| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Guenther
|
|
Using the standard macro makes it easier to move code into common, as
TALLOC_ZERO_ARRAY isn't standard talloc.
|
|
Using the standard macro makes it easier to move code into common, as
TALLOC_ZERO_P isn't standard talloc.
|
|
Using the standard macro makes it easier to move code into common, as
TALLOC_REALLOC_ARRAY isn't standard talloc.
Andrew Bartlett
|
|
This should not be used more generally, as it is specifically not for
multibyte strings, and uses malloc rather than talloc.
Andrew Bartlett
|
|
Guenther
|
|
Guenther
|
|
Guenther
|
|
<andreas.moroder@gmx.net>".
Jeremy.
|
|
|
|
the system one is broken.
|
|
Jeremy.
|
|
Jeremy.
|
|
Jeremy.
|
|
Jeremy
|
|
Guenther
|
|
Guenther
|
|
Guenther
|
|
Guenther
|
|
"Cooper S. Blake" <the_analogkid@yahoo.com>.
"I believe I have found two bugs in the 3.2 code and one bug that
carried on to the 3.3 branch. In the 3.2 code, everything is
located in the utils/net_rpc_samsync.c file. What I believe is the
first problem is that fetch_database() is calling
samsync_fix_delta_array() with rid_crypt set to true, which means
the password hashes are unencrypted from the RID encryption.
However, I believe this call is redundant, and the corresponding
call for samdump has rid_crypt set to false. So I think the
rid_crypt param should be false in fetch_database().
If you follow the code, it makes its way to sam_account_from_delta()
where the password hashes are decrypted a second time by calling
sam_pwd_hash(). I believe this is what is scrambling my passwords.
These methods were refactored somewhere in the 3.3 branch. Now the
net_rpc_samsync.c class calls rpc_vampire_internals, which calls
libnet/libnet_samsync.c, which calls samsync_fix_delta_array() with
rid_crypt always set to false. I think that's correct. But the
second bug has carried through in the sam_account_from_delta()
function:
208 if (memcmp(r->ntpassword.hash, zero_buf, 16) != 0) {
209 sam_pwd_hash(r->rid, r->ntpassword.hash, lm_passwd, 0);
210 pdb_set_lanman_passwd(account, lm_passwd, PDB_CHANGED);
211 }
212
213 if (memcmp(r->lmpassword.hash, zero_buf, 16) != 0) {
214 sam_pwd_hash(r->rid, r->lmpassword.hash, nt_passwd, 0);
215 pdb_set_nt_passwd(account, nt_passwd, PDB_CHANGED);
If you look closely you'll see that the nt hash is going into the
lm_passwd variable and the decrypted value is being set in the lanman
hash, and the lanman hash is being decrypted and put into the nt hash
field. So the LanMan and NT hashes look like they're being put in
the opposite fields."
Fix this by removing the rid_crypt parameter.
Jeremy.
|
|
Michael
(This used to be commit 32df05bd1f49f2290ad69f84d5a47207b1469629)
|
|
Karolin
(This used to be commit 7dae8b04f126d0ac86a452dcf373a690ee687ead)
|
|
Guenther
(This used to be commit fa1976e23a33bd3fab17c3f6ab5573ee1fdf9e31)
|
|
Guenther
(This used to be commit 1dbe6ea8607549649f69e1b63cc427efe67e0778)
|
|
Guenther
(This used to be commit e0b117200441f842fbc11cc817ab2cde4d63a22e)
|
|
Guenther
(This used to be commit e0843e631e379645296a5fe34dfc83bc265ebef3)
|
|
Guenther
(This used to be commit 1d5758ec3a5160e5649242c42f6e4a7b39eb6199)
|
