dce/rpc

diff --git a/source/include/client.h b/source/include/client.h
index 44ac14766566a64790367b52f10a880a143587ea..0da4b40c18a713fa3b1e8fef1cdd37eacd2ccbed 100644 (file)
--- a/source/include/client.h
+++ b/source/include/client.h
@@ -118,7 +118,7 @@ struct cli_state {
        uint32 nt_error;                   /* NT RPC error code. */
        uint16 nt_pipe_fnum;               /* Pipe handle. */
        unsigned char sess_key[16];        /* Current session key. */
-       unsigned char ntlmssp_hash[256];   /* ntlmssp data. */
+       unsigned char ntlmssp_hash[258];   /* ntlmssp data. */
        uint32 ntlmssp_cli_flgs;           /* ntlmssp client flags */
        uint32 ntlmssp_srv_flgs;           /* ntlmssp server flags */
        DOM_CRED clnt_cred;                /* Client credential. */

diff --git a/source/include/ntdomain.h b/source/include/ntdomain.h
index 261cc3dfe364b67259f37111a6bac8b3649098c9..c2a417059591aab283b77044baabbcdb7cbd83e0 100644 (file)
--- a/source/include/ntdomain.h
+++ b/source/include/ntdomain.h
@@ -84,7 +84,7 @@ typedef struct pipes_struct
        RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 
        BOOL ntlmssp_auth;
-       unsigned char ntlmssp_hash[256];
+       unsigned char ntlmssp_hash[258];
 
        uint32 file_offset;
        uint32 hdr_offsets;

diff --git a/source/include/proto.h b/source/include/proto.h
index 4cf63d279735148ea238caa007beeb0ff5dd0f02..b0c50cbca7492cd5c7c4eab3a0aec50de10e2d6a 100644 (file)
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -1269,6 +1269,7 @@ BOOL get_samr_query_userinfo(struct cli_state *cli,
                                POLICY_HND *pol_open_domain,
                                uint32 info_level,
                                uint32 user_rid, SAM_USER_INFO_21 *usr);
+BOOL do_samr_unknown_38(struct cli_state *cli, char *srv_name);
 BOOL do_samr_unknown_8(struct cli_state *cli, 
                                POLICY_HND *domain_pol, uint16 switch_value);
 BOOL do_samr_enum_dom_users(struct cli_state *cli, 
@@ -1541,7 +1542,7 @@ void make_rpc_hdr_ba(RPC_HDR_BA *rpc,
                                uint8 num_results, uint16 result, uint16 reason,
                                RPC_IFACE *transfer);
 void smb_io_rpc_hdr_ba(char *desc,  RPC_HDR_BA *rpc, prs_struct *ps, int depth);
-void make_rpc_hdr_req(RPC_HDR_REQ *hdr, uint32 data_len, uint16 opnum);
+void make_rpc_hdr_req(RPC_HDR_REQ *hdr, uint32 alloc_hint, uint16 opnum);
 void smb_io_rpc_hdr_req(char *desc,  RPC_HDR_REQ *rpc, prs_struct *ps, int depth);
 void smb_io_rpc_hdr_resp(char *desc,  RPC_HDR_RESP *rpc, prs_struct *ps, int depth);
 void make_rpc_hdr_autha(RPC_HDR_AUTHA *rai,

diff --git a/source/include/rpc_samr.h b/source/include/rpc_samr.h
index a31401559158d505674dcd26e006586e6d8054f8..5f1a4bb36e4bde2486fd1fdbbb53142b187fcc7a 100644 (file)
--- a/source/include/rpc_samr.h
+++ b/source/include/rpc_samr.h
@@ -91,6 +91,7 @@ SamrTestPrivateFunctionsUser
 #define SAMR_UNKNOWN_21        0x21
 #define SAMR_UNKNOWN_32        0x32
 #define SAMR_UNKNOWN_34        0x34
+#define SAMR_UNKNOWN_38        0x38
 #define SAMR_CONNECT           0x39
 #define SAMR_OPEN_ALIAS        0x1b
 #define SAMR_QUERY_ALIASINFO   0x1c

diff --git a/source/libsmb/smbdes.c b/source/libsmb/smbdes.c
index 1d6c6bc0a686836331987ce7a9e2f7c4ae9b56f4..c0f749ad3b32248d186a73f4da21f0c690b8b795 100644 (file)
--- a/source/libsmb/smbdes.c
+++ b/source/libsmb/smbdes.c
@@ -357,17 +357,17 @@ void cred_hash3(unsigned char *out,unsigned char *in,unsigned char *key, int for
         smbhash(out + 8, in + 8, key2, forw);
 }
 
-void NTLMSSPhash( unsigned char hash[256], unsigned char const key[5])
+void NTLMSSPhash( unsigned char hash[258], unsigned char key[5])
 {
-  unsigned char j = 0;
-  int ind;
+       unsigned char j = 0;
+       int ind;
 
        unsigned char k2[8];
 
-       memcpy(k2, key, sizeof(key));
+       memcpy(k2, key, 5);
        k2[5] = 0xe5;
-       k2[6] = 0xb8;
-       k2[6] = 0xb0;
+       k2[6] = 0x38;
+       k2[7] = 0xb0;
 
        for (ind = 0; ind < 256; ind++)
        {
@@ -384,12 +384,15 @@ void NTLMSSPhash( unsigned char hash[256], unsigned char const key[5])
                hash[ind] = hash[j];
                hash[j] = tc;
        }
+
+       hash[256] = 0;
+       hash[257] = 0;
 }
 
-void NTLMSSPcalc( unsigned char hash[256], unsigned char *data, int len)
+void NTLMSSPcalc( unsigned char hash[258], unsigned char *data, int len)
 {
-       unsigned char index_i = 0;
-       unsigned char index_j = 0;
+       unsigned char index_i = hash[256];
+       unsigned char index_j = hash[257];
        int ind;
 
        for( ind = 0; ind < len; ind++)
@@ -405,8 +408,11 @@ void NTLMSSPcalc( unsigned char hash[256], unsigned char *data, int len)
                hash[index_j] = tc;
 
                t = hash[index_i] + hash[index_j];
-               data[ind] ^= hash[t];
+               data[ind] = data[ind] ^ hash[t];
        }
+
+       hash[256] = index_i;
+       hash[257] = index_j;
 }
 
 void SamOEMhash( unsigned char *data, unsigned char *key, int val)

diff --git a/source/libsmb/smbencrypt.c b/source/libsmb/smbencrypt.c
index 44dcbd5e05bc92eebd8cbe6c3e9428edcce52a49..a9e680ccdd5875a5e492e4f9cb1885f3cac12c12 100644 (file)
--- a/source/libsmb/smbencrypt.c
+++ b/source/libsmb/smbencrypt.c
@@ -162,6 +162,12 @@ void NTLMSSPOWFencrypt(uchar passwd[8], uchar *ntlmchalresp, uchar p24[24])
        memset(p21 + 8, 0xbd, 8);    
 
        E_P24(p21, ntlmchalresp, p24);
+#ifdef DEBUG_PASSWORD
+       DEBUG(100,("NTLMSSPOWFencrypt: p21, c8, p24\n"));
+       dump_data(100, p21, 21);
+       dump_data(100, ntlmchalresp, 8);
+       dump_data(100, p24, 24);
+#endif
 }
 
 

diff --git a/source/rpc_client/cli_pipe.c b/source/rpc_client/cli_pipe.c
index f7060e0f71d7cc992c63199a9343a9204b7359c8..761f23f8851332b3bfb0390397937aa786056260 100644 (file)
--- a/source/rpc_client/cli_pipe.c
+++ b/source/rpc_client/cli_pipe.c
@@ -293,7 +293,7 @@ static BOOL create_rpc_bind_req(prs_struct *rhdr,
                                 prs_struct *auth_ntlm,
                                uint32 call_id,
                                 RPC_IFACE *abstract, RPC_IFACE *transfer,
-                                char *my_name, char *domain)
+                                char *my_name, char *domain, uint32 neg_flags)
 {
        RPC_HDR_RB           hdr_rb;
        RPC_HDR              hdr;
@@ -322,7 +322,7 @@ static BOOL create_rpc_bind_req(prs_struct *rhdr,
                mem_realloc_data(auth_req->data, auth_req->offset);
 
                make_rpc_auth_ntlmssp_neg(&ntlmssp_neg,
-                                      0x0000b2b3, my_name, domain);
+                                      neg_flags, my_name, domain);
 
                smb_io_rpc_auth_ntlmssp_neg("ntlmssp_neg", &ntlmssp_neg, auth_req, 0);
                mem_realloc_data(auth_req->data, auth_req->offset);
@@ -451,7 +451,7 @@ static BOOL create_rpc_request(prs_struct *rhdr, uint8 op_num, int data_len,
 
        if (auth_len != 0)
        {
-               alloc_hint = data_len - 0x18 - auth_len - 12;
+               alloc_hint = data_len - 0x18 - auth_len - 10;
        }
        else
        {
@@ -522,7 +522,7 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
                RPC_AUTH_NTLMSSP_CHK chk;
                RPC_HDR_AUTH         rhdr_auth;
 
-               make_rpc_hdr_auth(&rhdr_auth, 0x0a, 0x06, 0x02);
+               make_rpc_hdr_auth(&rhdr_auth, 0x0a, 0x06, 0x08);
                smb_io_rpc_hdr_auth("hdr_auth", &rhdr_auth, &hdr_auth, 0);
 
                make_rpc_auth_ntlmssp_chk(&chk, NTLMSSP_SIGN_VERSION, crc32, 0);
@@ -747,7 +747,8 @@ static BOOL rpc_pipe_bind(struct cli_state *cli, char *pipe_name,
                            ntlmssp_auth ? &auth_req : NULL,
                            ntlmssp_auth ? &auth_ntlm : NULL,
                            call_id,
-                           abstract, transfer, global_myname, cli->domain);
+                           abstract, transfer,
+                           global_myname, cli->domain, cli->ntlmssp_cli_flgs);
 
        /* this is a hack due to limitations in rpc_api_pipe */
        prs_init(&data, mem_buf_len(hdr.data), 4, 0x0, False);
@@ -884,16 +885,19 @@ BOOL cli_nt_session_open(struct cli_state *cli, char *pipe_name, BOOL encrypted)
 
        if (encrypted)
        {
-               cli->ntlmssp_cli_flgs =
+               cli->ntlmssp_cli_flgs = 
                                    NTLMSSP_NEGOTIATE_UNICODE |
-                                   NTLMSSP_NEGOTIATE_OEM |
+/*                                 NTLMSSP_NEGOTIATE_OEM |
+ */
                                    NTLMSSP_NEGOTIATE_SIGN |
                                    NTLMSSP_NEGOTIATE_SEAL |
                                    NTLMSSP_NEGOTIATE_LM_KEY |
                                    NTLMSSP_NEGOTIATE_NTLM |
-                                   NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
+                                   NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+/*
                                    NTLMSSP_NEGOTIATE_00001000 |
                                    NTLMSSP_NEGOTIATE_00002000;
+ */
                DEBUG(5,("cli_nt_session_open: neg_flags: %lx\n",
                         cli->ntlmssp_cli_flgs));
        }

diff --git a/source/rpc_client/cli_samr.c b/source/rpc_client/cli_samr.c
index c9e806fd21c9d933db390661ce16d99e89e7bf81..1428178c26543a310d0508c9e6df67db497774f2 100644 (file)
--- a/source/rpc_client/cli_samr.c
+++ b/source/rpc_client/cli_samr.c
@@ -97,6 +97,57 @@ BOOL get_samr_query_userinfo(struct cli_state *cli,
        return do_samr_close(cli, &pol_open_user);
 }
 
+/****************************************************************************
+do a SAMR unknown 0x38 command
+****************************************************************************/
+BOOL do_samr_unknown_38(struct cli_state *cli, char *srv_name)
+{
+       prs_struct data;
+       prs_struct rdata;
+
+       SAMR_Q_UNKNOWN_38 q_e;
+       BOOL valid_un8 = False;
+
+       /* create and send a MSRPC command with api SAMR_ENUM_DOM_USERS */
+
+       prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+       prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
+       DEBUG(4,("SAMR Unknown 38 server:%s\n", srv_name));
+
+       make_samr_q_unknown_38(&q_e, srv_name);
+
+       /* turn parameters into data stream */
+       samr_io_q_unknown_38("", &q_e, &data, 0);
+
+       /* send the data on \PIPE\ */
+       if (rpc_api_pipe_req(cli, SAMR_UNKNOWN_38, &data, &rdata))
+       {
+               SAMR_R_UNKNOWN_38 r_e;
+               BOOL p;
+
+               samr_io_r_unknown_38("", &r_e, &rdata, 0);
+
+               p = rdata.offset != 0;
+               if (p && r_e.status != 0)
+               {
+                       /* report error code */
+                       DEBUG(0,("SAMR_R_UNKNOWN_38: %s\n", get_nt_error_msg(r_e.status)));
+                       p = False;
+               }
+
+               if (p)
+               {
+                       valid_un8 = True;
+               }
+       }
+
+       prs_mem_free(&data   );
+       prs_mem_free(&rdata  );
+
+       return valid_un8;
+}
+
 /****************************************************************************
 do a SAMR unknown 0x8 command
 ****************************************************************************/

diff --git a/source/rpc_parse/parse_rpc.c b/source/rpc_parse/parse_rpc.c
index 2204207440ad01c9ff75304ae563b6638efe7d71..43cb204681995bfab546ae7d33714b58454e650d 100644 (file)
--- a/source/rpc_parse/parse_rpc.c
+++ b/source/rpc_parse/parse_rpc.c
@@ -554,8 +554,8 @@ void smb_io_rpc_auth_ntlmssp_neg(char *desc, RPC_AUTH_NTLMSSP_NEG *neg, prs_stru
        smb_io_strhdr("hdr_myname", &(neg->hdr_myname), ps, depth); 
        smb_io_strhdr("hdr_domain", &(neg->hdr_domain), ps, depth); 
 
-       prs_string("myname", ps, depth, neg->myname, neg->hdr_myname.str_str_len, sizeof(neg->myname)); 
        prs_string("domain", ps, depth, neg->domain, neg->hdr_domain.str_str_len, sizeof(neg->domain)); 
+       prs_string("myname", ps, depth, neg->myname, neg->hdr_myname.str_str_len, sizeof(neg->myname)); 
 }
 
 /*******************************************************************
@@ -635,12 +635,6 @@ void make_rpc_auth_ntlmssp_resp(RPC_AUTH_NTLMSSP_RESP *rsp,
                usr_len *= 2;
        }
 
-       make_str_hdr(&rsp->hdr_lm_resp, lm_len, lm_len, offset);
-       offset += lm_len;
-
-       make_str_hdr(&rsp->hdr_nt_resp, nt_len, nt_len, offset);
-       offset += nt_len;
-
        make_str_hdr(&rsp->hdr_domain , dom_len, dom_len, offset);
        offset += dom_len;
 
@@ -650,6 +644,12 @@ void make_rpc_auth_ntlmssp_resp(RPC_AUTH_NTLMSSP_RESP *rsp,
        make_str_hdr(&rsp->hdr_wks    , wks_len, wks_len, offset);
        offset += wks_len;
 
+       make_str_hdr(&rsp->hdr_lm_resp, lm_len , lm_len , offset);
+       offset += lm_len;
+
+       make_str_hdr(&rsp->hdr_nt_resp, nt_len , nt_len , offset);
+       offset += nt_len;
+
        make_str_hdr(&rsp->hdr_sess_key, 0, 0, offset);
 
        rsp->neg_flags = neg_flags;
@@ -705,14 +705,6 @@ void smb_io_rpc_auth_ntlmssp_resp(char *desc, RPC_AUTH_NTLMSSP_RESP *rsp, prs_st
 
                old_offset = ps->offset;
 
-               ps->offset = rsp->hdr_lm_resp .buffer + 0x1c;
-               prs_uint8s(False, "lm_resp ", ps, depth, (uint8*)rsp->lm_resp , MIN(rsp->hdr_lm_resp .str_str_len, sizeof(rsp->lm_resp ))); 
-               old_offset += rsp->hdr_lm_resp .str_str_len;
-
-               ps->offset = rsp->hdr_nt_resp .buffer + 0x1c;
-               prs_uint8s(False, "nt_resp ", ps, depth, (uint8*)rsp->nt_resp , MIN(rsp->hdr_nt_resp .str_str_len, sizeof(rsp->nt_resp ))); 
-               old_offset += rsp->hdr_nt_resp .str_str_len;
-
                ps->offset = rsp->hdr_domain  .buffer + 0x1c;
                prs_uint8s(True , "domain  ", ps, depth, (uint8*)rsp->domain  , MIN(rsp->hdr_domain  .str_str_len, sizeof(rsp->domain  ))); 
                old_offset += rsp->hdr_domain  .str_str_len;
@@ -725,6 +717,14 @@ void smb_io_rpc_auth_ntlmssp_resp(char *desc, RPC_AUTH_NTLMSSP_RESP *rsp, prs_st
                prs_uint8s(True , "wks     ", ps, depth, (uint8*)rsp->wks     , MIN(rsp->hdr_wks     .str_str_len, sizeof(rsp->wks     ))); 
                old_offset += rsp->hdr_wks     .str_str_len;
 
+               ps->offset = rsp->hdr_lm_resp .buffer + 0x1c;
+               prs_uint8s(False, "lm_resp ", ps, depth, (uint8*)rsp->lm_resp , MIN(rsp->hdr_lm_resp .str_str_len, sizeof(rsp->lm_resp ))); 
+               old_offset += rsp->hdr_lm_resp .str_str_len;
+
+               ps->offset = rsp->hdr_nt_resp .buffer + 0x1c;
+               prs_uint8s(False, "nt_resp ", ps, depth, (uint8*)rsp->nt_resp , MIN(rsp->hdr_nt_resp .str_str_len, sizeof(rsp->nt_resp ))); 
+               old_offset += rsp->hdr_nt_resp .str_str_len;
+
                if (rsp->hdr_sess_key.str_str_len != 0)
                {
                        ps->offset = rsp->hdr_sess_key.buffer + 0x1c;
@@ -746,11 +746,11 @@ void smb_io_rpc_auth_ntlmssp_resp(char *desc, RPC_AUTH_NTLMSSP_RESP *rsp, prs_st
 
                prs_uint32("neg_flags", ps, depth, &(rsp->neg_flags)); /* 0x0000 82b1 */
 
-               prs_uint8s(False, "lm_resp ", ps, depth, rsp->lm_resp , MIN(rsp->hdr_lm_resp .str_str_len, sizeof(rsp->lm_resp ))); 
-               prs_uint8s(False, "nt_resp ", ps, depth, rsp->nt_resp , MIN(rsp->hdr_nt_resp .str_str_len, sizeof(rsp->nt_resp ))); 
                prs_uint8s(True , "domain  ", ps, depth, rsp->domain  , MIN(rsp->hdr_domain  .str_str_len, sizeof(rsp->domain  ))); 
                prs_uint8s(True , "user    ", ps, depth, rsp->user    , MIN(rsp->hdr_usr     .str_str_len, sizeof(rsp->user    ))); 
                prs_uint8s(True , "wks     ", ps, depth, rsp->wks     , MIN(rsp->hdr_wks     .str_str_len, sizeof(rsp->wks     ))); 
+               prs_uint8s(False, "lm_resp ", ps, depth, rsp->lm_resp , MIN(rsp->hdr_lm_resp .str_str_len, sizeof(rsp->lm_resp ))); 
+               prs_uint8s(False, "nt_resp ", ps, depth, rsp->nt_resp , MIN(rsp->hdr_nt_resp .str_str_len, sizeof(rsp->nt_resp ))); 
                prs_uint8s(False, "sess_key", ps, depth, rsp->sess_key, MIN(rsp->hdr_sess_key.str_str_len, sizeof(rsp->sess_key))); 
        }
 }

diff --git a/source/rpcclient/cmd_samr.c b/source/rpcclient/cmd_samr.c
index 487c8e46c162079900bf475cd85284496edfd196..1c361f0f5e698073ecf72577d23b4e2b344c8fcb 100644 (file)
--- a/source/rpcclient/cmd_samr.c
+++ b/source/rpcclient/cmd_samr.c
@@ -68,12 +68,7 @@ void cmd_sam_test(struct client_info *info)
        res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, True) : False;
 
        /* establish a connection. */
-       res = res ? do_samr_connect(smb_cli, 
-                               srv_name, 0x00000020,
-                               &info->dom.samr_pol_connect) : False;
-
-       res = res ? do_samr_close(smb_cli,
-                   &info->dom.samr_pol_connect) : False;
+       res = res ? do_samr_unknown_38(smb_cli, srv_name) : False;
 
        /* close the session */
        cli_nt_session_close(smb_cli);

diff --git a/source/smbd/pipes.c b/source/smbd/pipes.c
index 3e10065711dea0da32f2c2aaa06020136b0e9a06..7cf7fd8ea3477e09c816b2b53f140415192b41ea 100644 (file)
--- a/source/smbd/pipes.c
+++ b/source/smbd/pipes.c
@@ -99,7 +99,7 @@ int reply_open_pipe_and_X(connection_struct *conn,
        put_dos_date3(outbuf,smb_vwv4,mtime);
        SIVAL(outbuf,smb_vwv6,size);
        SSVAL(outbuf,smb_vwv8,rmode);
-       SSVAL(outbuf,smb_vwv11,0);
+       SSVAL(outbuf,smb_vwv11,0x0001);
 
        return chain_reply(inbuf,outbuf,length,bufsize);
 }