source4/libnet/libnet_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2004
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23 #include "../lib/crypto/crypto.h"
  24 #include "libcli/auth/libcli_auth.h"
  25 #include "librpc/gen_ndr/ndr_samr_c.h"
  26
  27 /*
  28  * do a password change using DCERPC/SAMR calls
  29  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
  30  * 2. try samr_ChangePasswordUser3
  31  * 3. try samr_ChangePasswordUser2
  32  * 4. try samr_OemChangePasswordUser2
  33  * (not yet: 5. try samr_ChangePasswordUser)
  34  */
  35 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
  36 {
  37         NTSTATUS status;
  38         struct libnet_RpcConnect c;
  39 #if 0
  40         struct policy_handle user_handle;
  41         struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
  42         struct samr_ChangePasswordUser pw;
  43 #endif
  44         struct samr_OemChangePasswordUser2 oe2;
  45         struct samr_ChangePasswordUser2 pw2;
  46         struct samr_ChangePasswordUser3 pw3;
  47         struct lsa_String server, account;
  48         struct lsa_AsciiString a_server, a_account;
  49         struct samr_CryptPassword nt_pass, lm_pass;
  50         struct samr_Password nt_verifier, lm_verifier;
  51         uint8_t old_nt_hash[16], new_nt_hash[16];
  52         uint8_t old_lm_hash[16], new_lm_hash[16];
  53         struct samr_DomInfo1 *dominfo = NULL;
  54         struct userPwdChangeFailureInformation *reject = NULL;
  55
  56         ZERO_STRUCT(c);
  57
  58         /* prepare connect to the SAMR pipe of the users domain PDC */
  59         c.level                    = LIBNET_RPC_CONNECT_PDC;
  60         c.in.name                  = r->samr.in.domain_name;
  61         c.in.dcerpc_iface          = &ndr_table_samr;
  62         c.in.dcerpc_flags          = DCERPC_ANON_FALLBACK;
  63
  64         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
  65         status = libnet_RpcConnect(ctx, mem_ctx, &c);
  66         if (!NT_STATUS_IS_OK(status)) {
  67                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
  68                                                 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
  69                                                 r->samr.in.domain_name, nt_errstr(status));
  70                 return status;
  71         }
  72
  73         /* prepare password change for account */
  74         server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
  75         account.string = r->samr.in.account_name;
  76
  77         E_md4hash(r->samr.in.oldpassword, old_nt_hash);
  78         E_md4hash(r->samr.in.newpassword, new_nt_hash);
  79
  80         E_deshash(r->samr.in.oldpassword, old_lm_hash);
  81         E_deshash(r->samr.in.newpassword, new_lm_hash);
  82
  83         /* prepare samr_ChangePasswordUser3 */
  84         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
  85         arcfour_crypt(lm_pass.data, old_nt_hash, 516);
  86         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
  87
  88         encode_pw_buffer(nt_pass.data,  r->samr.in.newpassword, STR_UNICODE);
  89         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
  90         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
  91
  92         pw3.in.server = &server;
  93         pw3.in.account = &account;
  94         pw3.in.nt_password = &nt_pass;
  95         pw3.in.nt_verifier = &nt_verifier;
  96         pw3.in.lm_change = 1;
  97         pw3.in.lm_password = &lm_pass;
  98         pw3.in.lm_verifier = &lm_verifier;
  99         pw3.in.password3 = NULL;
 100         pw3.out.dominfo = &dominfo;
 101         pw3.out.reject = &reject;
 102
 103         /* 2. try samr_ChangePasswordUser3 */
 104         status = dcerpc_samr_ChangePasswordUser3_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw3);
 105         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 106                 if (!NT_STATUS_IS_OK(status)) {
 107                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 108                                                                    "samr_ChangePasswordUser3 failed: %s",
 109                                                                    nt_errstr(status));
 110                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 111                                                                    "samr_ChangePasswordUser3 for '%s\\%s' failed: %s",
 112                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 113                                                                    nt_errstr(status));
 114                 }
 115                 goto disconnect;
 116         }
 117
 118         /* prepare samr_ChangePasswordUser2 */
 119         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
 120         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 121         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 122
 123         encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
 124         arcfour_crypt(nt_pass.data, old_nt_hash, 516);
 125         E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
 126
 127         pw2.in.server = &server;
 128         pw2.in.account = &account;
 129         pw2.in.nt_password = &nt_pass;
 130         pw2.in.nt_verifier = &nt_verifier;
 131         pw2.in.lm_change = 1;
 132         pw2.in.lm_password = &lm_pass;
 133         pw2.in.lm_verifier = &lm_verifier;
 134
 135         /* 3. try samr_ChangePasswordUser2 */
 136         status = dcerpc_samr_ChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &pw2);
 137         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 138                 if (!NT_STATUS_IS_OK(status)) {
 139                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 140                                                                    "samr_ChangePasswordUser2 for '%s\\%s' failed: %s",
 141                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 142                                                                    nt_errstr(status));
 143                 }
 144                 goto disconnect;
 145         }
 146
 147
 148         /* prepare samr_OemChangePasswordUser2 */
 149         a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
 150         a_account.string = r->samr.in.account_name;
 151
 152         encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
 153         arcfour_crypt(lm_pass.data, old_lm_hash, 516);
 154         E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
 155
 156         oe2.in.server = &a_server;
 157         oe2.in.account = &a_account;
 158         oe2.in.password = &lm_pass;
 159         oe2.in.hash = &lm_verifier;
 160
 161         /* 4. try samr_OemChangePasswordUser2 */
 162         status = dcerpc_samr_OemChangePasswordUser2_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &oe2);
 163         if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 164                 if (!NT_STATUS_IS_OK(oe2.out.result)) {
 165                         r->samr.out.error_string = talloc_asprintf(mem_ctx,
 166                                                                    "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s",
 167                                                                    r->samr.in.domain_name, r->samr.in.account_name,
 168                                                                    nt_errstr(status));
 169                 }
 170                 goto disconnect;
 171         }
 172
 173 #if 0
 174         /* prepare samr_ChangePasswordUser */
 175         E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
 176         E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
 177         E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
 178         E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
 179         E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
 180         E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
 181
 182         /* TODO: ask for a user_handle */
 183         pw.in.handle = &user_handle;
 184         pw.in.lm_present = 1;
 185         pw.in.old_lm_crypted = &hash1;
 186         pw.in.new_lm_crypted = &hash2;
 187         pw.in.nt_present = 1;
 188         pw.in.old_nt_crypted = &hash3;
 189         pw.in.new_nt_crypted = &hash4;
 190         pw.in.cross1_present = 1;
 191         pw.in.nt_cross = &hash5;
 192         pw.in.cross2_present = 1;
 193         pw.in.lm_cross = &hash6;
 194
 195         /* 5. try samr_ChangePasswordUser */
 196         status = dcerpc_samr_ChangePasswordUser_r(c.pdc.out.dcerpc_pipe->binding_handle, mem_ctx, &pw);
 197         if (!NT_STATUS_IS_OK(status)) {
 198                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 199                                                 "samr_ChangePasswordUser failed: %s",
 200                                                 nt_errstr(status));
 201                 goto disconnect;
 202         }
 203
 204         /* check result of samr_ChangePasswordUser */
 205         if (!NT_STATUS_IS_OK(pw.out.result)) {
 206                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 207                                                 "samr_ChangePasswordUser for '%s\\%s' failed: %s",
 208                                                 r->samr.in.domain_name, r->samr.in.account_name,
 209                                                 nt_errstr(pw.out.result));
 210                 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
 211                         status = pw.out.result;
 212                         goto disconnect;
 213                 }
 214                 goto disconnect;
 215         }
 216 #endif
 217 disconnect:
 218         /* close connection */
 219         talloc_unlink(ctx, c.out.dcerpc_pipe);
 220
 221         return status;
 222 }
 223
 224 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 225 {
 226         NTSTATUS status;
 227         union libnet_ChangePassword r2;
 228
 229         r2.samr.level           = LIBNET_CHANGE_PASSWORD_SAMR;
 230         r2.samr.in.account_name = r->generic.in.account_name;
 231         r2.samr.in.domain_name  = r->generic.in.domain_name;
 232         r2.samr.in.oldpassword  = r->generic.in.oldpassword;
 233         r2.samr.in.newpassword  = r->generic.in.newpassword;
 234
 235         status = libnet_ChangePassword(ctx, mem_ctx, &r2);
 236
 237         r->generic.out.error_string = r2.samr.out.error_string;
 238
 239         return status;
 240 }
 241
 242 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
 243 {
 244         switch (r->generic.level) {
 245                 case LIBNET_CHANGE_PASSWORD_GENERIC:
 246                         return libnet_ChangePassword_generic(ctx, mem_ctx, r);
 247                 case LIBNET_CHANGE_PASSWORD_SAMR:
 248                         return libnet_ChangePassword_samr(ctx, mem_ctx, r);
 249                 case LIBNET_CHANGE_PASSWORD_KRB5:
 250                         return NT_STATUS_NOT_IMPLEMENTED;
 251                 case LIBNET_CHANGE_PASSWORD_LDAP:
 252                         return NT_STATUS_NOT_IMPLEMENTED;
 253                 case LIBNET_CHANGE_PASSWORD_RAP:
 254                         return NT_STATUS_NOT_IMPLEMENTED;
 255         }
 256
 257         return NT_STATUS_INVALID_LEVEL;
 258 }
 259
 260 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 261 {
 262         NTSTATUS status;
 263         struct samr_SetUserInfo2 sui;
 264         union samr_UserInfo u_info;
 265         DATA_BLOB session_key;
 266         DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 267         uint8_t confounder[16];
 268         struct MD5Context md5;
 269
 270         if (r->samr_handle.in.info21) {
 271                 return NT_STATUS_INVALID_PARAMETER_MIX;
 272         }
 273
 274         /* prepare samr_SetUserInfo2 level 26 */
 275         ZERO_STRUCT(u_info);
 276         encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 277         u_info.info26.password_expired = 0;
 278
 279         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 280         if (!NT_STATUS_IS_OK(status)) {
 281                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 282                                                                   "dcerpc_fetch_session_key failed: %s",
 283                                                                   nt_errstr(status));
 284                 return status;
 285         }
 286
 287         generate_random_buffer((uint8_t *)confounder, 16);
 288
 289         MD5Init(&md5);
 290         MD5Update(&md5, confounder, 16);
 291         MD5Update(&md5, session_key.data, session_key.length);
 292         MD5Final(confounded_session_key.data, &md5);
 293
 294         arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
 295         memcpy(&u_info.info26.password.data[516], confounder, 16);
 296
 297         sui.in.user_handle = r->samr_handle.in.user_handle;
 298         sui.in.info = &u_info;
 299         sui.in.level = 26;
 300
 301         /* 7. try samr_SetUserInfo2 level 26 to set the password */
 302         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 303         /* check result of samr_SetUserInfo2 level 26 */
 304         if (!NT_STATUS_IS_OK(status)) {
 305                 r->samr_handle.out.error_string
 306                         = talloc_asprintf(mem_ctx,
 307                                           "SetUserInfo2 level 26 for [%s] failed: %s",
 308                                           r->samr_handle.in.account_name, nt_errstr(status));
 309         }
 310         return status;
 311 }
 312
 313 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 314 {
 315         NTSTATUS status;
 316         struct samr_SetUserInfo2 sui;
 317         union samr_UserInfo u_info;
 318         DATA_BLOB session_key;
 319         DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
 320         uint8_t confounder[16];
 321         struct MD5Context md5;
 322
 323         if (!r->samr_handle.in.info21) {
 324                 return NT_STATUS_INVALID_PARAMETER_MIX;
 325         }
 326
 327         /* prepare samr_SetUserInfo2 level 25 */
 328         ZERO_STRUCT(u_info);
 329         u_info.info25.info = *r->samr_handle.in.info21;
 330         u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
 331         encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 332
 333         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 336                                                 "dcerpc_fetch_session_key failed: %s",
 337                                                 nt_errstr(status));
 338                 return status;
 339         }
 340
 341         generate_random_buffer((uint8_t *)confounder, 16);
 342
 343         MD5Init(&md5);
 344         MD5Update(&md5, confounder, 16);
 345         MD5Update(&md5, session_key.data, session_key.length);
 346         MD5Final(confounded_session_key.data, &md5);
 347
 348         arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
 349         memcpy(&u_info.info25.password.data[516], confounder, 16);
 350
 351         sui.in.user_handle = r->samr_handle.in.user_handle;
 352         sui.in.info = &u_info;
 353         sui.in.level = 25;
 354
 355         /* 8. try samr_SetUserInfo2 level 25 to set the password */
 356         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 357         if (!NT_STATUS_IS_OK(status)) {
 358                 r->samr_handle.out.error_string
 359                         = talloc_asprintf(mem_ctx,
 360                                           "SetUserInfo2 level 25 for [%s] failed: %s",
 361                                           r->samr_handle.in.account_name, nt_errstr(status));
 362         }
 363         return status;
 364 }
 365
 366 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 367 {
 368         NTSTATUS status;
 369         struct samr_SetUserInfo2 sui;
 370         union samr_UserInfo u_info;
 371         DATA_BLOB session_key;
 372
 373         if (r->samr_handle.in.info21) {
 374                 return NT_STATUS_INVALID_PARAMETER_MIX;
 375         }
 376
 377         /* prepare samr_SetUserInfo2 level 24 */
 378         ZERO_STRUCT(u_info);
 379         encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 380         u_info.info24.password_expired = 0;
 381
 382         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 383         if (!NT_STATUS_IS_OK(status)) {
 384                 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
 385                                                 "dcerpc_fetch_session_key failed: %s",
 386                                                 nt_errstr(status));
 387                 return status;
 388         }
 389
 390         arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
 391
 392         sui.in.user_handle = r->samr_handle.in.user_handle;
 393         sui.in.info = &u_info;
 394         sui.in.level = 24;
 395
 396         /* 9. try samr_SetUserInfo2 level 24 to set the password */
 397         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 398         if (!NT_STATUS_IS_OK(status)) {
 399                 r->samr_handle.out.error_string
 400                         = talloc_asprintf(mem_ctx,
 401                                           "SetUserInfo2 level 24 for [%s] failed: %s",
 402                                           r->samr_handle.in.account_name, nt_errstr(status));
 403         }
 404         return status;
 405 }
 406
 407 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 408 {
 409         NTSTATUS status;
 410         struct samr_SetUserInfo2 sui;
 411         union samr_UserInfo u_info;
 412         DATA_BLOB session_key;
 413
 414         if (!r->samr_handle.in.info21) {
 415                 return NT_STATUS_INVALID_PARAMETER_MIX;
 416         }
 417
 418         /* prepare samr_SetUserInfo2 level 23 */
 419         ZERO_STRUCT(u_info);
 420         u_info.info23.info = *r->samr_handle.in.info21;
 421         u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
 422         encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
 423
 424         status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
 425         if (!NT_STATUS_IS_OK(status)) {
 426                 r->samr_handle.out.error_string
 427                         = talloc_asprintf(mem_ctx,
 428                                           "dcerpc_fetch_session_key failed: %s",
 429                                           nt_errstr(status));
 430                 return status;
 431         }
 432
 433         arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
 434
 435         sui.in.user_handle = r->samr_handle.in.user_handle;
 436         sui.in.info = &u_info;
 437         sui.in.level = 23;
 438
 439         /* 10. try samr_SetUserInfo2 level 23 to set the password */
 440         status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
 441         if (!NT_STATUS_IS_OK(status)) {
 442                 r->samr_handle.out.error_string
 443                         = talloc_asprintf(mem_ctx,
 444                                           "SetUserInfo2 level 23 for [%s] failed: %s",
 445                                           r->samr_handle.in.account_name, nt_errstr(status));
 446         }
 447         return status;
 448 }
 449
 450 /*
 451  * 1. try samr_SetUserInfo2 level 26 to set the password
 452  * 2. try samr_SetUserInfo2 level 25 to set the password
 453  * 3. try samr_SetUserInfo2 level 24 to set the password
 454  * 4. try samr_SetUserInfo2 level 23 to set the password
 455 */
 456 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 457 {
 458
 459         NTSTATUS status;
 460         enum libnet_SetPassword_level levels[] = {
 461                 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
 462                 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
 463                 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
 464                 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
 465         };
 466         unsigned int i;
 467
 468         for (i=0; i < ARRAY_SIZE(levels); i++) {
 469                 r->generic.level = levels[i];
 470                 status = libnet_SetPassword(ctx, mem_ctx, r);
 471                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
 472                     || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
 473                     || NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 474                         /* Try another password set mechanism */
 475                         continue;
 476                 }
 477                 break;
 478         }
 479
 480         return status;
 481 }
 482 /*
 483  * set a password with DCERPC/SAMR calls
 484  * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
 485  *    is it correct to contact the the pdc of the domain of the user who's password should be set?
 486  * 2. do a samr_Connect to get a policy handle
 487  * 3. do a samr_LookupDomain to get the domain sid
 488  * 4. do a samr_OpenDomain to get a domain handle
 489  * 5. do a samr_LookupNames to get the users rid
 490  * 6. do a samr_OpenUser to get a user handle
 491  * 7  call libnet_SetPassword_samr_handle to set the password
 492  */
 493 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 494 {
 495         NTSTATUS status;
 496         struct libnet_RpcConnect c;
 497         struct samr_Connect sc;
 498         struct policy_handle p_handle;
 499         struct samr_LookupDomain ld;
 500         struct dom_sid2 *sid = NULL;
 501         struct lsa_String d_name;
 502         struct samr_OpenDomain od;
 503         struct policy_handle d_handle;
 504         struct samr_LookupNames ln;
 505         struct samr_Ids rids, types;
 506         struct samr_OpenUser ou;
 507         struct policy_handle u_handle;
 508         union libnet_SetPassword r2;
 509
 510         ZERO_STRUCT(c);
 511         /* prepare connect to the SAMR pipe of users domain PDC */
 512         c.level               = LIBNET_RPC_CONNECT_PDC;
 513         c.in.name             = r->samr.in.domain_name;
 514         c.in.dcerpc_iface     = &ndr_table_samr;
 515
 516         /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
 517         status = libnet_RpcConnect(ctx, mem_ctx, &c);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 520                                                            "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
 521                                                            r->samr.in.domain_name, nt_errstr(status));
 522                 return status;
 523         }
 524
 525         /* prepare samr_Connect */
 526         ZERO_STRUCT(p_handle);
 527         sc.in.system_name = NULL;
 528         sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 529         sc.out.connect_handle = &p_handle;
 530
 531         /* 2. do a samr_Connect to get a policy handle */
 532         status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc);
 533         if (!NT_STATUS_IS_OK(status)) {
 534                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 535                                                 "samr_Connect failed: %s",
 536                                                 nt_errstr(status));
 537                 goto disconnect;
 538         }
 539
 540         /* prepare samr_LookupDomain */
 541         d_name.string = r->samr.in.domain_name;
 542         ld.in.connect_handle = &p_handle;
 543         ld.in.domain_name = &d_name;
 544         ld.out.sid = &sid;
 545
 546         /* 3. do a samr_LookupDomain to get the domain sid */
 547         status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld);
 548         if (!NT_STATUS_IS_OK(status)) {
 549                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 550                                                 "samr_LookupDomain for [%s] failed: %s",
 551                                                 r->samr.in.domain_name, nt_errstr(status));
 552                 goto disconnect;
 553         }
 554
 555         /* prepare samr_OpenDomain */
 556         ZERO_STRUCT(d_handle);
 557         od.in.connect_handle = &p_handle;
 558         od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 559         od.in.sid = *ld.out.sid;
 560         od.out.domain_handle = &d_handle;
 561
 562         /* 4. do a samr_OpenDomain to get a domain handle */
 563         status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od);
 564         if (!NT_STATUS_IS_OK(status)) {
 565                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 566                                                 "samr_OpenDomain for [%s] failed: %s",
 567                                                 r->samr.in.domain_name, nt_errstr(status));
 568                 goto disconnect;
 569         }
 570
 571         /* prepare samr_LookupNames */
 572         ln.in.domain_handle = &d_handle;
 573         ln.in.num_names = 1;
 574         ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
 575         ln.out.rids = &rids;
 576         ln.out.types = &types;
 577         if (!ln.in.names) {
 578                 r->samr.out.error_string = "Out of Memory";
 579                 return NT_STATUS_NO_MEMORY;
 580         }
 581         ln.in.names[0].string = r->samr.in.account_name;
 582
 583         /* 5. do a samr_LookupNames to get the users rid */
 584         status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln);
 585         if (!NT_STATUS_IS_OK(status)) {
 586                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 587                                                 "samr_LookupNames for [%s] failed: %s",
 588                                                 r->samr.in.account_name, nt_errstr(status));
 589                 goto disconnect;
 590         }
 591
 592         /* check if we got one RID for the user */
 593         if (ln.out.rids->count != 1) {
 594                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 595                                                 "samr_LookupNames for [%s] returns %d RIDs",
 596                                                 r->samr.in.account_name, ln.out.rids->count);
 597                 status = NT_STATUS_INVALID_PARAMETER;
 598                 goto disconnect;
 599         }
 600
 601         /* prepare samr_OpenUser */
 602         ZERO_STRUCT(u_handle);
 603         ou.in.domain_handle = &d_handle;
 604         ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 605         ou.in.rid = ln.out.rids->ids[0];
 606         ou.out.user_handle = &u_handle;
 607
 608         /* 6. do a samr_OpenUser to get a user handle */
 609         status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou);
 610         if (!NT_STATUS_IS_OK(status)) {
 611                 r->samr.out.error_string = talloc_asprintf(mem_ctx,
 612                                                 "samr_OpenUser for [%s] failed: %s",
 613                                                 r->samr.in.account_name, nt_errstr(status));
 614                 goto disconnect;
 615         }
 616
 617         r2.samr_handle.level            = LIBNET_SET_PASSWORD_SAMR_HANDLE;
 618         r2.samr_handle.in.account_name  = r->samr.in.account_name;
 619         r2.samr_handle.in.newpassword   = r->samr.in.newpassword;
 620         r2.samr_handle.in.user_handle   = &u_handle;
 621         r2.samr_handle.in.dcerpc_pipe   = c.out.dcerpc_pipe;
 622         r2.samr_handle.in.info21        = NULL;
 623
 624         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 625
 626         r->generic.out.error_string = r2.samr_handle.out.error_string;
 627
 628 disconnect:
 629         /* close connection */
 630         talloc_unlink(ctx, c.out.dcerpc_pipe);
 631
 632         return status;
 633 }
 634
 635 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 636 {
 637         NTSTATUS status;
 638         union libnet_SetPassword r2;
 639
 640         r2.samr.level           = LIBNET_SET_PASSWORD_SAMR;
 641         r2.samr.in.account_name = r->generic.in.account_name;
 642         r2.samr.in.domain_name  = r->generic.in.domain_name;
 643         r2.samr.in.newpassword  = r->generic.in.newpassword;
 644
 645         r->generic.out.error_string = "Unknown Error";
 646         status = libnet_SetPassword(ctx, mem_ctx, &r2);
 647
 648         r->generic.out.error_string = r2.samr.out.error_string;
 649
 650         return status;
 651 }
 652
 653 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
 654 {
 655         switch (r->generic.level) {
 656                 case LIBNET_SET_PASSWORD_GENERIC:
 657                         return libnet_SetPassword_generic(ctx, mem_ctx, r);
 658                 case LIBNET_SET_PASSWORD_SAMR:
 659                         return libnet_SetPassword_samr(ctx, mem_ctx, r);
 660                 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
 661                         return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
 662                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
 663                         return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
 664                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
 665                         return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
 666                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
 667                         return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
 668                 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
 669                         return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
 670                 case LIBNET_SET_PASSWORD_KRB5:
 671                         return NT_STATUS_NOT_IMPLEMENTED;
 672                 case LIBNET_SET_PASSWORD_LDAP:
 673                         return NT_STATUS_NOT_IMPLEMENTED;
 674                 case LIBNET_SET_PASSWORD_RAP:
 675                         return NT_STATUS_NOT_IMPLEMENTED;
 676         }
 677
 678         return NT_STATUS_INVALID_LEVEL;
 679 }