/* Unix SMB/Netbios implementation. Version 1.9. NT Domain Authentication SMB / MSRPC client Copyright (C) Andrew Tridgell 1994-1999 Copyright (C) Luke Kenneth Casson Leighton 1996-1999 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ #ifdef SYSLOG #undef SYSLOG #endif #include "includes.h" #include "nterr.h" extern int DEBUGLEVEL; #define DEBUG_TESTING extern struct cli_state *smb_cli; extern FILE* out_hnd; static void sam_display_domain(const char *domain) { report(out_hnd, "Domain Name: %s\n", domain); } static void sam_display_alias_info(const char *domain, const DOM_SID *sid, uint32 alias_rid, ALIAS_INFO_CTR *const ctr) { display_alias_info_ctr(out_hnd, ACTION_HEADER , ctr); display_alias_info_ctr(out_hnd, ACTION_ENUMERATE, ctr); display_alias_info_ctr(out_hnd, ACTION_FOOTER , ctr); } static void sam_display_alias(const char *domain, const DOM_SID *sid, uint32 alias_rid, const char *alias_name) { report(out_hnd, "Alias RID: %8x Alias Name: %s\n", alias_rid, alias_name); } static void sam_display_alias_members(const char *domain, const DOM_SID *sid, uint32 alias_rid, const char *alias_name, uint32 num_names, DOM_SID *const *const sids, char *const *const name, uint8 *const type) { display_alias_members(out_hnd, ACTION_HEADER , num_names, name, type); display_alias_members(out_hnd, ACTION_ENUMERATE, num_names, name, type); display_alias_members(out_hnd, ACTION_FOOTER , num_names, name, type); } static void sam_display_group_info(const char *domain, const DOM_SID *sid, uint32 group_rid, GROUP_INFO_CTR *const ctr) { display_group_info_ctr(out_hnd, ACTION_HEADER , ctr); display_group_info_ctr(out_hnd, ACTION_ENUMERATE, ctr); display_group_info_ctr(out_hnd, ACTION_FOOTER , ctr); } static void sam_display_group(const char *domain, const DOM_SID *sid, uint32 group_rid, const char *group_name) { report(out_hnd, "Group RID: %8x Group Name: %s\n", group_rid, group_name); } static void sam_display_group_members(const char *domain, const DOM_SID *sid, uint32 group_rid, const char *group_name, uint32 num_names, const uint32 *rid_mem, char *const *const name, uint32 *const type) { display_group_members(out_hnd, ACTION_HEADER , num_names, name, type); display_group_members(out_hnd, ACTION_ENUMERATE, num_names, name, type); display_group_members(out_hnd, ACTION_FOOTER , num_names, name, type); } static void sam_display_user_info(const char *domain, const DOM_SID *sid, uint32 user_rid, SAM_USER_INFO_21 *const usr) { display_sam_user_info_21(out_hnd, ACTION_HEADER , usr); display_sam_user_info_21(out_hnd, ACTION_ENUMERATE, usr); display_sam_user_info_21(out_hnd, ACTION_FOOTER , usr); } static void sam_display_user(const char *domain, const DOM_SID *sid, uint32 user_rid, const char *user_name) { report(out_hnd, "User RID: %8x User Name: %s\n", user_rid, user_name); } /**************************************************************************** SAM password change ****************************************************************************/ void cmd_sam_ntchange_pwd(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid; char *new_passwd; BOOL res = True; char nt_newpass[516]; uchar nt_hshhash[16]; uchar nt_newhash[16]; uchar nt_oldhash[16]; char lm_newpass[516]; uchar lm_newhash[16]; uchar lm_hshhash[16]; uchar lm_oldhash[16]; sid_to_string(sid, &info->dom.level5_sid); fstrcpy(domain, info->dom.level5_dom); fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); report(out_hnd, "SAM NT Password Change\n"); #if 0 struct pwd_info new_pwd; pwd_read(&new_pwd, "New Password (ONCE: this is test code!):", True); #endif new_passwd = (char*)getpass("New Password (ONCE ONLY - get it right :-)"); nt_lm_owf_gen(new_passwd, lm_newhash, nt_newhash); pwd_get_lm_nt_16(&(smb_cli->pwd), lm_oldhash, nt_oldhash ); make_oem_passwd_hash(nt_newpass, new_passwd, nt_oldhash, True); make_oem_passwd_hash(lm_newpass, new_passwd, lm_oldhash, True); E_old_pw_hash(lm_newhash, lm_oldhash, lm_hshhash); E_old_pw_hash(lm_newhash, nt_oldhash, nt_hshhash); cli_nt_set_ntlmssp_flgs(smb_cli, NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_LM_KEY | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_00001000 | NTLMSSP_NEGOTIATE_00002000); /* open SAMR session. */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_unknown_38(smb_cli, fnum, srv_name) : False; /* establish a connection. */ res = res ? samr_chgpasswd_user(smb_cli, fnum, srv_name, smb_cli->user_name, nt_newpass, nt_hshhash, lm_newpass, lm_hshhash) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res) { report(out_hnd, "NT Password changed OK\n"); } else { report(out_hnd, "NT Password change FAILED\n"); } } /**************************************************************************** experimental SAM encryted rpc test connection ****************************************************************************/ void cmd_sam_test(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid; BOOL res = True; sid_to_string(sid, &info->dom.level5_sid); fstrcpy(domain, info->dom.level5_dom); /* if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } */ fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); report(out_hnd, "SAM Encryption Test\n"); cli_nt_set_ntlmssp_flgs(smb_cli, NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_LM_KEY | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_00001000 | NTLMSSP_NEGOTIATE_00002000); /* open SAMR session. */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_unknown_38(smb_cli, fnum, srv_name) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res) { DEBUG(5,("cmd_sam_test: succeeded\n")); } else { DEBUG(5,("cmd_sam_test: failed\n")); } } /**************************************************************************** Lookup domain in SAM server. ****************************************************************************/ void cmd_sam_lookup_domain(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring str_sid; DOM_SID dom_sid; BOOL res = True; POLICY_HND sam_pol; fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, domain, NULL, sizeof(domain))) { report(out_hnd, "lookupdomain: \n"); return; } report(out_hnd, "Lookup Domain in SAM Server\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_query_lookup_domain(smb_cli, fnum, &sam_pol, domain, &dom_sid) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res) { DEBUG(5,("cmd_sam_lookup_domain: succeeded\n")); sid_to_string(str_sid, &dom_sid); report(out_hnd, "%s SID: %s\n", domain, str_sid); report(out_hnd, "Lookup Domain: OK\n"); } else { DEBUG(5,("cmd_sam_lookup_domain: failed\n")); report(out_hnd, "Lookup Domain: FAILED\n"); } } /**************************************************************************** SAM delete alias member. ****************************************************************************/ void cmd_sam_del_aliasmem(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring tmp; fstring sid; DOM_SID sid1; POLICY_HND alias_pol; BOOL res = True; BOOL res1 = True; BOOL res2 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ DOM_SID member_sid; uint32 alias_rid; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, tmp, NULL, sizeof(tmp))) { report(out_hnd, "delaliasmem: [member sid1] [member sid2] ...\n"); return; } alias_rid = get_number(tmp); report(out_hnd, "SAM Domain Alias Member\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* connect to the domain */ res1 = res ? samr_open_alias(smb_cli, fnum, &pol_dom, 0x000f001f, alias_rid, &alias_pol) : False; while (next_token(NULL, tmp, NULL, sizeof(tmp)) && res2 && res1) { /* get a sid, delete a member from the alias */ res2 = res2 ? string_to_sid(&member_sid, tmp) : False; res2 = res2 ? samr_del_aliasmem(smb_cli, fnum, &alias_pol, &member_sid) : False; if (res2) { report(out_hnd, "SID deleted from Alias 0x%x: %s\n", alias_rid, tmp); } } res1 = res1 ? samr_close(smb_cli, fnum, &alias_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1 && res2) { DEBUG(5,("cmd_sam_del_aliasmem: succeeded\n")); report(out_hnd, "Delete Domain Alias Member: OK\n"); } else { DEBUG(5,("cmd_sam_del_aliasmem: failed\n")); report(out_hnd, "Delete Domain Alias Member: FAILED\n"); } } /**************************************************************************** SAM delete alias. ****************************************************************************/ void cmd_sam_delete_dom_alias(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring name; fstring sid; DOM_SID sid1; POLICY_HND alias_pol; BOOL res = True; BOOL res1 = True; BOOL res2 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 alias_rid = 0; char *names[1]; uint32 rid [MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; uint32 num_rids; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, name, NULL, sizeof(name))) { report(out_hnd, "delalias \n"); return; } report(out_hnd, "SAM Delete Domain Alias\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; names[0] = name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x000003e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { alias_rid = rid[0]; } /* connect to the domain */ res1 = res1 ? samr_open_alias(smb_cli, fnum, &pol_dom, 0x000f001f, alias_rid, &alias_pol) : False; res2 = res1 ? samr_delete_dom_alias(smb_cli, fnum, &alias_pol) : False; res1 = res1 ? samr_close(smb_cli, fnum, &alias_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1 && res2) { DEBUG(5,("cmd_sam_delete_dom_alias: succeeded\n")); report(out_hnd, "Delete Domain Alias: OK\n"); } else { DEBUG(5,("cmd_sam_delete_dom_alias: failed\n")); report(out_hnd, "Delete Domain Alias: FAILED\n"); } } /**************************************************************************** SAM add alias member. ****************************************************************************/ void cmd_sam_add_aliasmem(struct client_info *info) { uint16 fnum; uint16 fnum_lsa; fstring srv_name; fstring domain; fstring tmp; fstring sid; DOM_SID sid1; POLICY_HND alias_pol; BOOL res = True; BOOL res1 = True; BOOL res2 = True; BOOL res3 = True; BOOL res4 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 alias_rid; char **names = NULL; int num_names = 0; DOM_SID *sids = NULL; int num_sids = 0; int i; POLICY_HND sam_pol; POLICY_HND pol_dom; POLICY_HND lsa_pol; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); while (next_token(NULL, tmp, NULL, sizeof(tmp))) { if (add_chars_to_array(&num_names, &names, tmp) == NULL) { return; } } if (num_names < 2) { report(out_hnd, "addaliasmem [member name1] [member name2] ...\n"); return; } report(out_hnd, "SAM Domain Alias Member\n"); /* open LSARPC session. */ res3 = res3 ? cli_nt_session_open(smb_cli, PIPE_LSARPC, &fnum_lsa) : False; /* lookup domain controller; receive a policy handle */ res3 = res3 ? lsa_open_policy(smb_cli, fnum_lsa, srv_name, &lsa_pol, True) : False; /* send lsa lookup sids call */ res4 = res3 ? lsa_lookup_names(smb_cli, fnum_lsa, &lsa_pol, num_names, names, &sids, NULL, &num_sids) : False; res3 = res3 ? lsa_close(smb_cli, fnum_lsa, &lsa_pol) : False; cli_nt_session_close(smb_cli, fnum_lsa); res4 = num_sids < 2 ? False : res4; if (res4) { /* * accept domain sid or builtin sid */ DOM_SID sid_1_5_20; string_to_sid(&sid_1_5_20, "S-1-5-32"); sid_split_rid(&sids[0], &alias_rid); if (sid_equal(&sids[0], &sid_1_5_20)) { sid_copy(&sid1, &sid_1_5_20); } else if (!sid_equal(&sids[0], &sid1)) { res4 = False; } } /* open SAMR session. negotiate credentials */ res = res4 ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* connect to the domain */ res1 = res ? samr_open_alias(smb_cli, fnum, &pol_dom, 0x000f001f, alias_rid, &alias_pol) : False; for (i = 1; i < num_sids && res2 && res1; i++) { /* add a member to the alias */ res2 = res2 ? samr_add_aliasmem(smb_cli, fnum, &alias_pol, &sids[i]) : False; if (res2) { sid_to_string(tmp, &sids[i]); report(out_hnd, "SID added to Alias 0x%x: %s\n", alias_rid, tmp); } } res1 = res1 ? samr_close(smb_cli, fnum, &alias_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (sids != NULL) { free(sids); } free_char_array(num_names, names); if (res && res1 && res2) { DEBUG(5,("cmd_sam_add_aliasmem: succeeded\n")); report(out_hnd, "Add Domain Alias Member: OK\n"); } else { DEBUG(5,("cmd_sam_add_aliasmem: failed\n")); report(out_hnd, "Add Domain Alias Member: FAILED\n"); } } /**************************************************************************** SAM create domain user. ****************************************************************************/ void cmd_sam_create_dom_user(struct client_info *info) { fstring domain; fstring acct_name; fstring sid; DOM_SID sid1; uint32 user_rid; uint16 acb_info; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, acct_name, NULL, sizeof(acct_name))) { report(out_hnd, "createuser: \n"); } if (acct_name[strlen(acct_name)-1] == '$') { acb_info = ACB_WSTRUST; } else { acb_info = ACB_NORMAL; } report(out_hnd, "SAM Create Domain User\n"); report(out_hnd, "Domain: %s Name: %s\n", domain, acct_name); if (msrpc_sam_create_dom_user(smb_cli, &sid1, acct_name, acb_info, &user_rid)) { report(out_hnd, "Create Domain User: OK\n"); } else { report(out_hnd, "Create Domain User: FAILED\n"); } } /**************************************************************************** SAM create domain alias. ****************************************************************************/ void cmd_sam_create_dom_alias(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring acct_name; fstring acct_desc; fstring sid; DOM_SID sid1; BOOL res = True; BOOL res1 = True; uint32 ace_perms = 0x02000000; /* permissions */ uint32 alias_rid; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, acct_name, NULL, sizeof(acct_name))) { report(out_hnd, "createalias: [acct description]\n"); } if (!next_token(NULL, acct_desc, NULL, sizeof(acct_desc))) { acct_desc[0] = 0; } report(out_hnd, "SAM Create Domain Alias\n"); report(out_hnd, "Domain: %s Name: %s Description: %s\n", domain, acct_name, acct_desc); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* create a domain alias */ res1 = res ? create_samr_domain_alias(smb_cli, fnum, &pol_dom, acct_name, acct_desc, &alias_rid) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1) { DEBUG(5,("cmd_sam_create_dom_alias: succeeded\n")); report(out_hnd, "Create Domain Alias: OK\n"); } else { DEBUG(5,("cmd_sam_create_dom_alias: failed\n")); report(out_hnd, "Create Domain Alias: FAILED\n"); } } /**************************************************************************** SAM delete group member. ****************************************************************************/ void cmd_sam_del_groupmem(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring tmp; fstring sid; DOM_SID sid1; POLICY_HND pol_grp; BOOL res = True; BOOL res1 = True; BOOL res2 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 member_rid; uint32 group_rid; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, tmp, NULL, sizeof(tmp))) { report(out_hnd, "delgroupmem: [member rid1] [member rid2] ...\n"); return; } group_rid = get_number(tmp); report(out_hnd, "SAM Add Domain Group member\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* connect to the domain */ res1 = res ? samr_open_group(smb_cli, fnum, &pol_dom, 0x0000001f, group_rid, &pol_grp) : False; while (next_token(NULL, tmp, NULL, sizeof(tmp)) && res2 && res1) { /* get a rid, delete a member from the group */ member_rid = get_number(tmp); res2 = res2 ? samr_del_groupmem(smb_cli, fnum, &pol_grp, member_rid) : False; if (res2) { report(out_hnd, "RID deleted from Group 0x%x: 0x%x\n", group_rid, member_rid); } } res1 = res1 ? samr_close(smb_cli, fnum, &pol_grp) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1 && res2) { DEBUG(5,("cmd_sam_del_groupmem: succeeded\n")); report(out_hnd, "Add Domain Group Member: OK\n"); } else { DEBUG(5,("cmd_sam_del_groupmem: failed\n")); report(out_hnd, "Add Domain Group Member: FAILED\n"); } } /**************************************************************************** SAM delete group. ****************************************************************************/ void cmd_sam_delete_dom_group(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring name; fstring sid; DOM_SID sid1; POLICY_HND pol_grp; BOOL res = True; BOOL res1 = True; BOOL res2 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 group_rid = 0; char *names[1]; uint32 rid [MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; uint32 num_rids; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, name, NULL, sizeof(name))) { report(out_hnd, "delgroup \n"); return; } report(out_hnd, "SAM Delete Domain Group\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; names[0] = name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x000003e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { group_rid = rid[0]; } /* connect to the domain */ res1 = res1 ? samr_open_group(smb_cli, fnum, &pol_dom, 0x0000001f, group_rid, &pol_grp) : False; res2 = res1 ? samr_delete_dom_group(smb_cli, fnum, &pol_grp) : False; res1 = res1 ? samr_close(smb_cli, fnum, &pol_grp) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1 && res2) { DEBUG(5,("cmd_sam_delete_dom_group: succeeded\n")); report(out_hnd, "Delete Domain Group: OK\n"); } else { DEBUG(5,("cmd_sam_delete_dom_group: failed\n")); report(out_hnd, "Delete Domain Group: FAILED\n"); } } /**************************************************************************** SAM add group member. ****************************************************************************/ void cmd_sam_add_groupmem(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring tmp; fstring sid; DOM_SID sid1; POLICY_HND pol_grp; BOOL res = True; BOOL res1 = True; BOOL res2 = True; BOOL res3 = True; BOOL res4 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 group_rid[1]; uint32 group_type[1]; char **names = NULL; uint32 num_names = 0; fstring group_name; char *group_names[1]; uint32 rid [MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; uint32 num_rids; uint32 num_group_rids; uint32 i; DOM_SID sid_1_5_20; POLICY_HND sam_pol; POLICY_HND pol_dom; POLICY_HND pol_blt; string_to_sid(&sid_1_5_20, "S-1-5-32"); sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); res = next_token(NULL, group_name, NULL, sizeof(group_name)); group_names[0] = group_name; while (res && next_token(NULL, tmp, NULL, sizeof(tmp))) { if (add_chars_to_array(&num_names, &names, tmp) == NULL) { return; } } if (num_names < 1) { report(out_hnd, "addgroupmem [member name1] [member name2] ...\n"); return; } report(out_hnd, "SAM Add Domain Group member\n"); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res4 = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* connect to the domain */ res3 = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid_1_5_20, &pol_blt) : False; res2 = res4 ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x000003e8, 1, group_names, &num_group_rids, group_rid, group_type) : False; /* open the group */ res2 = res2 ? samr_open_group(smb_cli, fnum, &pol_dom, 0x0000001f, group_rid[0], &pol_grp) : False; if (!res2 || (group_type != NULL && group_type[0] == SID_NAME_UNKNOWN)) { res2 = res3 ? samr_query_lookup_names(smb_cli, fnum, &pol_blt, 0x000003e8, 1, group_names, &num_group_rids, group_rid, group_type) : False; /* open the group */ res2 = res2 ? samr_open_group(smb_cli, fnum, &pol_blt, 0x0000001f, group_rid[0], &pol_grp) : False; } if (res2 && group_type[0] == SID_NAME_ALIAS) { report(out_hnd, "%s is a local alias, not a group. Use addaliasmem command instead\n", group_name); return; } res1 = res2 ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x000003e8, num_names, names, &num_rids, rid, type) : False; if (num_rids == 0) { report(out_hnd, "Member names not known\n"); } for (i = 0; i < num_rids && res2 && res1; i++) { if (type[i] == SID_NAME_UNKNOWN) { report(out_hnd, "Name %s unknown\n", names[i]); } else { if (samr_add_groupmem(smb_cli, fnum, &pol_grp, rid[i])) { report(out_hnd, "RID added to Group 0x%x: 0x%x\n", group_rid[0], rid[i]); } } } res1 = res ? samr_close(smb_cli, fnum, &pol_grp) : False; res1 = res3 ? samr_close(smb_cli, fnum, &pol_blt) : False; res1 = res4 ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); free_char_array(num_names, names); if (res && res1 && res2) { DEBUG(5,("cmd_sam_add_groupmem: succeeded\n")); report(out_hnd, "Add Domain Group Member: OK\n"); } else { DEBUG(5,("cmd_sam_add_groupmem: failed\n")); report(out_hnd, "Add Domain Group Member: FAILED\n"); } #if 0 if (group_rid != NULL) { free(group_rid); } if (group_type != NULL) { free(group_type); } #endif } /**************************************************************************** SAM create domain group. ****************************************************************************/ void cmd_sam_create_dom_group(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring acct_name; fstring acct_desc; fstring sid; DOM_SID sid1; BOOL res = True; BOOL res1 = True; uint32 ace_perms = 0x02000000; /* absolutely no idea. */ uint32 group_rid; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (!next_token(NULL, acct_name, NULL, sizeof(acct_name))) { report(out_hnd, "creategroup: [acct description]\n"); } if (!next_token(NULL, acct_desc, NULL, sizeof(acct_desc))) { acct_desc[0] = 0; } report(out_hnd, "SAM Create Domain Group\n"); report(out_hnd, "Domain: %s Name: %s Description: %s\n", domain, acct_name, acct_desc); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; /* read some users */ res1 = res ? create_samr_domain_group(smb_cli, fnum, &pol_dom, acct_name, acct_desc, &group_rid) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res && res1) { DEBUG(5,("cmd_sam_create_dom_group: succeeded\n")); report(out_hnd, "Create Domain Group: OK\n"); } else { DEBUG(5,("cmd_sam_create_dom_group: failed\n")); report(out_hnd, "Create Domain Group: FAILED\n"); } } /**************************************************************************** experimental SAM users enum. ****************************************************************************/ void cmd_sam_enum_users(struct client_info *info) { BOOL request_user_info = False; BOOL request_group_info = False; BOOL request_alias_info = False; fstring tmp; struct acct_info *sam = NULL; uint32 num_sam_entries = 0; int i; fstring srv_name; fstring domain; fstring sid; DOM_SID sid1; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); for (i = 0; i < 3; i++) { /* a bad way to do token parsing... */ if (next_token(NULL, tmp, NULL, sizeof(tmp))) { request_user_info |= strequal(tmp, "-u"); request_group_info |= strequal(tmp, "-g"); request_alias_info |= strequal(tmp, "-a"); } else { break; } } report(out_hnd, "SAM Enumerate Users\n"); msrpc_sam_enum_users(smb_cli, domain, &sid1, srv_name, &sam, &num_sam_entries, sam_display_user, request_user_info ? sam_display_user_info : NULL, request_group_info ? sam_display_group_members : NULL, request_alias_info ? sam_display_group_members : NULL); if (sam != NULL) { free(sam); } } /**************************************************************************** experimental SAM group query members. ****************************************************************************/ void cmd_sam_query_groupmem(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; fstring group_name; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, group_name, NULL, sizeof(group_name))) { report(out_hnd, "samgroup \n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Query Group: %s\n", group_name); report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid_str); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x304, &sid, &pol_dom) : False; /* look up group rid */ names[0] = group_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { res1 = req_groupmem_info(smb_cli, fnum, &pol_dom, domain, &sid, rid[0], names[0], sam_display_group_members); } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { DEBUG(5,("cmd_sam_query_group: succeeded\n")); } else { DEBUG(5,("cmd_sam_query_group: failed\n")); } } /**************************************************************************** experimental SAM group query. ****************************************************************************/ void cmd_sam_query_group(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; fstring group_name; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, group_name, NULL, sizeof(group_name))) { report(out_hnd, "samgroup \n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Query Group: %s\n", group_name); report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid_str); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x304, &sid, &pol_dom) : False; /* look up group rid */ names[0] = group_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { res1 = query_groupinfo(smb_cli, fnum, &pol_dom, domain, &sid, rid[0], sam_display_group_info); } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { DEBUG(5,("cmd_sam_query_group: succeeded\n")); } else { DEBUG(5,("cmd_sam_query_group: failed\n")); } } /**************************************************************************** experimental SAM user query. ****************************************************************************/ void cmd_sam_query_user(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; fstring user_name; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, user_name, NULL, sizeof(user_name))) { report(out_hnd, "samuser \n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Query User: %s\n", user_name); report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid_str); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x304, &sid, &pol_dom) : False; /* look up user rid */ names[0] = user_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; /* send user info query */ if (res1 && num_rids == 1) { res1 = req_user_info(smb_cli, fnum, &pol_dom, domain, &sid, rid[0], sam_display_user_info); } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { DEBUG(5,("cmd_sam_query_user: succeeded\n")); } else { DEBUG(5,("cmd_sam_query_user: failed\n")); } } /**************************************************************************** experimental SAM user set. ****************************************************************************/ void cmd_sam_set_userinfo2(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; uint32 argc = 0; char **argv = NULL; uint32 cp_argc = 0; char **cp_argv = NULL; extern int optind; int opt; BOOL set_acb_bits = False; fstring user_name; fstring tmp; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; SAM_USER_INFO_16 usr16; uint16 acb_set = 0x0; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } /* create arguments array */ while (next_token(NULL, tmp, NULL, sizeof(tmp))) { add_chars_to_array(&argc, &argv, tmp); } cp_argc = argc; cp_argv = argv; if (cp_argc < 2) { report(out_hnd, "samuserset2 [-s ]\n"); return; } safe_strcpy(user_name, cp_argv[0], sizeof(user_name)); cp_argc--; cp_argv++; optind = -1; while ((opt = getopt(cp_argc, cp_argv,"s:")) != EOF) { switch (opt) { case 's': { set_acb_bits = True; acb_set = get_number(optarg); break; } } } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Set User Info: %s\n", user_name); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x02000000, &sid, &pol_dom) : False; /* look up user rid */ names[0] = user_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; /* send set user info */ if (res1 && num_rids == 1 && get_samr_query_userinfo(smb_cli, fnum, &pol_dom, 0x10, rid[0], (void*)&usr16)) { void *usr = NULL; uint32 switch_value = 0; if (set_acb_bits) { usr16.acb_info |= acb_set; } if (True) { SAM_USER_INFO_16 *p = malloc(sizeof(SAM_USER_INFO_16)); p->acb_info = usr16.acb_info; usr = (void*)p; switch_value = 16; } if (usr != NULL) { res1 = set_samr_set_userinfo2(smb_cli, fnum, &pol_dom, switch_value, rid[0], usr); } } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { report(out_hnd, "Set User Info: OK\n"); DEBUG(5,("cmd_sam_query_user: succeeded\n")); } else { report(out_hnd, "Set User Info: Failed\n"); DEBUG(5,("cmd_sam_query_user: failed\n")); } free_char_array(argc, argv); } /**************************************************************************** experimental SAM user set. ****************************************************************************/ void cmd_sam_set_userinfo(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; uint32 argc = 0; char **argv = NULL; uint32 cp_argc = 0; char **cp_argv = NULL; extern int optind; int opt; BOOL set_passwd = False; fstring user_name; fstring password; fstring tmp; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; SAM_USER_INFO_21 usr21; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } /* create arguments array */ while (next_token(NULL, tmp, NULL, sizeof(tmp))) { add_chars_to_array(&argc, &argv, tmp); } cp_argc = argc; cp_argv = argv; if (cp_argc == 0) { report(out_hnd, "samuserset [-p password]\n"); return; } safe_strcpy(user_name, cp_argv[0], sizeof(user_name)); cp_argc--; cp_argv++; if (cp_argc == 0) { fstring pass_str; char *pass; slprintf(pass_str, sizeof(pass_str)-1, "Enter %s's Password:", user_name); pass = (char*)getpass(pass_str); if (pass != NULL) { safe_strcpy(password, pass, sizeof(password)-1); set_passwd = True; } } else { optind = -1; while ((opt = getopt(cp_argc, cp_argv,"p:")) != EOF) { switch (opt) { case 'p': { set_passwd = True; safe_strcpy(password, optarg, sizeof(password)-1); break; } } } } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Set User Info: %s\n", user_name); report(out_hnd, "Password: %s\n", password); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x02000000, &sid, &pol_dom) : False; /* look up user rid */ names[0] = user_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; /* send set user info */ if (res1 && num_rids == 1 && get_samr_query_userinfo(smb_cli, fnum, &pol_dom, 0x15, rid[0], &usr21)) { void *usr = NULL; uint32 switch_value = 0; char pwbuf[516]; if (set_passwd) { encode_pw_buffer(pwbuf, password, strlen(password), True); #ifdef DEBUG_PASSWORD dump_data(100, smb_cli->sess_key, 16); #endif SamOEMhash(pwbuf, smb_cli->sess_key, 1); } if (True) { SAM_USER_INFO_24 *p = malloc(sizeof(SAM_USER_INFO_24)); make_sam_user_info24(p, pwbuf); usr = p; switch_value = 24; } if (False) { SAM_USER_INFO_23 *p = malloc(sizeof(SAM_USER_INFO_23)); /* send user info query, level 0x15 */ make_sam_user_info23W(p, &usr21.logon_time, &usr21.logoff_time, &usr21.kickoff_time, &usr21.pass_last_set_time, &usr21.pass_can_change_time, &usr21.pass_must_change_time, &usr21.uni_user_name, &usr21.uni_full_name, &usr21.uni_home_dir, &usr21.uni_dir_drive, &usr21.uni_logon_script, &usr21.uni_profile_path, &usr21.uni_acct_desc, &usr21.uni_workstations, &usr21.uni_unknown_str, &usr21.uni_munged_dial, 0x0, usr21.group_rid, usr21.acb_info, 0x09f827fa, usr21.logon_divs, &usr21.logon_hrs, usr21.unknown_5, pwbuf, usr21.unknown_6); usr = p; switch_value = 23; } if (usr != NULL) { res1 = set_samr_set_userinfo(smb_cli, fnum, &pol_dom, switch_value, rid[0], usr); } } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { report(out_hnd, "Set User Info: OK\n"); DEBUG(5,("cmd_sam_query_user: succeeded\n")); } else { report(out_hnd, "Set User Info: Failed\n"); DEBUG(5,("cmd_sam_query_user: failed\n")); } free_char_array(argc, argv); } /**************************************************************************** experimental SAM query display info. ****************************************************************************/ void cmd_sam_query_dispinfo(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid; DOM_SID sid1; BOOL res = True; fstring info_str; uint16 switch_value = 1; uint32 ace_perms = 0x304; /* absolutely no idea. */ SAM_DISPINFO_CTR ctr; SAM_DISPINFO_1 inf1; uint32 num_entries; POLICY_HND sam_pol; POLICY_HND pol_dom; sid_to_string(sid, &info->dom.level5_sid); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } string_to_sid(&sid1, sid); fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); if (next_token(NULL, info_str, NULL, sizeof(info_str))) { switch_value = strtoul(info_str, (char**)NULL, 10); } fprintf(out_hnd, "SAM Query Domain Info: info level %d\n", switch_value); fprintf(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, ace_perms, &sid1, &pol_dom) : False; ctr.sam.info1 = &inf1; /* send a samr query_disp_info command */ res = res ? samr_query_dispinfo(smb_cli, fnum, &pol_dom, switch_value, &num_entries, &ctr) : False; res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res) { DEBUG(5,("cmd_sam_query_dispinfo: succeeded\n")); #if 0 display_sam_disp_info_ctr(out_hnd, ACTION_HEADER , switch_value, &ctr); display_sam_disp_info_ctr(out_hnd, ACTION_ENUMERATE, switch_value, &ctr); display_sam_disp_info_ctr(out_hnd, ACTION_FOOTER , switch_value, &ctr); #endif } else { DEBUG(5,("cmd_sam_query_dispinfo: failed\n")); } } /**************************************************************************** experimental SAM domain info query. ****************************************************************************/ void cmd_sam_query_dominfo(struct client_info *info) { fstring domain; fstring sid; DOM_SID sid1; fstring info_str; uint32 switch_value = 2; SAM_UNK_CTR ctr; sid_to_string(sid, &info->dom.level5_sid); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } string_to_sid(&sid1, sid); if (next_token(NULL, info_str, NULL, sizeof(info_str))) { switch_value = strtoul(info_str, (char**)NULL, 10); } report(out_hnd, "SAM Query Domain Info: info level %d\n", switch_value); report(out_hnd, "From: %s Domain: %s SID: %s\n", info->myhostname, domain, sid); if (sam_query_dominfo(smb_cli, &sid1, switch_value, &ctr)) { DEBUG(5,("cmd_sam_query_dominfo: succeeded\n")); display_sam_unk_ctr(out_hnd, ACTION_HEADER , switch_value, &ctr); display_sam_unk_ctr(out_hnd, ACTION_ENUMERATE, switch_value, &ctr); display_sam_unk_ctr(out_hnd, ACTION_FOOTER , switch_value, &ctr); } else { DEBUG(5,("cmd_sam_query_dominfo: failed\n")); } } /**************************************************************************** experimental SAM alias query members. ****************************************************************************/ void cmd_sam_query_aliasmem(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; fstring alias_name; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, alias_name, NULL, sizeof(alias_name))) { report(out_hnd, "samalias \n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Query Alias: %s\n", alias_name); report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid_str); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x304, &sid, &pol_dom) : False; /* look up alias rid */ names[0] = alias_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { res1 = req_aliasmem_info(smb_cli, fnum, &pol_dom, domain, &sid, rid[0], names[0], sam_display_alias_members); } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { DEBUG(5,("cmd_sam_query_alias: succeeded\n")); } else { DEBUG(5,("cmd_sam_query_alias: failed\n")); } } /**************************************************************************** experimental SAM alias query. ****************************************************************************/ void cmd_sam_query_alias(struct client_info *info) { uint16 fnum; fstring srv_name; fstring domain; fstring sid_str; DOM_SID sid; BOOL res = True; BOOL res1 = True; fstring alias_name; char *names[1]; uint32 num_rids; uint32 rid[MAX_LOOKUP_SIDS]; uint32 type[MAX_LOOKUP_SIDS]; POLICY_HND sam_pol; POLICY_HND pol_dom; fstrcpy(domain, info->dom.level5_dom); sid_copy(&sid, &info->dom.level5_sid); if (sid.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } if (!next_token(NULL, alias_name, NULL, sizeof(alias_name))) { report(out_hnd, "samalias \n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); sid_to_string(sid_str, &sid); report(out_hnd, "SAM Query Alias: %s\n", alias_name); report(out_hnd, "From: %s To: %s Domain: %s SID: %s\n", info->myhostname, srv_name, domain, sid_str); /* open SAMR session. negotiate credentials */ res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR, &fnum) : False; /* establish a connection. */ res = res ? samr_connect(smb_cli, fnum, srv_name, 0x02000000, &sam_pol) : False; /* connect to the domain */ res = res ? samr_open_domain(smb_cli, fnum, &sam_pol, 0x304, &sid, &pol_dom) : False; /* look up alias rid */ names[0] = alias_name; res1 = res ? samr_query_lookup_names(smb_cli, fnum, &pol_dom, 0x3e8, 1, names, &num_rids, rid, type) : False; if (res1 && num_rids == 1) { res1 = query_aliasinfo(smb_cli, fnum, &pol_dom, domain, &sid, rid[0], sam_display_alias_info); } res = res ? samr_close(smb_cli, fnum, &sam_pol) : False; res = res ? samr_close(smb_cli, fnum, &pol_dom) : False; /* close the session */ cli_nt_session_close(smb_cli, fnum); if (res1) { DEBUG(5,("cmd_sam_query_alias: succeeded\n")); } else { DEBUG(5,("cmd_sam_query_alias: failed\n")); } } /**************************************************************************** SAM aliases query. ****************************************************************************/ void cmd_sam_enum_aliases(struct client_info *info) { BOOL request_member_info = False; BOOL request_alias_info = False; fstring tmp; int i; struct acct_info *sam = NULL; uint32 num_sam_entries = 0; fstring domain; fstring srv_name; fstring sid; DOM_SID sid1; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); for (i = 0; i < 2; i++) { /* a bad way to do token parsing... */ if (next_token(NULL, tmp, NULL, sizeof(tmp))) { request_member_info |= strequal(tmp, "-m"); request_alias_info |= strequal(tmp, "-a"); } else { break; } } report(out_hnd, "SAM Enumerate Aliases\n"); msrpc_sam_enum_aliases(smb_cli, domain, &sid1, srv_name, &sam, &num_sam_entries, sam_display_alias, request_alias_info ? sam_display_alias_info : NULL, request_member_info ? sam_display_alias_members : NULL); if (sam != NULL) { free(sam); } } /**************************************************************************** experimental SAM groups enum. ****************************************************************************/ void cmd_sam_enum_groups(struct client_info *info) { BOOL request_member_info = False; BOOL request_group_info = False; fstring tmp; int i; struct acct_info *sam = NULL; uint32 num_sam_entries = 0; fstring srv_name; fstring domain; fstring sid; DOM_SID sid1; sid_copy(&sid1, &info->dom.level5_sid); sid_to_string(sid, &sid1); fstrcpy(domain, info->dom.level5_dom); if (sid1.num_auths == 0) { report(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n"); return; } fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); for (i = 0; i < 3; i++) { /* a bad way to do token parsing... */ if (next_token(NULL, tmp, NULL, sizeof(tmp))) { request_member_info |= strequal(tmp, "-m"); request_group_info |= strequal(tmp, "-g"); } else { break; } } report(out_hnd, "SAM Enumerate Groups\n"); msrpc_sam_enum_groups(smb_cli, domain, &sid1, srv_name, &sam, &num_sam_entries, sam_display_group, request_group_info ? sam_display_group_info : NULL, request_member_info ? sam_display_group_members : NULL); if (sam != NULL) { free(sam); } } /**************************************************************************** experimental SAM domains enum. ****************************************************************************/ void cmd_sam_enum_domains(struct client_info *info) { BOOL request_domain_info = False; fstring tmp; int i; struct acct_info *sam = NULL; uint32 num_sam_entries = 0; fstring srv_name; fstrcpy(srv_name, "\\\\"); fstrcat(srv_name, info->dest_host); strupper(srv_name); for (i = 0; i < 3; i++) { /* a bad way to do token parsing... */ if (next_token(NULL, tmp, NULL, sizeof(tmp))) { request_domain_info |= strequal(tmp, "-i"); } else { break; } } report(out_hnd, "SAM Enumerate Domains\n"); msrpc_sam_enum_domains(smb_cli, srv_name, &sam, &num_sam_entries, sam_display_domain); if (sam != NULL) { free(sam); } }