source4/libnet/libnet_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2004
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23 #include "libnet/libnet.h"
  24 #include "librpc/gen_ndr/ndr_samr.h"
  25 #include "lib/crypto/crypto.h"
  26
  27 /*
  28  * do a password change using DCERPC/SAMR calls
  29  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
  30  * 2. try samr_ChangePasswordUser3
  31  * 3. try samr_ChangePasswordUser2
  32  * 4. try samr_OemChangePasswordUser2
  33  * (not yet: 5. try samr_ChangePasswordUser)
  34  */
  35 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
  36 {
  37         NTSTATUS status;
  38         union libnet_rpc_connect c;
  39 #if 0
  40         struct policy_handle user_handle;
  41         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
  42         struct samr_ChangePasswordUser pw;
  43 #endif
  44         struct samr_OemChangePasswordUser2 oe2;
  45         struct samr_ChangePasswordUser2 pw2;
  46         struct samr_ChangePasswordUser3 pw3;
  47         struct samr_String server, account;
  48         struct samr_AsciiName a_server, a_account;
  49         struct samr_CryptPassword nt_pass, lm_pass;
  50         struct samr_Password nt_verifier, lm_verifier;
  51         uint8_t old_nt_hash[16], new_nt_hash[16];
  52         uint8_t old_lm_hash[16], new_lm_hash[16];
  53
  54         /* prepare connect to the SAMR pipe of the users domain PDC */
  55         c.pdc.level                     = LIBNET_RPC_CONNECT_PDC;
  56         c.pdc.in.domain_name            = r->samr.in.domain_name;
  57         c.pdc.in.dcerpc_iface_name      = DCERPC_SAMR_NAME;
  58         c.pdc.in.dcerpc_iface_uuid      = DCERPC_SAMR_UUID;
  59         c.pdc.in.dcerpc_iface_version   = DCERPC_SAMR_VERSION;
  60
  61         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
  62         status = libnet_rpc_connect(ctx, mem_ctx, &c);
  63         if (!NT_STATUS_IS_OK(status)) {
  64                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
  65                                                 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
  66                                                 r->samr.in.domain_name, nt_errstr(status));
  67                 return status;
  68         }
  69
  70         /* prepare password change for account */
  71         server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
  72         account.string = r->samr.in.account_name;
  73
  74         E_md4hash(r->samr.in.oldpassword, old_nt_hash);
  75         E_md4hash(r->samr.in.newpassword, new_nt_hash);
  76
  77         E_deshash(r->samr.in.oldpassword, old_lm_hash);
  78         E_deshash(r->samr.in.newpassword, new_lm_hash);
  79
  80         /* prepare samr_ChangePasswordUser3 */
  81         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
  82         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
  83         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
  84
  85         encode_pw_buffer(nt_pass.data,  r->samr.in.newpassword, STR_UNICODE);
  86         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
  87         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
  88
  89         pw3.in.server = &server;
  90         pw3.in.account = &account;
  91         pw3.in.nt_password = &nt_pass;
  92         pw3.in.nt_verifier = &nt_verifier;
  93         pw3.in.lm_change = 1;
  94         pw3.in.lm_password = &lm_pass;
  95         pw3.in.lm_verifier = &lm_verifier;
  96         pw3.in.password3 = NULL;
  97
  98         /* 2. try samr_ChangePasswordUser3 */
  99         status = dcerpc_samr_ChangePasswordUser3(c.pdc.out.dcerpc_pipe, mem_ctx, &pw3);
 100         if (!NT_STATUS_IS_OK(status)) {
 101                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 102                                                 "samr_ChangePasswordUser3 failed: %s\n",
 103                                                 nt_errstr(status));
 104                 goto ChangePasswordUser2;
 105         }
 106
 107         /* check result of samr_ChangePasswordUser3 */
 108         if (!NT_STATUS_IS_OK(pw3.out.result)) {
 109                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 110                                                 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
 111                                                 r->samr.in.domain_name, r->samr.in.account_name,
 112                                                 nt_errstr(pw3.out.result));
 113                                                 /* TODO: give the reason of the reject */
 114                 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 115                         status = pw3.out.result;
 116                         goto disconnect;
 117                 }
 118                 goto ChangePasswordUser2;
 119         }
 120
 121         goto disconnect;
 122
 123 ChangePasswordUser2:
 124         /* prepare samr_ChangePasswordUser2 */
 125         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
 126         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 127         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 128
 129         encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
 130         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
 131         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
 132
 133         pw2.in.server = &server;
 134         pw2.in.account = &account;
 135         pw2.in.nt_password = &nt_pass;
 136         pw2.in.nt_verifier = &nt_verifier;
 137         pw2.in.lm_change = 1;
 138         pw2.in.lm_password = &lm_pass;
 139         pw2.in.lm_verifier = &lm_verifier;
 140
 141         /* 3. try samr_ChangePasswordUser2 */
 142         status = dcerpc_samr_ChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &pw2);
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 145                                                 "samr_ChangePasswordUser2 failed: %s\n",
 146                                                 nt_errstr(status));
 147                 goto OemChangePasswordUser2;
 148         }
 149
 150         /* check result of samr_ChangePasswordUser2 */
 151         if (!NT_STATUS_IS_OK(pw2.out.result)) {
 152                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 153                                                 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
 154                                                 r->samr.in.domain_name, r->samr.in.account_name,
 155                                                 nt_errstr(pw2.out.result));
 156                 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 157                         status = pw2.out.result;
 158                         goto disconnect;
 159                 }
 160                 goto OemChangePasswordUser2;
 161         }
 162
 163         goto disconnect;
 164
 165 OemChangePasswordUser2:
 166         /* prepare samr_OemChangePasswordUser2 */
 167         a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.pdc.out.dcerpc_pipe));
 168         a_account.string = r->samr.in.account_name;
 169
 170         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
 171         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 172         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 173
 174         oe2.in.server = &a_server;
 175         oe2.in.account = &a_account;
 176         oe2.in.password = &lm_pass;
 177         oe2.in.hash = &lm_verifier;
 178
 179         /* 4. try samr_OemChangePasswordUser2 */
 180         status = dcerpc_samr_OemChangePasswordUser2(c.pdc.out.dcerpc_pipe, mem_ctx, &oe2);
 181         if (!NT_STATUS_IS_OK(status)) {
 182                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 183                                                 "samr_OemChangePasswordUser2 failed: %s\n",
 184                                                 nt_errstr(status));
 185                 goto ChangePasswordUser;
 186         }
 187
 188         /* check result of samr_OemChangePasswordUser2 */
 189         if (!NT_STATUS_IS_OK(oe2.out.result)) {
 190                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 191                                                 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
 192                                                 r->samr.in.domain_name, r->samr.in.account_name,
 193                                                 nt_errstr(oe2.out.result));
 194                 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 195                         status = oe2.out.result;
 196                         goto disconnect;
 197                 }
 198                 goto ChangePasswordUser;
 199         }
 200
 201         goto disconnect;
 202
 203 ChangePasswordUser:
 204 #if 0
 205         /* prepare samr_ChangePasswordUser */
 206         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
 207         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
 208         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
 209         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
 210         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
 211         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
 212
 213         /* TODO: ask for a user_handle */
 214         pw.in.handle = &user_handle;
 215         pw.in.lm_present = 1;
 216         pw.in.old_lm_crypted = &hash1;
 217         pw.in.new_lm_crypted = &hash2;
 218         pw.in.nt_present = 1;
 219         pw.in.old_nt_crypted = &hash3;
 220         pw.in.new_nt_crypted = &hash4;
 221         pw.in.cross1_present = 1;
 222         pw.in.nt_cross = &hash5;
 223         pw.in.cross2_present = 1;
 224         pw.in.lm_cross = &hash6;
 225
 226         /* 5. try samr_ChangePasswordUser */
 227         status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
 228         if (!NT_STATUS_IS_OK(status)) {
 229                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 230                                                 "samr_ChangePasswordUser failed: %s\n",
 231                                                 nt_errstr(status));
 232                 goto disconnect;
 233         }
 234
 235         /* check result of samr_ChangePasswordUser */
 236         if (!NT_STATUS_IS_OK(pw.out.result)) {
 237                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 238                                                 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
 239                                                 r->samr.in.domain_name, r->samr.in.account_name,
 240                                                 nt_errstr(pw.out.result));
 241                 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 242                         status = pw.out.result;
 243                         goto disconnect;
 244                 }
 245                 goto disconnect;
 246         }
 247 #endif
 248 disconnect:
 249         /* close connection */
 250         dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
 251
 252         return status;
 253 }
 254
 255 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 256 {
 257         NTSTATUS status;
 258         union libnet_ChangePassword r2;
 259
 260         r2.samr.level           = LIBNET_CHANGE_PASSWORD_SAMR;
 261         r2.samr.in.account_name = r->generic.in.account_name;
 262         r2.samr.in.domain_name  = r->generic.in.domain_name;
 263         r2.samr.in.oldpassword  = r->generic.in.oldpassword;
 264         r2.samr.in.newpassword  = r->generic.in.newpassword;
 265
 266         status = libnet_ChangePassword(ctx, mem_ctx, &r2);
 267
 268         r->generic.out.error_string = r2.samr.out.error_string;
 269
 270         return status;
 271 }
 272
 273 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 274 {
 275         switch (r->generic.level) {
 276                 case LIBNET_CHANGE_PASSWORD_GENERIC:
 277                         return libnet_ChangePassword_generic(ctx, mem_ctx, r);
 278                 case LIBNET_CHANGE_PASSWORD_SAMR:
 279                         return libnet_ChangePassword_samr(ctx, mem_ctx, r);
 280                 case LIBNET_CHANGE_PASSWORD_KRB5:
 281                         return NT_STATUS_NOT_IMPLEMENTED;
 282                 case LIBNET_CHANGE_PASSWORD_LDAP:
 283                         return NT_STATUS_NOT_IMPLEMENTED;
 284                 case LIBNET_CHANGE_PASSWORD_RAP:
 285                         return NT_STATUS_NOT_IMPLEMENTED;
 286         }
 287
 288         return NT_STATUS_INVALID_LEVEL;
 289 }
 290
 291 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 292 {
 293         NTSTATUS status;
 294         struct samr_SetUserInfo sui;
 295         union samr_UserInfo u_info;
 296         DATA_BLOB session_key;
 297         DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 298         uint8_t confounder[16];
 299         struct MD5Context md5;
 300
 301         /* prepare samr_SetUserInfo level 26 */
 302         ZERO_STRUCT(u_info);
 303         encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 304         u_info.info26.pw_len = strlen(r->samr_handle.in.newpassword);
 305
 306         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 309                                                                   "dcerpc_fetch_session_key failed: %s\n",
 310                                                                   nt_errstr(status));
 311                 return status;
 312         }
 313
 314         generate_random_buffer((uint8_t *)confounder, 16);
 315
 316         MD5Init(&md5);
 317         MD5Update(&md5, confounder, 16);
 318         MD5Update(&md5, session_key.data, session_key.length);
 319         MD5Final(confounded_session_key.data, &md5);
 320
 321         arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
 322         memcpy(&u_info.info26.password.data[516], confounder, 16);
 323
 324         sui.in.user_handle = r->samr_handle.in.user_handle;
 325         sui.in.info = &u_info;
 326         sui.in.level = 26;
 327
 328         /* 7. try samr_SetUserInfo level 26 to set the password */
 329         status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
 330         /* check result of samr_SetUserInfo level 26 */
 331         if (!NT_STATUS_IS_OK(status)) {
 332                 r->samr_handle.out.error_string
 333                         = talloc_asprintf(mem_ctx,
 334                                           "SetUserInfo level 26 for [%s] failed: %s\n",
 335                                           r->samr_handle.in.account_name, nt_errstr(status));
 336         }
 337         return status;
 338 }
 339
 340 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 341 {
 342         NTSTATUS status;
 343         struct samr_SetUserInfo sui;
 344         union samr_UserInfo u_info;
 345         DATA_BLOB session_key;
 346         DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 347         uint8_t confounder[16];
 348         struct MD5Context md5;
 349
 350         /* prepare samr_SetUserInfo level 25 */
 351         ZERO_STRUCT(u_info);
 352         u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
 353         encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 354
 355         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 358                                                 "dcerpc_fetch_session_key failed: %s\n",
 359                                                 nt_errstr(status));
 360                 return status;
 361         }
 362
 363         generate_random_buffer((uint8_t *)confounder, 16);
 364
 365         MD5Init(&md5);
 366         MD5Update(&md5, confounder, 16);
 367         MD5Update(&md5, session_key.data, session_key.length);
 368         MD5Final(confounded_session_key.data, &md5);
 369
 370         arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
 371         memcpy(&u_info.info25.password.data[516], confounder, 16);
 372
 373         sui.in.user_handle = r->samr_handle.in.user_handle;
 374         sui.in.info = &u_info;
 375         sui.in.level = 25;
 376
 377         /* 8. try samr_SetUserInfo level 25 to set the password */
 378         status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
 379         if (!NT_STATUS_IS_OK(status)) {
 380                 r->samr_handle.out.error_string
 381                         = talloc_asprintf(mem_ctx,
 382                                           "SetUserInfo level 25 for [%s] failed: %s\n",
 383                                           r->samr_handle.in.account_name, nt_errstr(status));
 384         }
 385         return status;
 386 }
 387
 388 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 389 {
 390         NTSTATUS status;
 391         struct samr_SetUserInfo sui;
 392         union samr_UserInfo u_info;
 393         DATA_BLOB session_key;
 394
 395         /* prepare samr_SetUserInfo level 24 */
 396         ZERO_STRUCT(u_info);
 397         encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 398         /* w2k3 ignores this length */
 399         u_info.info24.pw_len = strlen_m(r->samr_handle.in.newpassword)*2;
 400
 401         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 402         if (!NT_STATUS_IS_OK(status)) {
 403                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 404                                                 "dcerpc_fetch_session_key failed: %s\n",
 405                                                 nt_errstr(status));
 406                 return status;
 407         }
 408
 409         arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
 410
 411         sui.in.user_handle = r->samr_handle.in.user_handle;
 412         sui.in.info = &u_info;
 413         sui.in.level = 24;
 414
 415         /* 9. try samr_SetUserInfo level 24 to set the password */
 416         status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 r->samr_handle.out.error_string
 419                         = talloc_asprintf(mem_ctx,
 420                                           "SetUserInfo level 24 for [%s] failed: %s\n",
 421                                           r->samr_handle.in.account_name, nt_errstr(status));
 422         }
 423         return status;
 424 }
 425
 426 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 427 {
 428         NTSTATUS status;
 429         struct samr_SetUserInfo sui;
 430         union samr_UserInfo u_info;
 431         DATA_BLOB session_key;
 432
 433         /* prepare samr_SetUserInfo level 23 */
 434         ZERO_STRUCT(u_info);
 435         u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
 436         encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 437
 438         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 439         if (!NT_STATUS_IS_OK(status)) {
 440                 r->samr_handle.out.error_string
 441                         = talloc_asprintf(mem_ctx,
 442                                           "dcerpc_fetch_session_key failed: %s\n",
 443                                           nt_errstr(status));
 444                 return status;
 445         }
 446
 447         arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
 448
 449         sui.in.user_handle = r->samr_handle.in.user_handle;
 450         sui.in.info = &u_info;
 451         sui.in.level = 23;
 452
 453         /* 10. try samr_SetUserInfo level 23 to set the password */
 454         status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 r->samr_handle.out.error_string
 457                         = talloc_asprintf(mem_ctx,
 458                                           "SetUserInfo level 23 for [%s] failed: %s\n",
 459                                           r->samr_handle.in.account_name, nt_errstr(status));
 460         }
 461         return status;
 462 }
 463
 464 /*
 465  * 1. try samr_SetUserInfo level 26 to set the password
 466  * 2. try samr_SetUserInfo level 25 to set the password
 467  * 3. try samr_SetUserInfo level 24 to set the password
 468  * 4. try samr_SetUserInfo level 23 to set the password
 469 */
 470 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 471 {
 472         NTSTATUS status;
 473         enum libnet_SetPassword_level levels[] = {
 474                 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
 475                 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
 476                 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
 477                 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
 478         };
 479         int i;
 480
 481         for (i=0; i < ARRAY_SIZE(levels); i++) {
 482                 r->generic.level = levels[i];
 483                 status = libnet_SetPassword(ctx, mem_ctx, r);
 484                 if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
 485                         break;
 486                 }
 487         }
 488
 489         return status;
 490 }
 491 /*
 492  * set a password with DCERPC/SAMR calls
 493  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
 494  *    is it correct to contact the the pdc of the domain of the user who's password should be set?
 495  * 2. do a samr_Connect to get a policy handle
 496  * 3. do a samr_LookupDomain to get the domain sid
 497  * 4. do a samr_OpenDomain to get a domain handle
 498  * 5. do a samr_LookupNames to get the users rid
 499  * 6. do a samr_OpenUser to get a user handle
 500  * 7  call libnet_SetPassword_samr_handle to set the password
 501  */
 502 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 503 {
 504         NTSTATUS status;
 505         union libnet_rpc_connect c;
 506         struct samr_Connect sc;
 507         struct policy_handle p_handle;
 508         struct samr_LookupDomain ld;
 509         struct samr_String d_name;
 510         struct samr_OpenDomain od;
 511         struct policy_handle d_handle;
 512         struct samr_LookupNames ln;
 513         struct samr_OpenUser ou;
 514         struct policy_handle u_handle;
 515         union libnet_SetPassword r2;
 516
 517         /* prepare connect to the SAMR pipe of users domain PDC */
 518         c.pdc.level                     = LIBNET_RPC_CONNECT_PDC;
 519         c.pdc.in.domain_name            = r->samr.in.domain_name;
 520         c.pdc.in.dcerpc_iface_name      = DCERPC_SAMR_NAME;
 521         c.pdc.in.dcerpc_iface_uuid      = DCERPC_SAMR_UUID;
 522         c.pdc.in.dcerpc_iface_version   = DCERPC_SAMR_VERSION;
 523
 524         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
 525         status = libnet_rpc_connect(ctx, mem_ctx, &c);
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 528                                                            "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
 529                                                            r->samr.in.domain_name, nt_errstr(status));
 530                 return status;
 531         }
 532
 533         /* prepare samr_Connect */
 534         ZERO_STRUCT(p_handle);
 535         sc.in.system_name = NULL;
 536         sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 537         sc.out.connect_handle = &p_handle;
 538
 539         /* 2. do a samr_Connect to get a policy handle */
 540         status = dcerpc_samr_Connect(c.pdc.out.dcerpc_pipe, mem_ctx, &sc);
 541         if (!NT_STATUS_IS_OK(status)) {
 542                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 543                                                 "samr_Connect failed: %s\n",
 544                                                 nt_errstr(status));
 545                 goto disconnect;
 546         }
 547
 548         /* prepare samr_LookupDomain */
 549         d_name.string = r->samr.in.domain_name;
 550         ld.in.connect_handle = &p_handle;
 551         ld.in.domain_name = &d_name;
 552
 553         /* 3. do a samr_LookupDomain to get the domain sid */
 554         status = dcerpc_samr_LookupDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &ld);
 555         if (!NT_STATUS_IS_OK(status)) {
 556                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 557                                                 "samr_LookupDomain for [%s] failed: %s\n",
 558                                                 r->samr.in.domain_name, nt_errstr(status));
 559                 goto disconnect;
 560         }
 561
 562         /* prepare samr_OpenDomain */
 563         ZERO_STRUCT(d_handle);
 564         od.in.connect_handle = &p_handle;
 565         od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 566         od.in.sid = ld.out.sid;
 567         od.out.domain_handle = &d_handle;
 568
 569         /* 4. do a samr_OpenDomain to get a domain handle */
 570         status = dcerpc_samr_OpenDomain(c.pdc.out.dcerpc_pipe, mem_ctx, &od);
 571         if (!NT_STATUS_IS_OK(status)) {
 572                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 573                                                 "samr_OpenDomain for [%s] failed: %s\n",
 574                                                 r->samr.in.domain_name, nt_errstr(status));
 575                 goto disconnect;
 576         }
 577
 578         /* prepare samr_LookupNames */
 579         ln.in.domain_handle = &d_handle;
 580         ln.in.num_names = 1;
 581         ln.in.names = talloc_array(mem_ctx, struct samr_String, 1);
 582         if (!ln.in.names) {
 583                 r->samr.out.error_string = "Out of Memory";
 584                 return NT_STATUS_NO_MEMORY;
 585         }
 586         ln.in.names[0].string = r->samr.in.account_name;
 587
 588         /* 5. do a samr_LookupNames to get the users rid */
 589         status = dcerpc_samr_LookupNames(c.pdc.out.dcerpc_pipe, mem_ctx, &ln);
 590         if (!NT_STATUS_IS_OK(status)) {
 591                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 592                                                 "samr_LookupNames for [%s] failed: %s\n",
 593                                                 r->samr.in.account_name, nt_errstr(status));
 594                 goto disconnect;
 595         }
 596
 597         /* check if we got one RID for the user */
 598         if (ln.out.rids.count != 1) {
 599                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 600                                                 "samr_LookupNames for [%s] returns %d RIDs\n",
 601                                                 r->samr.in.account_name, ln.out.rids.count);
 602                 status = NT_STATUS_INVALID_PARAMETER;
 603                 goto disconnect;
 604         }
 605
 606         /* prepare samr_OpenUser */
 607         ZERO_STRUCT(u_handle);
 608         ou.in.domain_handle = &d_handle;
 609         ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 610         ou.in.rid = ln.out.rids.ids[0];
 611         ou.out.user_handle = &u_handle;
 612
 613         /* 6. do a samr_OpenUser to get a user handle */
 614         status = dcerpc_samr_OpenUser(c.pdc.out.dcerpc_pipe, mem_ctx, &ou);
 615         if (!NT_STATUS_IS_OK(status)) {
 616                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 617                                                 "samr_OpenUser for [%s] failed: %s\n",
 618                                                 r->samr.in.account_name, nt_errstr(status));
 619                 goto disconnect;
 620         }
 621
 622         r2.samr_handle.level            = LIBNET_SET_PASSWORD_SAMR_HANDLE;
 623         r2.samr_handle.in.account_name  = r->samr.in.account_name;
 624         r2.samr_handle.in.newpassword   = r->samr.in.newpassword;
 625         r2.samr_handle.in.user_handle   = &u_handle;
 626         r2.samr_handle.in.dcerpc_pipe   = c.pdc.out.dcerpc_pipe;
 627
 628         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 629
 630         r->generic.out.error_string = r2.samr_handle.out.error_string;
 631
 632 disconnect:
 633         /* close connection */
 634         dcerpc_pipe_close(c.pdc.out.dcerpc_pipe);
 635
 636         return status;
 637 }
 638
 639 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 640 {
 641         NTSTATUS status;
 642         union libnet_SetPassword r2;
 643
 644         r2.samr.level           = LIBNET_SET_PASSWORD_SAMR;
 645         r2.samr.in.account_name = r->generic.in.account_name;
 646         r2.samr.in.domain_name  = r->generic.in.domain_name;
 647         r2.samr.in.newpassword  = r->generic.in.newpassword;
 648
 649         r->generic.out.error_string = "Unknown Error";
 650         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 651
 652         r->generic.out.error_string = r2.samr.out.error_string;
 653
 654         return status;
 655 }
 656
 657 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 658 {
 659         switch (r->generic.level) {
 660                 case LIBNET_SET_PASSWORD_GENERIC:
 661                         return libnet_SetPassword_generic(ctx, mem_ctx, r);
 662                 case LIBNET_SET_PASSWORD_SAMR:
 663                         return libnet_SetPassword_samr(ctx, mem_ctx, r);
 664                 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
 665                         return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
 666                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
 667                         return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
 668                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
 669                         return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
 670                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
 671                         return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
 672                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
 673                         return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
 674                 case LIBNET_SET_PASSWORD_KRB5:
 675                         return NT_STATUS_NOT_IMPLEMENTED;
 676                 case LIBNET_SET_PASSWORD_LDAP:
 677                         return NT_STATUS_NOT_IMPLEMENTED;
 678                 case LIBNET_SET_PASSWORD_RAP:
 679                         return NT_STATUS_NOT_IMPLEMENTED;
 680         }
 681
 682         return NT_STATUS_INVALID_LEVEL;
 683 }