2 Unix SMB/CIFS implementation.
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "rpcclient.h"
26 /* useful function to allow entering a name instead of a SID and
27 * looking it up automatically */
28 static NTSTATUS name_to_sid(struct cli_state *cli,
30 DOM_SID *sid, const char *name)
37 /* maybe its a raw SID */
38 if (strncmp(name, "S-", 2) == 0 &&
39 string_to_sid(sid, name)) {
43 result = cli_lsa_open_policy(cli, mem_ctx, True,
44 SEC_RIGHTS_MAXIMUM_ALLOWED,
46 if (!NT_STATUS_IS_OK(result))
49 result = cli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, &sids, &sid_types);
50 if (!NT_STATUS_IS_OK(result))
53 cli_lsa_close(cli, mem_ctx, &pol);
61 /* Look up domain related information on a remote host */
63 static NTSTATUS cmd_lsa_query_info_policy(struct cli_state *cli,
64 TALLOC_CTX *mem_ctx, int argc,
68 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
71 fstring sid_str, domain_name="", dns_name="", forest_name="";
72 uint32 info_class = 3;
75 printf("Usage: %s [info_class]\n", argv[0]);
80 info_class = atoi(argv[1]);
82 /* Lookup info policy */
85 result = cli_lsa_open_policy2(cli, mem_ctx, True,
86 SEC_RIGHTS_MAXIMUM_ALLOWED,
89 if (!NT_STATUS_IS_OK(result))
91 result = cli_lsa_query_info_policy2(cli, mem_ctx, &pol,
92 info_class, domain_name,
93 dns_name, forest_name,
97 result = cli_lsa_open_policy(cli, mem_ctx, True,
98 SEC_RIGHTS_MAXIMUM_ALLOWED,
101 if (!NT_STATUS_IS_OK(result))
103 result = cli_lsa_query_info_policy(cli, mem_ctx, &pol,
104 info_class, domain_name,
108 if (!NT_STATUS_IS_OK(result))
111 sid_to_string(sid_str, &dom_sid);
114 printf("domain %s has sid %s\n", domain_name, sid_str);
116 printf("could not query info for level %d\n", info_class);
119 printf("domain dns name is %s\n", dns_name);
121 printf("forest name is %s\n", forest_name);
123 if (info_class == 12) {
124 printf("domain GUID is ");
125 print_guid(&dom_guid);
131 /* Resolve a list of names to a list of sids */
133 static NTSTATUS cmd_lsa_lookup_names(struct cli_state *cli,
134 TALLOC_CTX *mem_ctx, int argc,
138 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
144 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
148 result = cli_lsa_open_policy(cli, mem_ctx, True,
149 SEC_RIGHTS_MAXIMUM_ALLOWED,
152 if (!NT_STATUS_IS_OK(result))
155 result = cli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
156 (const char**)(argv + 1), &sids, &types);
158 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
159 NT_STATUS_V(STATUS_SOME_UNMAPPED))
162 result = NT_STATUS_OK;
166 for (i = 0; i < (argc - 1); i++) {
168 sid_to_string(sid_str, &sids[i]);
169 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
170 sid_type_lookup(types[i]), types[i]);
177 /* Resolve a list of SIDs to a list of names */
179 static NTSTATUS cmd_lsa_lookup_sids(struct cli_state *cli, TALLOC_CTX *mem_ctx,
180 int argc, char **argv)
183 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
191 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
195 result = cli_lsa_open_policy(cli, mem_ctx, True,
196 SEC_RIGHTS_MAXIMUM_ALLOWED,
199 if (!NT_STATUS_IS_OK(result))
202 /* Convert arguments to sids */
204 sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * (argc - 1));
207 printf("could not allocate memory for %d sids\n", argc - 1);
211 for (i = 0; i < argc - 1; i++)
212 string_to_sid(&sids[i], argv[i + 1]);
214 /* Lookup the SIDs */
216 result = cli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
217 &domains, &names, &types);
219 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
220 NT_STATUS_V(STATUS_SOME_UNMAPPED))
223 result = NT_STATUS_OK;
227 for (i = 0; i < (argc - 1); i++) {
230 sid_to_string(sid_str, &sids[i]);
231 printf("%s %s\\%s (%d)\n", sid_str,
232 domains[i] ? domains[i] : "*unknown*",
233 names[i] ? names[i] : "*unknown*", types[i]);
240 /* Enumerate list of trusted domains */
242 static NTSTATUS cmd_lsa_enum_trust_dom(struct cli_state *cli,
243 TALLOC_CTX *mem_ctx, int argc,
247 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
248 DOM_SID *domain_sids;
251 /* defaults, but may be changed using params */
253 uint32 num_domains = 0;
257 printf("Usage: %s [enum context (0)]\n", argv[0]);
261 if (argc == 2 && argv[1]) {
262 enum_ctx = atoi(argv[2]);
265 result = cli_lsa_open_policy(cli, mem_ctx, True,
266 POLICY_VIEW_LOCAL_INFORMATION,
269 if (!NT_STATUS_IS_OK(result))
272 /* Lookup list of trusted domains */
274 result = cli_lsa_enum_trust_dom(cli, mem_ctx, &pol, &enum_ctx,
276 &domain_names, &domain_sids);
277 if (!NT_STATUS_IS_OK(result) &&
278 !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
279 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
282 /* Print results: list of names and sids returned in this response. */
283 for (i = 0; i < num_domains; i++) {
286 sid_to_string(sid_str, &domain_sids[i]);
287 printf("%s %s\n", domain_names[i] ? domain_names[i] :
288 "*unknown*", sid_str);
295 /* Enumerates privileges */
297 static NTSTATUS cmd_lsa_enum_privilege(struct cli_state *cli,
298 TALLOC_CTX *mem_ctx, int argc,
302 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
304 uint32 enum_context=0;
305 uint32 pref_max_length=0x1000;
313 printf("Usage: %s [enum context] [max length]\n", argv[0]);
318 enum_context=atoi(argv[1]);
321 pref_max_length=atoi(argv[2]);
323 result = cli_lsa_open_policy(cli, mem_ctx, True,
324 SEC_RIGHTS_MAXIMUM_ALLOWED,
327 if (!NT_STATUS_IS_OK(result))
330 result = cli_lsa_enum_privilege(cli, mem_ctx, &pol, &enum_context, pref_max_length,
331 &count, &privs_name, &privs_high, &privs_low);
333 if (!NT_STATUS_IS_OK(result))
337 printf("found %d privileges\n\n", count);
339 for (i = 0; i < count; i++) {
340 printf("%s \t\t%d:%d (0x%x:0x%x)\n", privs_name[i] ? privs_name[i] : "*unknown*",
341 privs_high[i], privs_low[i], privs_high[i], privs_low[i]);
348 /* Get privilege name */
350 static NTSTATUS cmd_lsa_get_dispname(struct cli_state *cli,
351 TALLOC_CTX *mem_ctx, int argc,
355 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
358 uint16 lang_id_sys=0;
363 printf("Usage: %s privilege name\n", argv[0]);
367 result = cli_lsa_open_policy(cli, mem_ctx, True,
368 SEC_RIGHTS_MAXIMUM_ALLOWED,
371 if (!NT_STATUS_IS_OK(result))
374 result = cli_lsa_get_dispname(cli, mem_ctx, &pol, argv[1], lang_id, lang_id_sys, description, &lang_id_desc);
376 if (!NT_STATUS_IS_OK(result))
380 printf("%s -> %s (language: 0x%x)\n", argv[1], description, lang_id_desc);
386 /* Enumerate the LSA SIDS */
388 static NTSTATUS cmd_lsa_enum_sids(struct cli_state *cli,
389 TALLOC_CTX *mem_ctx, int argc,
393 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
395 uint32 enum_context=0;
396 uint32 pref_max_length=0x1000;
402 printf("Usage: %s [enum context] [max length]\n", argv[0]);
407 enum_context=atoi(argv[1]);
410 pref_max_length=atoi(argv[2]);
412 result = cli_lsa_open_policy(cli, mem_ctx, True,
413 SEC_RIGHTS_MAXIMUM_ALLOWED,
416 if (!NT_STATUS_IS_OK(result))
419 result = cli_lsa_enum_sids(cli, mem_ctx, &pol, &enum_context, pref_max_length,
422 if (!NT_STATUS_IS_OK(result))
426 printf("found %d SIDs\n\n", count);
428 for (i = 0; i < count; i++) {
431 sid_to_string(sid_str, &sids[i]);
432 printf("%s\n", sid_str);
439 /* Enumerate the privileges of an SID */
441 static NTSTATUS cmd_lsa_enum_privsaccounts(struct cli_state *cli,
442 TALLOC_CTX *mem_ctx, int argc,
447 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
448 uint32 access_desired = 0x000f000f;
456 printf("Usage: %s SID\n", argv[0]);
460 string_to_sid(&sid, argv[1]);
462 result = cli_lsa_open_policy2(cli, mem_ctx, True,
463 SEC_RIGHTS_MAXIMUM_ALLOWED,
466 if (!NT_STATUS_IS_OK(result))
469 result = cli_lsa_open_account(cli, mem_ctx, &dom_pol, &sid, access_desired, &user_pol);
471 if (!NT_STATUS_IS_OK(result))
474 result = cli_lsa_enum_privsaccount(cli, mem_ctx, &user_pol, &count, &set);
476 if (!NT_STATUS_IS_OK(result))
480 printf("found %d privileges for SID %s\n\n", count, argv[1]);
481 printf("high\tlow\tattribute\n");
483 for (i = 0; i < count; i++) {
484 printf("%u\t%u\t%u\n", set[i].luid.high, set[i].luid.low, set[i].attr);
492 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
494 static NTSTATUS cmd_lsa_enum_acct_rights(struct cli_state *cli,
495 TALLOC_CTX *mem_ctx, int argc,
499 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
508 printf("Usage: %s SID\n", argv[0]);
512 string_to_sid(&sid, argv[1]);
514 result = cli_lsa_open_policy2(cli, mem_ctx, True,
515 SEC_RIGHTS_MAXIMUM_ALLOWED,
518 if (!NT_STATUS_IS_OK(result))
521 result = cli_lsa_enum_account_rights(cli, mem_ctx, &dom_pol, sid, &count, &rights);
523 if (!NT_STATUS_IS_OK(result))
526 printf("found %d privileges for SID %s\n", count, argv[1]);
528 for (i = 0; i < count; i++) {
529 printf("\t%s\n", rights[i]);
537 /* add some privileges to a SID via LsaAddAccountRights */
539 static NTSTATUS cmd_lsa_add_acct_rights(struct cli_state *cli,
540 TALLOC_CTX *mem_ctx, int argc,
544 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
549 printf("Usage: %s SID [rights...]\n", argv[0]);
553 result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
554 if (!NT_STATUS_IS_OK(result))
557 result = cli_lsa_open_policy2(cli, mem_ctx, True,
558 SEC_RIGHTS_MAXIMUM_ALLOWED,
561 if (!NT_STATUS_IS_OK(result))
564 result = cli_lsa_add_account_rights(cli, mem_ctx, &dom_pol, sid,
567 if (!NT_STATUS_IS_OK(result))
575 /* Get a privilege value given its name */
577 static NTSTATUS cmd_lsa_lookupprivvalue(struct cli_state *cli,
578 TALLOC_CTX *mem_ctx, int argc,
582 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
586 printf("Usage: %s name\n", argv[0]);
590 result = cli_lsa_open_policy2(cli, mem_ctx, True,
591 SEC_RIGHTS_MAXIMUM_ALLOWED,
594 if (!NT_STATUS_IS_OK(result))
597 result = cli_lsa_lookupprivvalue(cli, mem_ctx, &pol, argv[1], &luid);
599 if (!NT_STATUS_IS_OK(result))
604 printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
610 /* Query LSA security object */
612 static NTSTATUS cmd_lsa_query_secobj(struct cli_state *cli,
613 TALLOC_CTX *mem_ctx, int argc,
617 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
619 uint32 sec_info = 0x00000004; /* ??? */
622 printf("Usage: %s\n", argv[0]);
626 result = cli_lsa_open_policy2(cli, mem_ctx, True,
627 SEC_RIGHTS_MAXIMUM_ALLOWED,
630 if (!NT_STATUS_IS_OK(result))
633 result = cli_lsa_query_secobj(cli, mem_ctx, &pol, sec_info, &sdb);
635 if (!NT_STATUS_IS_OK(result))
640 display_sec_desc(sdb->sec);
647 /* List of commands exported by this module */
649 struct cmd_set lsarpc_commands[] = {
653 { "lsaquery", cmd_lsa_query_info_policy, PI_LSARPC, "Query info policy", "" },
654 { "lookupsids", cmd_lsa_lookup_sids, PI_LSARPC, "Convert SIDs to names", "" },
655 { "lookupnames", cmd_lsa_lookup_names, PI_LSARPC, "Convert names to SIDs", "" },
656 { "enumtrust", cmd_lsa_enum_trust_dom, PI_LSARPC, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
657 { "enumprivs", cmd_lsa_enum_privilege, PI_LSARPC, "Enumerate privileges", "" },
658 { "getdispname", cmd_lsa_get_dispname, PI_LSARPC, "Get the privilege name", "" },
659 { "lsaenumsid", cmd_lsa_enum_sids, PI_LSARPC, "Enumerate the LSA SIDS", "" },
660 { "lsaenumprivsaccount", cmd_lsa_enum_privsaccounts, PI_LSARPC, "Enumerate the privileges of an SID", "" },
661 { "lsaenumacctrights", cmd_lsa_enum_acct_rights, PI_LSARPC, "Enumerate the rights of an SID", "" },
662 { "lsaaddacctrights", cmd_lsa_add_acct_rights, PI_LSARPC, "Add rights to an account", "" },
663 { "lsalookupprivvalue", cmd_lsa_lookupprivvalue, PI_LSARPC, "Get a privilege value given its name", "" },
664 { "lsaquerysecobj", cmd_lsa_query_secobj, PI_LSARPC, "Query LSA security object", "" },