2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libnet/libnet.h"
25 #include "lib/crypto/crypto.h"
26 #include "libcli/auth/libcli_auth.h"
27 #include "librpc/gen_ndr/ndr_samr.h"
28 #include "librpc/gen_ndr/ndr_samr_c.h"
31 * do a password change using DCERPC/SAMR calls
32 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
33 * 2. try samr_ChangePasswordUser3
34 * 3. try samr_ChangePasswordUser2
35 * 4. try samr_OemChangePasswordUser2
36 * (not yet: 5. try samr_ChangePasswordUser)
38 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
41 struct libnet_RpcConnect c;
43 struct policy_handle user_handle;
44 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
45 struct samr_ChangePasswordUser pw;
47 struct samr_OemChangePasswordUser2 oe2;
48 struct samr_ChangePasswordUser2 pw2;
49 struct samr_ChangePasswordUser3 pw3;
50 struct lsa_String server, account;
51 struct lsa_AsciiString a_server, a_account;
52 struct samr_CryptPassword nt_pass, lm_pass;
53 struct samr_Password nt_verifier, lm_verifier;
54 uint8_t old_nt_hash[16], new_nt_hash[16];
55 uint8_t old_lm_hash[16], new_lm_hash[16];
57 /* prepare connect to the SAMR pipe of the users domain PDC */
58 c.level = LIBNET_RPC_CONNECT_PDC;
59 c.in.name = r->samr.in.domain_name;
60 c.in.dcerpc_iface = &dcerpc_table_samr;
62 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
63 status = libnet_RpcConnect(ctx, mem_ctx, &c);
64 if (!NT_STATUS_IS_OK(status)) {
65 r->samr.out.error_string = talloc_asprintf(mem_ctx,
66 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
67 r->samr.in.domain_name, nt_errstr(status));
71 /* prepare password change for account */
72 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
73 account.string = r->samr.in.account_name;
75 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
76 E_md4hash(r->samr.in.newpassword, new_nt_hash);
78 E_deshash(r->samr.in.oldpassword, old_lm_hash);
79 E_deshash(r->samr.in.newpassword, new_lm_hash);
81 /* prepare samr_ChangePasswordUser3 */
82 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
83 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
84 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
86 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
87 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
88 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
90 pw3.in.server = &server;
91 pw3.in.account = &account;
92 pw3.in.nt_password = &nt_pass;
93 pw3.in.nt_verifier = &nt_verifier;
95 pw3.in.lm_password = &lm_pass;
96 pw3.in.lm_verifier = &lm_verifier;
97 pw3.in.password3 = NULL;
99 /* 2. try samr_ChangePasswordUser3 */
100 status = dcerpc_samr_ChangePasswordUser3(c.out.dcerpc_pipe, mem_ctx, &pw3);
101 if (!NT_STATUS_IS_OK(status)) {
102 r->samr.out.error_string = talloc_asprintf(mem_ctx,
103 "samr_ChangePasswordUser3 failed: %s\n",
105 goto ChangePasswordUser2;
108 /* check result of samr_ChangePasswordUser3 */
109 if (!NT_STATUS_IS_OK(pw3.out.result)) {
110 r->samr.out.error_string = talloc_asprintf(mem_ctx,
111 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
112 r->samr.in.domain_name, r->samr.in.account_name,
113 nt_errstr(pw3.out.result));
114 /* TODO: give the reason of the reject */
115 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
116 status = pw3.out.result;
119 goto ChangePasswordUser2;
125 /* prepare samr_ChangePasswordUser2 */
126 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
127 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
128 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
130 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
131 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
132 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
134 pw2.in.server = &server;
135 pw2.in.account = &account;
136 pw2.in.nt_password = &nt_pass;
137 pw2.in.nt_verifier = &nt_verifier;
138 pw2.in.lm_change = 1;
139 pw2.in.lm_password = &lm_pass;
140 pw2.in.lm_verifier = &lm_verifier;
142 /* 3. try samr_ChangePasswordUser2 */
143 status = dcerpc_samr_ChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &pw2);
144 if (!NT_STATUS_IS_OK(status)) {
145 r->samr.out.error_string = talloc_asprintf(mem_ctx,
146 "samr_ChangePasswordUser2 failed: %s\n",
148 goto OemChangePasswordUser2;
151 /* check result of samr_ChangePasswordUser2 */
152 if (!NT_STATUS_IS_OK(pw2.out.result)) {
153 r->samr.out.error_string = talloc_asprintf(mem_ctx,
154 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
155 r->samr.in.domain_name, r->samr.in.account_name,
156 nt_errstr(pw2.out.result));
157 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
158 status = pw2.out.result;
161 goto OemChangePasswordUser2;
166 OemChangePasswordUser2:
167 /* prepare samr_OemChangePasswordUser2 */
168 a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
169 a_account.string = r->samr.in.account_name;
171 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
172 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
173 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
175 oe2.in.server = &a_server;
176 oe2.in.account = &a_account;
177 oe2.in.password = &lm_pass;
178 oe2.in.hash = &lm_verifier;
180 /* 4. try samr_OemChangePasswordUser2 */
181 status = dcerpc_samr_OemChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &oe2);
182 if (!NT_STATUS_IS_OK(status)) {
183 r->samr.out.error_string = talloc_asprintf(mem_ctx,
184 "samr_OemChangePasswordUser2 failed: %s\n",
186 goto ChangePasswordUser;
189 /* check result of samr_OemChangePasswordUser2 */
190 if (!NT_STATUS_IS_OK(oe2.out.result)) {
191 r->samr.out.error_string = talloc_asprintf(mem_ctx,
192 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
193 r->samr.in.domain_name, r->samr.in.account_name,
194 nt_errstr(oe2.out.result));
195 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
196 status = oe2.out.result;
199 goto ChangePasswordUser;
206 /* prepare samr_ChangePasswordUser */
207 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
208 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
209 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
210 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
211 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
212 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
214 /* TODO: ask for a user_handle */
215 pw.in.handle = &user_handle;
216 pw.in.lm_present = 1;
217 pw.in.old_lm_crypted = &hash1;
218 pw.in.new_lm_crypted = &hash2;
219 pw.in.nt_present = 1;
220 pw.in.old_nt_crypted = &hash3;
221 pw.in.new_nt_crypted = &hash4;
222 pw.in.cross1_present = 1;
223 pw.in.nt_cross = &hash5;
224 pw.in.cross2_present = 1;
225 pw.in.lm_cross = &hash6;
227 /* 5. try samr_ChangePasswordUser */
228 status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
229 if (!NT_STATUS_IS_OK(status)) {
230 r->samr.out.error_string = talloc_asprintf(mem_ctx,
231 "samr_ChangePasswordUser failed: %s\n",
236 /* check result of samr_ChangePasswordUser */
237 if (!NT_STATUS_IS_OK(pw.out.result)) {
238 r->samr.out.error_string = talloc_asprintf(mem_ctx,
239 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
240 r->samr.in.domain_name, r->samr.in.account_name,
241 nt_errstr(pw.out.result));
242 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
243 status = pw.out.result;
250 /* close connection */
251 talloc_free(c.out.dcerpc_pipe);
256 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
259 union libnet_ChangePassword r2;
261 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
262 r2.samr.in.account_name = r->generic.in.account_name;
263 r2.samr.in.domain_name = r->generic.in.domain_name;
264 r2.samr.in.oldpassword = r->generic.in.oldpassword;
265 r2.samr.in.newpassword = r->generic.in.newpassword;
267 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
269 r->generic.out.error_string = r2.samr.out.error_string;
274 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
276 switch (r->generic.level) {
277 case LIBNET_CHANGE_PASSWORD_GENERIC:
278 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
279 case LIBNET_CHANGE_PASSWORD_SAMR:
280 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
281 case LIBNET_CHANGE_PASSWORD_KRB5:
282 return NT_STATUS_NOT_IMPLEMENTED;
283 case LIBNET_CHANGE_PASSWORD_LDAP:
284 return NT_STATUS_NOT_IMPLEMENTED;
285 case LIBNET_CHANGE_PASSWORD_RAP:
286 return NT_STATUS_NOT_IMPLEMENTED;
289 return NT_STATUS_INVALID_LEVEL;
292 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
295 struct samr_SetUserInfo sui;
296 union samr_UserInfo u_info;
297 DATA_BLOB session_key;
298 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
299 uint8_t confounder[16];
300 struct MD5Context md5;
302 /* prepare samr_SetUserInfo level 26 */
304 encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
305 u_info.info26.pw_len = strlen(r->samr_handle.in.newpassword);
307 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
308 if (!NT_STATUS_IS_OK(status)) {
309 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
310 "dcerpc_fetch_session_key failed: %s\n",
315 generate_random_buffer((uint8_t *)confounder, 16);
318 MD5Update(&md5, confounder, 16);
319 MD5Update(&md5, session_key.data, session_key.length);
320 MD5Final(confounded_session_key.data, &md5);
322 arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
323 memcpy(&u_info.info26.password.data[516], confounder, 16);
325 sui.in.user_handle = r->samr_handle.in.user_handle;
326 sui.in.info = &u_info;
329 /* 7. try samr_SetUserInfo level 26 to set the password */
330 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
331 /* check result of samr_SetUserInfo level 26 */
332 if (!NT_STATUS_IS_OK(status)) {
333 r->samr_handle.out.error_string
334 = talloc_asprintf(mem_ctx,
335 "SetUserInfo level 26 for [%s] failed: %s\n",
336 r->samr_handle.in.account_name, nt_errstr(status));
341 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
344 struct samr_SetUserInfo sui;
345 union samr_UserInfo u_info;
346 DATA_BLOB session_key;
347 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
348 uint8_t confounder[16];
349 struct MD5Context md5;
351 /* prepare samr_SetUserInfo level 25 */
353 u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
354 encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
356 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
357 if (!NT_STATUS_IS_OK(status)) {
358 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
359 "dcerpc_fetch_session_key failed: %s\n",
364 generate_random_buffer((uint8_t *)confounder, 16);
367 MD5Update(&md5, confounder, 16);
368 MD5Update(&md5, session_key.data, session_key.length);
369 MD5Final(confounded_session_key.data, &md5);
371 arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
372 memcpy(&u_info.info25.password.data[516], confounder, 16);
374 sui.in.user_handle = r->samr_handle.in.user_handle;
375 sui.in.info = &u_info;
378 /* 8. try samr_SetUserInfo level 25 to set the password */
379 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
380 if (!NT_STATUS_IS_OK(status)) {
381 r->samr_handle.out.error_string
382 = talloc_asprintf(mem_ctx,
383 "SetUserInfo level 25 for [%s] failed: %s\n",
384 r->samr_handle.in.account_name, nt_errstr(status));
389 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
392 struct samr_SetUserInfo sui;
393 union samr_UserInfo u_info;
394 DATA_BLOB session_key;
396 /* prepare samr_SetUserInfo level 24 */
398 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
399 /* w2k3 ignores this length */
400 u_info.info24.pw_len = strlen_m(r->samr_handle.in.newpassword)*2;
402 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
403 if (!NT_STATUS_IS_OK(status)) {
404 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
405 "dcerpc_fetch_session_key failed: %s\n",
410 arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
412 sui.in.user_handle = r->samr_handle.in.user_handle;
413 sui.in.info = &u_info;
416 /* 9. try samr_SetUserInfo level 24 to set the password */
417 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
418 if (!NT_STATUS_IS_OK(status)) {
419 r->samr_handle.out.error_string
420 = talloc_asprintf(mem_ctx,
421 "SetUserInfo level 24 for [%s] failed: %s\n",
422 r->samr_handle.in.account_name, nt_errstr(status));
427 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
430 struct samr_SetUserInfo sui;
431 union samr_UserInfo u_info;
432 DATA_BLOB session_key;
434 /* prepare samr_SetUserInfo level 23 */
436 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
437 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
439 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
440 if (!NT_STATUS_IS_OK(status)) {
441 r->samr_handle.out.error_string
442 = talloc_asprintf(mem_ctx,
443 "dcerpc_fetch_session_key failed: %s\n",
448 arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
450 sui.in.user_handle = r->samr_handle.in.user_handle;
451 sui.in.info = &u_info;
454 /* 10. try samr_SetUserInfo level 23 to set the password */
455 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
456 if (!NT_STATUS_IS_OK(status)) {
457 r->samr_handle.out.error_string
458 = talloc_asprintf(mem_ctx,
459 "SetUserInfo level 23 for [%s] failed: %s\n",
460 r->samr_handle.in.account_name, nt_errstr(status));
466 * 1. try samr_SetUserInfo level 26 to set the password
467 * 2. try samr_SetUserInfo level 25 to set the password
468 * 3. try samr_SetUserInfo level 24 to set the password
469 * 4. try samr_SetUserInfo level 23 to set the password
471 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
474 enum libnet_SetPassword_level levels[] = {
475 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
476 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
477 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
478 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
482 for (i=0; i < ARRAY_SIZE(levels); i++) {
483 r->generic.level = levels[i];
484 status = libnet_SetPassword(ctx, mem_ctx, r);
485 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
486 || NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
487 /* Try another password set mechanism */
496 * set a password with DCERPC/SAMR calls
497 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
498 * is it correct to contact the the pdc of the domain of the user who's password should be set?
499 * 2. do a samr_Connect to get a policy handle
500 * 3. do a samr_LookupDomain to get the domain sid
501 * 4. do a samr_OpenDomain to get a domain handle
502 * 5. do a samr_LookupNames to get the users rid
503 * 6. do a samr_OpenUser to get a user handle
504 * 7 call libnet_SetPassword_samr_handle to set the password
506 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
509 struct libnet_RpcConnect c;
510 struct samr_Connect sc;
511 struct policy_handle p_handle;
512 struct samr_LookupDomain ld;
513 struct lsa_String d_name;
514 struct samr_OpenDomain od;
515 struct policy_handle d_handle;
516 struct samr_LookupNames ln;
517 struct samr_OpenUser ou;
518 struct policy_handle u_handle;
519 union libnet_SetPassword r2;
521 /* prepare connect to the SAMR pipe of users domain PDC */
522 c.level = LIBNET_RPC_CONNECT_PDC;
523 c.in.name = r->samr.in.domain_name;
524 c.in.dcerpc_iface = &dcerpc_table_samr;
526 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
527 status = libnet_RpcConnect(ctx, mem_ctx, &c);
528 if (!NT_STATUS_IS_OK(status)) {
529 r->samr.out.error_string = talloc_asprintf(mem_ctx,
530 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
531 r->samr.in.domain_name, nt_errstr(status));
535 /* prepare samr_Connect */
536 ZERO_STRUCT(p_handle);
537 sc.in.system_name = NULL;
538 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
539 sc.out.connect_handle = &p_handle;
541 /* 2. do a samr_Connect to get a policy handle */
542 status = dcerpc_samr_Connect(c.out.dcerpc_pipe, mem_ctx, &sc);
543 if (!NT_STATUS_IS_OK(status)) {
544 r->samr.out.error_string = talloc_asprintf(mem_ctx,
545 "samr_Connect failed: %s\n",
550 /* prepare samr_LookupDomain */
551 d_name.string = r->samr.in.domain_name;
552 ld.in.connect_handle = &p_handle;
553 ld.in.domain_name = &d_name;
555 /* 3. do a samr_LookupDomain to get the domain sid */
556 status = dcerpc_samr_LookupDomain(c.out.dcerpc_pipe, mem_ctx, &ld);
557 if (!NT_STATUS_IS_OK(status)) {
558 r->samr.out.error_string = talloc_asprintf(mem_ctx,
559 "samr_LookupDomain for [%s] failed: %s\n",
560 r->samr.in.domain_name, nt_errstr(status));
564 /* prepare samr_OpenDomain */
565 ZERO_STRUCT(d_handle);
566 od.in.connect_handle = &p_handle;
567 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
568 od.in.sid = ld.out.sid;
569 od.out.domain_handle = &d_handle;
571 /* 4. do a samr_OpenDomain to get a domain handle */
572 status = dcerpc_samr_OpenDomain(c.out.dcerpc_pipe, mem_ctx, &od);
573 if (!NT_STATUS_IS_OK(status)) {
574 r->samr.out.error_string = talloc_asprintf(mem_ctx,
575 "samr_OpenDomain for [%s] failed: %s\n",
576 r->samr.in.domain_name, nt_errstr(status));
580 /* prepare samr_LookupNames */
581 ln.in.domain_handle = &d_handle;
583 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
585 r->samr.out.error_string = "Out of Memory";
586 return NT_STATUS_NO_MEMORY;
588 ln.in.names[0].string = r->samr.in.account_name;
590 /* 5. do a samr_LookupNames to get the users rid */
591 status = dcerpc_samr_LookupNames(c.out.dcerpc_pipe, mem_ctx, &ln);
592 if (!NT_STATUS_IS_OK(status)) {
593 r->samr.out.error_string = talloc_asprintf(mem_ctx,
594 "samr_LookupNames for [%s] failed: %s\n",
595 r->samr.in.account_name, nt_errstr(status));
599 /* check if we got one RID for the user */
600 if (ln.out.rids.count != 1) {
601 r->samr.out.error_string = talloc_asprintf(mem_ctx,
602 "samr_LookupNames for [%s] returns %d RIDs\n",
603 r->samr.in.account_name, ln.out.rids.count);
604 status = NT_STATUS_INVALID_PARAMETER;
608 /* prepare samr_OpenUser */
609 ZERO_STRUCT(u_handle);
610 ou.in.domain_handle = &d_handle;
611 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
612 ou.in.rid = ln.out.rids.ids[0];
613 ou.out.user_handle = &u_handle;
615 /* 6. do a samr_OpenUser to get a user handle */
616 status = dcerpc_samr_OpenUser(c.out.dcerpc_pipe, mem_ctx, &ou);
617 if (!NT_STATUS_IS_OK(status)) {
618 r->samr.out.error_string = talloc_asprintf(mem_ctx,
619 "samr_OpenUser for [%s] failed: %s\n",
620 r->samr.in.account_name, nt_errstr(status));
624 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
625 r2.samr_handle.in.account_name = r->samr.in.account_name;
626 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
627 r2.samr_handle.in.user_handle = &u_handle;
628 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
630 status = libnet_SetPassword(ctx, mem_ctx, &r2);
632 r->generic.out.error_string = r2.samr_handle.out.error_string;
635 /* close connection */
636 talloc_free(c.out.dcerpc_pipe);
641 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
644 union libnet_SetPassword r2;
646 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
647 r2.samr.in.account_name = r->generic.in.account_name;
648 r2.samr.in.domain_name = r->generic.in.domain_name;
649 r2.samr.in.newpassword = r->generic.in.newpassword;
651 r->generic.out.error_string = "Unknown Error";
652 status = libnet_SetPassword(ctx, mem_ctx, &r2);
654 r->generic.out.error_string = r2.samr.out.error_string;
659 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
661 switch (r->generic.level) {
662 case LIBNET_SET_PASSWORD_GENERIC:
663 return libnet_SetPassword_generic(ctx, mem_ctx, r);
664 case LIBNET_SET_PASSWORD_SAMR:
665 return libnet_SetPassword_samr(ctx, mem_ctx, r);
666 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
667 return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
668 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
669 return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
670 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
671 return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
672 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
673 return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
674 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
675 return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
676 case LIBNET_SET_PASSWORD_KRB5:
677 return NT_STATUS_NOT_IMPLEMENTED;
678 case LIBNET_SET_PASSWORD_LDAP:
679 return NT_STATUS_NOT_IMPLEMENTED;
680 case LIBNET_SET_PASSWORD_RAP:
681 return NT_STATUS_NOT_IMPLEMENTED;
684 return NT_STATUS_INVALID_LEVEL;