9 @@ nt lsa query
 void cmd_lsa_set_secret(struct client_info *info, int argc, char *argv[])
 {
        char *secret_name;
-       STRING2 secret;
        fstring srv_name;
+       char *data;
+       int len;
 
        fstrcpy(srv_name, "\\\\");
        fstrcat(srv_name, info->dest_host);
@@ -353,10 +354,10 @@ void cmd_lsa_set_secret(struct client_info *info, int argc, char *argv[])
        }
 
        secret_name = argv[1];
+       data = argv[2];
+       len = strlen(argv[2]);
 
-       make_string2(&secret, argv[2], strlen(argv[2]));
-
-       if (msrpc_lsa_set_secret(srv_name, secret_name, &secret))
+       if (msrpc_lsa_set_secret(srv_name, secret_name, data, len))
        {
                report(out_hnd, "LSA Set Secret: OK\n");
        }