2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "libnet/libnet.h"
23 #include "../lib/crypto/crypto.h"
24 #include "libcli/auth/libcli_auth.h"
25 #include "librpc/gen_ndr/ndr_samr_c.h"
28 * do a password change using DCERPC/SAMR calls
29 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
30 * 2. try samr_ChangePasswordUser3
31 * 3. try samr_ChangePasswordUser2
32 * 4. try samr_OemChangePasswordUser2
33 * (not yet: 5. try samr_ChangePasswordUser)
35 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
38 struct libnet_RpcConnect c;
40 struct policy_handle user_handle;
41 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
42 struct samr_ChangePasswordUser pw;
44 struct samr_OemChangePasswordUser2 oe2;
45 struct samr_ChangePasswordUser2 pw2;
46 struct samr_ChangePasswordUser3 pw3;
47 struct lsa_String server, account;
48 struct lsa_AsciiString a_server, a_account;
49 struct samr_CryptPassword nt_pass, lm_pass;
50 struct samr_Password nt_verifier, lm_verifier;
51 uint8_t old_nt_hash[16], new_nt_hash[16];
52 uint8_t old_lm_hash[16], new_lm_hash[16];
53 struct samr_DomInfo1 *dominfo = NULL;
54 struct samr_ChangeReject *reject = NULL;
56 /* prepare connect to the SAMR pipe of the users domain PDC */
57 c.level = LIBNET_RPC_CONNECT_PDC;
58 c.in.name = r->samr.in.domain_name;
59 c.in.dcerpc_iface = &ndr_table_samr;
61 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
62 status = libnet_RpcConnect(ctx, mem_ctx, &c);
63 if (!NT_STATUS_IS_OK(status)) {
64 r->samr.out.error_string = talloc_asprintf(mem_ctx,
65 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
66 r->samr.in.domain_name, nt_errstr(status));
70 /* prepare password change for account */
71 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
72 account.string = r->samr.in.account_name;
74 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
75 E_md4hash(r->samr.in.newpassword, new_nt_hash);
77 E_deshash(r->samr.in.oldpassword, old_lm_hash);
78 E_deshash(r->samr.in.newpassword, new_lm_hash);
80 /* prepare samr_ChangePasswordUser3 */
81 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
82 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
83 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
85 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
86 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
87 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
89 pw3.in.server = &server;
90 pw3.in.account = &account;
91 pw3.in.nt_password = &nt_pass;
92 pw3.in.nt_verifier = &nt_verifier;
94 pw3.in.lm_password = &lm_pass;
95 pw3.in.lm_verifier = &lm_verifier;
96 pw3.in.password3 = NULL;
97 pw3.out.dominfo = &dominfo;
98 pw3.out.reject = &reject;
100 /* 2. try samr_ChangePasswordUser3 */
101 status = dcerpc_samr_ChangePasswordUser3(c.out.dcerpc_pipe, mem_ctx, &pw3);
102 if (!NT_STATUS_IS_OK(status)) {
103 r->samr.out.error_string = talloc_asprintf(mem_ctx,
104 "samr_ChangePasswordUser3 failed: %s",
106 goto ChangePasswordUser2;
109 /* check result of samr_ChangePasswordUser3 */
110 if (!NT_STATUS_IS_OK(pw3.out.result)) {
111 r->samr.out.error_string = talloc_asprintf(mem_ctx,
112 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s",
113 r->samr.in.domain_name, r->samr.in.account_name,
114 nt_errstr(pw3.out.result));
115 /* TODO: give the reason of the reject */
116 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
117 status = pw3.out.result;
120 goto ChangePasswordUser2;
126 /* prepare samr_ChangePasswordUser2 */
127 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
128 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
129 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
131 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
132 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
133 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
135 pw2.in.server = &server;
136 pw2.in.account = &account;
137 pw2.in.nt_password = &nt_pass;
138 pw2.in.nt_verifier = &nt_verifier;
139 pw2.in.lm_change = 1;
140 pw2.in.lm_password = &lm_pass;
141 pw2.in.lm_verifier = &lm_verifier;
143 /* 3. try samr_ChangePasswordUser2 */
144 status = dcerpc_samr_ChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &pw2);
145 if (!NT_STATUS_IS_OK(status)) {
146 r->samr.out.error_string = talloc_asprintf(mem_ctx,
147 "samr_ChangePasswordUser2 failed: %s",
149 goto OemChangePasswordUser2;
152 /* check result of samr_ChangePasswordUser2 */
153 if (!NT_STATUS_IS_OK(pw2.out.result)) {
154 r->samr.out.error_string = talloc_asprintf(mem_ctx,
155 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s",
156 r->samr.in.domain_name, r->samr.in.account_name,
157 nt_errstr(pw2.out.result));
158 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
159 status = pw2.out.result;
162 goto OemChangePasswordUser2;
167 OemChangePasswordUser2:
168 /* prepare samr_OemChangePasswordUser2 */
169 a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
170 a_account.string = r->samr.in.account_name;
172 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
173 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
174 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
176 oe2.in.server = &a_server;
177 oe2.in.account = &a_account;
178 oe2.in.password = &lm_pass;
179 oe2.in.hash = &lm_verifier;
181 /* 4. try samr_OemChangePasswordUser2 */
182 status = dcerpc_samr_OemChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &oe2);
183 if (!NT_STATUS_IS_OK(status)) {
184 r->samr.out.error_string = talloc_asprintf(mem_ctx,
185 "samr_OemChangePasswordUser2 failed: %s",
187 goto ChangePasswordUser;
190 /* check result of samr_OemChangePasswordUser2 */
191 if (!NT_STATUS_IS_OK(oe2.out.result)) {
192 r->samr.out.error_string = talloc_asprintf(mem_ctx,
193 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s",
194 r->samr.in.domain_name, r->samr.in.account_name,
195 nt_errstr(oe2.out.result));
196 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
197 status = oe2.out.result;
200 goto ChangePasswordUser;
207 /* prepare samr_ChangePasswordUser */
208 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
209 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
210 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
211 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
212 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
213 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
215 /* TODO: ask for a user_handle */
216 pw.in.handle = &user_handle;
217 pw.in.lm_present = 1;
218 pw.in.old_lm_crypted = &hash1;
219 pw.in.new_lm_crypted = &hash2;
220 pw.in.nt_present = 1;
221 pw.in.old_nt_crypted = &hash3;
222 pw.in.new_nt_crypted = &hash4;
223 pw.in.cross1_present = 1;
224 pw.in.nt_cross = &hash5;
225 pw.in.cross2_present = 1;
226 pw.in.lm_cross = &hash6;
228 /* 5. try samr_ChangePasswordUser */
229 status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
230 if (!NT_STATUS_IS_OK(status)) {
231 r->samr.out.error_string = talloc_asprintf(mem_ctx,
232 "samr_ChangePasswordUser failed: %s",
237 /* check result of samr_ChangePasswordUser */
238 if (!NT_STATUS_IS_OK(pw.out.result)) {
239 r->samr.out.error_string = talloc_asprintf(mem_ctx,
240 "samr_ChangePasswordUser for '%s\\%s' failed: %s",
241 r->samr.in.domain_name, r->samr.in.account_name,
242 nt_errstr(pw.out.result));
243 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
244 status = pw.out.result;
251 /* close connection */
252 talloc_free(c.out.dcerpc_pipe);
257 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
260 union libnet_ChangePassword r2;
262 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
263 r2.samr.in.account_name = r->generic.in.account_name;
264 r2.samr.in.domain_name = r->generic.in.domain_name;
265 r2.samr.in.oldpassword = r->generic.in.oldpassword;
266 r2.samr.in.newpassword = r->generic.in.newpassword;
268 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
270 r->generic.out.error_string = r2.samr.out.error_string;
275 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
277 switch (r->generic.level) {
278 case LIBNET_CHANGE_PASSWORD_GENERIC:
279 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
280 case LIBNET_CHANGE_PASSWORD_SAMR:
281 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
282 case LIBNET_CHANGE_PASSWORD_KRB5:
283 return NT_STATUS_NOT_IMPLEMENTED;
284 case LIBNET_CHANGE_PASSWORD_LDAP:
285 return NT_STATUS_NOT_IMPLEMENTED;
286 case LIBNET_CHANGE_PASSWORD_RAP:
287 return NT_STATUS_NOT_IMPLEMENTED;
290 return NT_STATUS_INVALID_LEVEL;
293 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
296 struct samr_SetUserInfo2 sui;
297 union samr_UserInfo u_info;
298 DATA_BLOB session_key;
299 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
300 uint8_t confounder[16];
301 struct MD5Context md5;
303 if (r->samr_handle.in.info21) {
304 return NT_STATUS_INVALID_PARAMETER_MIX;
307 /* prepare samr_SetUserInfo2 level 26 */
309 encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
310 u_info.info26.pw_len = strlen(r->samr_handle.in.newpassword);
312 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
313 if (!NT_STATUS_IS_OK(status)) {
314 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
315 "dcerpc_fetch_session_key failed: %s",
320 generate_random_buffer((uint8_t *)confounder, 16);
323 MD5Update(&md5, confounder, 16);
324 MD5Update(&md5, session_key.data, session_key.length);
325 MD5Final(confounded_session_key.data, &md5);
327 arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
328 memcpy(&u_info.info26.password.data[516], confounder, 16);
330 sui.in.user_handle = r->samr_handle.in.user_handle;
331 sui.in.info = &u_info;
334 /* 7. try samr_SetUserInfo2 level 26 to set the password */
335 status = dcerpc_samr_SetUserInfo2(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
336 /* check result of samr_SetUserInfo2 level 26 */
337 if (!NT_STATUS_IS_OK(status)) {
338 r->samr_handle.out.error_string
339 = talloc_asprintf(mem_ctx,
340 "SetUserInfo2 level 26 for [%s] failed: %s",
341 r->samr_handle.in.account_name, nt_errstr(status));
346 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
349 struct samr_SetUserInfo2 sui;
350 union samr_UserInfo u_info;
351 DATA_BLOB session_key;
352 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
353 uint8_t confounder[16];
354 struct MD5Context md5;
356 if (!r->samr_handle.in.info21) {
357 return NT_STATUS_INVALID_PARAMETER_MIX;
360 /* prepare samr_SetUserInfo2 level 25 */
362 u_info.info25.info = *r->samr_handle.in.info21;
363 u_info.info25.info.fields_present |= SAMR_FIELD_PASSWORD;
364 encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
366 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
367 if (!NT_STATUS_IS_OK(status)) {
368 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
369 "dcerpc_fetch_session_key failed: %s",
374 generate_random_buffer((uint8_t *)confounder, 16);
377 MD5Update(&md5, confounder, 16);
378 MD5Update(&md5, session_key.data, session_key.length);
379 MD5Final(confounded_session_key.data, &md5);
381 arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
382 memcpy(&u_info.info25.password.data[516], confounder, 16);
384 sui.in.user_handle = r->samr_handle.in.user_handle;
385 sui.in.info = &u_info;
388 /* 8. try samr_SetUserInfo2 level 25 to set the password */
389 status = dcerpc_samr_SetUserInfo2(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
390 if (!NT_STATUS_IS_OK(status)) {
391 r->samr_handle.out.error_string
392 = talloc_asprintf(mem_ctx,
393 "SetUserInfo2 level 25 for [%s] failed: %s",
394 r->samr_handle.in.account_name, nt_errstr(status));
399 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
402 struct samr_SetUserInfo2 sui;
403 union samr_UserInfo u_info;
404 DATA_BLOB session_key;
406 if (r->samr_handle.in.info21) {
407 return NT_STATUS_INVALID_PARAMETER_MIX;
410 /* prepare samr_SetUserInfo2 level 24 */
412 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
413 /* w2k3 ignores this length */
414 u_info.info24.pw_len = strlen_m(r->samr_handle.in.newpassword)*2;
416 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
417 if (!NT_STATUS_IS_OK(status)) {
418 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
419 "dcerpc_fetch_session_key failed: %s",
424 arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
426 sui.in.user_handle = r->samr_handle.in.user_handle;
427 sui.in.info = &u_info;
430 /* 9. try samr_SetUserInfo2 level 24 to set the password */
431 status = dcerpc_samr_SetUserInfo2(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
432 if (!NT_STATUS_IS_OK(status)) {
433 r->samr_handle.out.error_string
434 = talloc_asprintf(mem_ctx,
435 "SetUserInfo2 level 24 for [%s] failed: %s",
436 r->samr_handle.in.account_name, nt_errstr(status));
441 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
444 struct samr_SetUserInfo2 sui;
445 union samr_UserInfo u_info;
446 DATA_BLOB session_key;
448 if (!r->samr_handle.in.info21) {
449 return NT_STATUS_INVALID_PARAMETER_MIX;
452 /* prepare samr_SetUserInfo2 level 23 */
454 u_info.info23.info = *r->samr_handle.in.info21;
455 u_info.info23.info.fields_present |= SAMR_FIELD_PASSWORD;
456 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
458 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
459 if (!NT_STATUS_IS_OK(status)) {
460 r->samr_handle.out.error_string
461 = talloc_asprintf(mem_ctx,
462 "dcerpc_fetch_session_key failed: %s",
467 arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
469 sui.in.user_handle = r->samr_handle.in.user_handle;
470 sui.in.info = &u_info;
473 /* 10. try samr_SetUserInfo2 level 23 to set the password */
474 status = dcerpc_samr_SetUserInfo2(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
475 if (!NT_STATUS_IS_OK(status)) {
476 r->samr_handle.out.error_string
477 = talloc_asprintf(mem_ctx,
478 "SetUserInfo2 level 23 for [%s] failed: %s",
479 r->samr_handle.in.account_name, nt_errstr(status));
485 * 1. try samr_SetUserInfo2 level 26 to set the password
486 * 2. try samr_SetUserInfo2 level 25 to set the password
487 * 3. try samr_SetUserInfo2 level 24 to set the password
488 * 4. try samr_SetUserInfo2 level 23 to set the password
490 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
494 enum libnet_SetPassword_level levels[] = {
495 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
496 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
497 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
498 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
502 for (i=0; i < ARRAY_SIZE(levels); i++) {
503 r->generic.level = levels[i];
504 status = libnet_SetPassword(ctx, mem_ctx, r);
505 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
506 || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
507 || NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
508 /* Try another password set mechanism */
517 * set a password with DCERPC/SAMR calls
518 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
519 * is it correct to contact the the pdc of the domain of the user who's password should be set?
520 * 2. do a samr_Connect to get a policy handle
521 * 3. do a samr_LookupDomain to get the domain sid
522 * 4. do a samr_OpenDomain to get a domain handle
523 * 5. do a samr_LookupNames to get the users rid
524 * 6. do a samr_OpenUser to get a user handle
525 * 7 call libnet_SetPassword_samr_handle to set the password
527 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
530 struct libnet_RpcConnect c;
531 struct samr_Connect sc;
532 struct policy_handle p_handle;
533 struct samr_LookupDomain ld;
534 struct lsa_String d_name;
535 struct samr_OpenDomain od;
536 struct policy_handle d_handle;
537 struct samr_LookupNames ln;
538 struct samr_OpenUser ou;
539 struct policy_handle u_handle;
540 union libnet_SetPassword r2;
542 /* prepare connect to the SAMR pipe of users domain PDC */
543 c.level = LIBNET_RPC_CONNECT_PDC;
544 c.in.name = r->samr.in.domain_name;
545 c.in.dcerpc_iface = &ndr_table_samr;
547 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
548 status = libnet_RpcConnect(ctx, mem_ctx, &c);
549 if (!NT_STATUS_IS_OK(status)) {
550 r->samr.out.error_string = talloc_asprintf(mem_ctx,
551 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
552 r->samr.in.domain_name, nt_errstr(status));
556 /* prepare samr_Connect */
557 ZERO_STRUCT(p_handle);
558 sc.in.system_name = NULL;
559 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
560 sc.out.connect_handle = &p_handle;
562 /* 2. do a samr_Connect to get a policy handle */
563 status = dcerpc_samr_Connect(c.out.dcerpc_pipe, mem_ctx, &sc);
564 if (!NT_STATUS_IS_OK(status)) {
565 r->samr.out.error_string = talloc_asprintf(mem_ctx,
566 "samr_Connect failed: %s",
571 /* prepare samr_LookupDomain */
572 d_name.string = r->samr.in.domain_name;
573 ld.in.connect_handle = &p_handle;
574 ld.in.domain_name = &d_name;
576 /* 3. do a samr_LookupDomain to get the domain sid */
577 status = dcerpc_samr_LookupDomain(c.out.dcerpc_pipe, mem_ctx, &ld);
578 if (!NT_STATUS_IS_OK(status)) {
579 r->samr.out.error_string = talloc_asprintf(mem_ctx,
580 "samr_LookupDomain for [%s] failed: %s",
581 r->samr.in.domain_name, nt_errstr(status));
585 /* prepare samr_OpenDomain */
586 ZERO_STRUCT(d_handle);
587 od.in.connect_handle = &p_handle;
588 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
589 od.in.sid = ld.out.sid;
590 od.out.domain_handle = &d_handle;
592 /* 4. do a samr_OpenDomain to get a domain handle */
593 status = dcerpc_samr_OpenDomain(c.out.dcerpc_pipe, mem_ctx, &od);
594 if (!NT_STATUS_IS_OK(status)) {
595 r->samr.out.error_string = talloc_asprintf(mem_ctx,
596 "samr_OpenDomain for [%s] failed: %s",
597 r->samr.in.domain_name, nt_errstr(status));
601 /* prepare samr_LookupNames */
602 ln.in.domain_handle = &d_handle;
604 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
606 r->samr.out.error_string = "Out of Memory";
607 return NT_STATUS_NO_MEMORY;
609 ln.in.names[0].string = r->samr.in.account_name;
611 /* 5. do a samr_LookupNames to get the users rid */
612 status = dcerpc_samr_LookupNames(c.out.dcerpc_pipe, mem_ctx, &ln);
613 if (!NT_STATUS_IS_OK(status)) {
614 r->samr.out.error_string = talloc_asprintf(mem_ctx,
615 "samr_LookupNames for [%s] failed: %s",
616 r->samr.in.account_name, nt_errstr(status));
620 /* check if we got one RID for the user */
621 if (ln.out.rids.count != 1) {
622 r->samr.out.error_string = talloc_asprintf(mem_ctx,
623 "samr_LookupNames for [%s] returns %d RIDs",
624 r->samr.in.account_name, ln.out.rids.count);
625 status = NT_STATUS_INVALID_PARAMETER;
629 /* prepare samr_OpenUser */
630 ZERO_STRUCT(u_handle);
631 ou.in.domain_handle = &d_handle;
632 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
633 ou.in.rid = ln.out.rids.ids[0];
634 ou.out.user_handle = &u_handle;
636 /* 6. do a samr_OpenUser to get a user handle */
637 status = dcerpc_samr_OpenUser(c.out.dcerpc_pipe, mem_ctx, &ou);
638 if (!NT_STATUS_IS_OK(status)) {
639 r->samr.out.error_string = talloc_asprintf(mem_ctx,
640 "samr_OpenUser for [%s] failed: %s",
641 r->samr.in.account_name, nt_errstr(status));
645 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
646 r2.samr_handle.in.account_name = r->samr.in.account_name;
647 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
648 r2.samr_handle.in.user_handle = &u_handle;
649 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
650 r2.samr_handle.in.info21 = NULL;
652 status = libnet_SetPassword(ctx, mem_ctx, &r2);
654 r->generic.out.error_string = r2.samr_handle.out.error_string;
657 /* close connection */
658 talloc_free(c.out.dcerpc_pipe);
663 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
666 union libnet_SetPassword r2;
668 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
669 r2.samr.in.account_name = r->generic.in.account_name;
670 r2.samr.in.domain_name = r->generic.in.domain_name;
671 r2.samr.in.newpassword = r->generic.in.newpassword;
673 r->generic.out.error_string = "Unknown Error";
674 status = libnet_SetPassword(ctx, mem_ctx, &r2);
676 r->generic.out.error_string = r2.samr.out.error_string;
681 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
683 switch (r->generic.level) {
684 case LIBNET_SET_PASSWORD_GENERIC:
685 return libnet_SetPassword_generic(ctx, mem_ctx, r);
686 case LIBNET_SET_PASSWORD_SAMR:
687 return libnet_SetPassword_samr(ctx, mem_ctx, r);
688 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
689 return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
690 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
691 return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
692 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
693 return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
694 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
695 return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
696 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
697 return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
698 case LIBNET_SET_PASSWORD_KRB5:
699 return NT_STATUS_NOT_IMPLEMENTED;
700 case LIBNET_SET_PASSWORD_LDAP:
701 return NT_STATUS_NOT_IMPLEMENTED;
702 case LIBNET_SET_PASSWORD_RAP:
703 return NT_STATUS_NOT_IMPLEMENTED;
706 return NT_STATUS_INVALID_LEVEL;