2 Unix SMB/CIFS implementation.
5 Copyright (C) Tim Potter 2000
6 Copyright (C) Rafal Szczesniak 2002
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "rpcclient.h"
26 /* Look up domain related information on a remote host */
28 static NTSTATUS cmd_lsa_query_info_policy(struct cli_state *cli,
29 TALLOC_CTX *mem_ctx, int argc,
33 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
36 fstring sid_str, domain_name="", dns_name="", forest_name="";
37 uint32 info_class = 3;
40 printf("Usage: %s [info_class]\n", argv[0]);
45 info_class = atoi(argv[1]);
47 /* Lookup info policy */
50 result = cli_lsa_open_policy2(cli, mem_ctx, True,
51 SEC_RIGHTS_MAXIMUM_ALLOWED,
54 if (!NT_STATUS_IS_OK(result))
56 result = cli_lsa_query_info_policy2(cli, mem_ctx, &pol,
57 info_class, domain_name,
58 dns_name, forest_name,
62 result = cli_lsa_open_policy(cli, mem_ctx, True,
63 SEC_RIGHTS_MAXIMUM_ALLOWED,
66 if (!NT_STATUS_IS_OK(result))
68 result = cli_lsa_query_info_policy(cli, mem_ctx, &pol,
69 info_class, domain_name,
73 if (!NT_STATUS_IS_OK(result))
76 sid_to_string(sid_str, &dom_sid);
79 printf("domain %s has sid %s\n", domain_name, sid_str);
81 printf("could not query info for level %d\n", info_class);
84 printf("domain dns name is %s\n", dns_name);
86 printf("forest name is %s\n", forest_name);
88 if (info_class == 12) {
89 printf("domain GUID is ");
90 print_guid(&dom_guid);
96 /* Resolve a list of names to a list of sids */
98 static NTSTATUS cmd_lsa_lookup_names(struct cli_state *cli,
99 TALLOC_CTX *mem_ctx, int argc,
103 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
109 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
113 result = cli_lsa_open_policy(cli, mem_ctx, True,
114 SEC_RIGHTS_MAXIMUM_ALLOWED,
117 if (!NT_STATUS_IS_OK(result))
120 result = cli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
121 (const char**)(argv + 1), &sids, &types);
123 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
124 NT_STATUS_V(STATUS_SOME_UNMAPPED))
127 result = NT_STATUS_OK;
131 for (i = 0; i < (argc - 1); i++) {
133 sid_to_string(sid_str, &sids[i]);
134 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
135 sid_type_lookup(types[i]), types[i]);
142 /* Resolve a list of SIDs to a list of names */
144 static NTSTATUS cmd_lsa_lookup_sids(struct cli_state *cli, TALLOC_CTX *mem_ctx,
145 int argc, char **argv)
148 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
156 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
160 result = cli_lsa_open_policy(cli, mem_ctx, True,
161 SEC_RIGHTS_MAXIMUM_ALLOWED,
164 if (!NT_STATUS_IS_OK(result))
167 /* Convert arguments to sids */
169 sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * (argc - 1));
172 printf("could not allocate memory for %d sids\n", argc - 1);
176 for (i = 0; i < argc - 1; i++)
177 string_to_sid(&sids[i], argv[i + 1]);
179 /* Lookup the SIDs */
181 result = cli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
182 &domains, &names, &types);
184 if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
185 NT_STATUS_V(STATUS_SOME_UNMAPPED))
188 result = NT_STATUS_OK;
192 for (i = 0; i < (argc - 1); i++) {
195 sid_to_string(sid_str, &sids[i]);
196 printf("%s %s\\%s (%d)\n", sid_str,
197 domains[i] ? domains[i] : "*unknown*",
198 names[i] ? names[i] : "*unknown*", types[i]);
205 /* Enumerate list of trusted domains */
207 static NTSTATUS cmd_lsa_enum_trust_dom(struct cli_state *cli,
208 TALLOC_CTX *mem_ctx, int argc,
212 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
213 DOM_SID *domain_sids;
216 /* defaults, but may be changed using params */
218 uint32 num_domains = 0;
222 printf("Usage: %s [enum context (0)]\n", argv[0]);
226 if (argc == 2 && argv[1]) {
227 enum_ctx = atoi(argv[2]);
230 result = cli_lsa_open_policy(cli, mem_ctx, True,
231 POLICY_VIEW_LOCAL_INFORMATION,
234 if (!NT_STATUS_IS_OK(result))
237 /* Lookup list of trusted domains */
239 result = cli_lsa_enum_trust_dom(cli, mem_ctx, &pol, &enum_ctx,
241 &domain_names, &domain_sids);
242 if (!NT_STATUS_IS_OK(result) &&
243 !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
244 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
247 /* Print results: list of names and sids returned in this response. */
248 for (i = 0; i < num_domains; i++) {
251 sid_to_string(sid_str, &domain_sids[i]);
252 printf("%s %s\n", domain_names[i] ? domain_names[i] :
253 "*unknown*", sid_str);
260 /* Enumerates privileges */
262 static NTSTATUS cmd_lsa_enum_privilege(struct cli_state *cli,
263 TALLOC_CTX *mem_ctx, int argc,
267 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
269 uint32 enum_context=0;
270 uint32 pref_max_length=0x1000;
278 printf("Usage: %s [enum context] [max length]\n", argv[0]);
283 enum_context=atoi(argv[1]);
286 pref_max_length=atoi(argv[2]);
288 result = cli_lsa_open_policy(cli, mem_ctx, True,
289 SEC_RIGHTS_MAXIMUM_ALLOWED,
292 if (!NT_STATUS_IS_OK(result))
295 result = cli_lsa_enum_privilege(cli, mem_ctx, &pol, &enum_context, pref_max_length,
296 &count, &privs_name, &privs_high, &privs_low);
298 if (!NT_STATUS_IS_OK(result))
302 printf("found %d privileges\n\n", count);
304 for (i = 0; i < count; i++) {
305 printf("%s \t\t%d:%d (0x%x:0x%x)\n", privs_name[i] ? privs_name[i] : "*unknown*",
306 privs_high[i], privs_low[i], privs_high[i], privs_low[i]);
313 /* Get privilege name */
315 static NTSTATUS cmd_lsa_get_dispname(struct cli_state *cli,
316 TALLOC_CTX *mem_ctx, int argc,
320 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
323 uint16 lang_id_sys=0;
328 printf("Usage: %s privilege name\n", argv[0]);
332 result = cli_lsa_open_policy(cli, mem_ctx, True,
333 SEC_RIGHTS_MAXIMUM_ALLOWED,
336 if (!NT_STATUS_IS_OK(result))
339 result = cli_lsa_get_dispname(cli, mem_ctx, &pol, argv[1], lang_id, lang_id_sys, description, &lang_id_desc);
341 if (!NT_STATUS_IS_OK(result))
345 printf("%s -> %s (language: 0x%x)\n", argv[1], description, lang_id_desc);
351 /* Enumerate the LSA SIDS */
353 static NTSTATUS cmd_lsa_enum_sids(struct cli_state *cli,
354 TALLOC_CTX *mem_ctx, int argc,
358 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
360 uint32 enum_context=0;
361 uint32 pref_max_length=0x1000;
367 printf("Usage: %s [enum context] [max length]\n", argv[0]);
372 enum_context=atoi(argv[1]);
375 pref_max_length=atoi(argv[2]);
377 result = cli_lsa_open_policy(cli, mem_ctx, True,
378 SEC_RIGHTS_MAXIMUM_ALLOWED,
381 if (!NT_STATUS_IS_OK(result))
384 result = cli_lsa_enum_sids(cli, mem_ctx, &pol, &enum_context, pref_max_length,
387 if (!NT_STATUS_IS_OK(result))
391 printf("found %d SIDs\n\n", count);
393 for (i = 0; i < count; i++) {
396 sid_to_string(sid_str, &sids[i]);
397 printf("%s\n", sid_str);
404 /* Enumerate the privileges of an SID */
406 static NTSTATUS cmd_lsa_enum_privsaccounts(struct cli_state *cli,
407 TALLOC_CTX *mem_ctx, int argc,
412 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
413 uint32 access_desired = 0x000f000f;
421 printf("Usage: %s SID\n", argv[0]);
425 string_to_sid(&sid, argv[1]);
427 result = cli_lsa_open_policy2(cli, mem_ctx, True,
428 SEC_RIGHTS_MAXIMUM_ALLOWED,
431 if (!NT_STATUS_IS_OK(result))
434 result = cli_lsa_open_account(cli, mem_ctx, &dom_pol, &sid, access_desired, &user_pol);
436 if (!NT_STATUS_IS_OK(result))
439 result = cli_lsa_enum_privsaccount(cli, mem_ctx, &user_pol, &count, &set);
441 if (!NT_STATUS_IS_OK(result))
445 printf("found %d privileges for SID %s\n\n", count, argv[1]);
446 printf("high\tlow\tattribute\n");
448 for (i = 0; i < count; i++) {
449 printf("%u\t%u\t%u\n", set[i].luid.high, set[i].luid.low, set[i].attr);
456 /* Get a privilege value given its name */
458 static NTSTATUS cmd_lsa_lookupprivvalue(struct cli_state *cli,
459 TALLOC_CTX *mem_ctx, int argc,
463 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
467 printf("Usage: %s name\n", argv[0]);
471 result = cli_lsa_open_policy2(cli, mem_ctx, True,
472 SEC_RIGHTS_MAXIMUM_ALLOWED,
475 if (!NT_STATUS_IS_OK(result))
478 result = cli_lsa_lookupprivvalue(cli, mem_ctx, &pol, argv[1], &luid);
480 if (!NT_STATUS_IS_OK(result))
485 printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
491 /* Query LSA security object */
493 static NTSTATUS cmd_lsa_query_secobj(struct cli_state *cli,
494 TALLOC_CTX *mem_ctx, int argc,
498 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
500 uint32 sec_info = 0x00000004; /* ??? */
503 printf("Usage: %s\n", argv[0]);
507 result = cli_lsa_open_policy2(cli, mem_ctx, True,
508 SEC_RIGHTS_MAXIMUM_ALLOWED,
511 if (!NT_STATUS_IS_OK(result))
514 result = cli_lsa_query_secobj(cli, mem_ctx, &pol, sec_info, &sdb);
516 if (!NT_STATUS_IS_OK(result))
521 display_sec_desc(sdb->sec);
528 /* List of commands exported by this module */
530 struct cmd_set lsarpc_commands[] = {
534 { "lsaquery", cmd_lsa_query_info_policy, PI_LSARPC, "Query info policy", "" },
535 { "lookupsids", cmd_lsa_lookup_sids, PI_LSARPC, "Convert SIDs to names", "" },
536 { "lookupnames", cmd_lsa_lookup_names, PI_LSARPC, "Convert names to SIDs", "" },
537 { "enumtrust", cmd_lsa_enum_trust_dom, PI_LSARPC, "Enumerate trusted domains", "Usage: [preferred max number] [enum context (0)]" },
538 { "enumprivs", cmd_lsa_enum_privilege, PI_LSARPC, "Enumerate privileges", "" },
539 { "getdispname", cmd_lsa_get_dispname, PI_LSARPC, "Get the privilege name", "" },
540 { "lsaenumsid", cmd_lsa_enum_sids, PI_LSARPC, "Enumerate the LSA SIDS", "" },
541 { "lsaenumprivsaccount", cmd_lsa_enum_privsaccounts, PI_LSARPC, "Enumerate the privileges of an SID", "" },
542 { "lsalookupprivvalue", cmd_lsa_lookupprivvalue, PI_LSARPC, "Get a privilege value given its name", "" },
543 { "lsaquerysecobj", cmd_lsa_query_secobj, PI_LSARPC, "Query LSA security object", "" },