summaryrefslogtreecommitdiff
path: root/source4/scripting/devel/repl_cleartext_pwd.py
blob: ac650d95d0ba0b1d4b6bad96ee4046f5972936fd (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
#!/usr/bin/env python
#
# Copyright Stefan Metzmacher 2011-2012
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
# This is useful to sync passwords from an AD domain.
#
#  $
#  $ source4/scripting/devel/repl_cleartext_pwd.py \
#  	-Uadministrator%A1b2C3d4 \
#  	172.31.9.219 DC=bla,DC=base /tmp/cookie cleartext_utf8 131085 displayName
#  # starting at usn[0]
#  dn: CN=Test User1,CN=Users,DC=bla,DC=base
#  cleartext_utf8: A1b2C3d4
#  displayName:: VABlAHMAdAAgAFUAcwBlAHIAMQA=
#
#  # up to usn[16449]
#  $
#  $ source4/scripting/devel/repl_cleartext_pwd.py \
#  	-Uadministrator%A1b2C3d4
#  	172.31.9.219 DC=bla,DC=base cookie_file cleartext_utf8 131085 displayName
#  # starting at usn[16449]
#  # up to usn[16449]
#  $
#

import sys

# Find right direction when running from source tree
sys.path.insert(0, "bin/python")

import samba.getopt as options
from optparse import OptionParser

from samba.dcerpc import drsuapi, drsblobs, misc
from samba.ndr import ndr_pack, ndr_unpack, ndr_print

import binascii
import hashlib
import Crypto.Cipher.ARC4
import struct
import os

from ldif import LDIFWriter

class globals:
    def __init__(self):
        self.global_objs = {}
        self.ldif = LDIFWriter(sys.stdout)

    def add_attr(self, dn, attname, vals):
        if dn not in self.global_objs:
           self.global_objs[dn] = {}
        self.global_objs[dn][attname] = vals

    def print_all(self):
        for dn, obj in self.global_objs.items():
           self.ldif.unparse(dn, obj)
           continue
        self.global_objs = {}

########### main code ###########
if __name__ == "__main__":
    parser = OptionParser("repl_cleartext_pwd.py [options] server dn cookie_file cleartext_name [attid attname]")
    sambaopts = options.SambaOptions(parser)
    credopts = options.CredentialsOptions(parser)
    parser.add_option_group(credopts)

    (opts, args) = parser.parse_args()

    if len(args) < 4 or len(args) == 5:
        parser.error("more arguments required")

    server = args[0]
    dn = args[1]
    cookie_file = args[2]
    if len(cookie_file) == 0:
        cookie_file = None
    cleartext_name = args[3]
    if len(args) >= 5:
        attid = int(args[4])
        attname = args[5]
    else:
        attid = -1
        attname = None

    lp = sambaopts.get_loadparm()
    creds = credopts.get_credentials(lp)

    if not creds.authentication_requested():
        parser.error("You must supply credentials")

    gls = globals()
    try:
       f = open(cookie_file, 'r')
       store_blob = f.read()
       f.close()

       store_hdr = store_blob[0:28]
       (store_version, \
        store_dn_len, store_dn_ofs, \
        store_hwm_len, store_hwm_ofs, \
        store_utdv_len, store_utdv_ofs) = \
        struct.unpack("<LLLLLLL", store_hdr)

       store_dn = store_blob[store_dn_ofs:store_dn_ofs+store_dn_len]
       store_hwm_blob = store_blob[store_hwm_ofs:store_hwm_ofs+store_hwm_len]
       store_utdv_blob = store_blob[store_utdv_ofs:store_utdv_ofs+store_utdv_len]

       store_hwm = ndr_unpack(drsuapi.DsReplicaHighWaterMark, store_hwm_blob)
       store_utdv = ndr_unpack(drsblobs.replUpToDateVectorBlob, store_utdv_blob)

       assert store_dn == dn
       #print "%s" % ndr_print(store_hwm)
       #print "%s" % ndr_print(store_utdv)
    except:
       store_dn = dn
       store_hwm = drsuapi.DsReplicaHighWaterMark()
       store_hwm.tmp_highest_usn  = 0
       store_hwm.reserved_usn     = 0
       store_hwm.highest_usn      = 0
       store_utdv = None

    binding_str = "ncacn_ip_tcp:%s[spnego,seal]" % server

    drs_conn = drsuapi.drsuapi(binding_str, lp, creds)

    bind_info = drsuapi.DsBindInfoCtr()
    bind_info.length = 28
    bind_info.info = drsuapi.DsBindInfo28()
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7
    bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT
    (info, drs_handle) = drs_conn.DsBind(misc.GUID(drsuapi.DRSUAPI_DS_BIND_GUID), bind_info)

    null_guid = misc.GUID()

    naming_context = drsuapi.DsReplicaObjectIdentifier()
    naming_context.dn              = dn
    highwatermark                  = store_hwm
    uptodateness_vector            = None
    if store_utdv is not None:
        uptodateness_vector = drsuapi.DsReplicaCursorCtrEx()
        if store_utdv.version == 1:
            uptodateness_vector.cursors = store_utdv.cursors
        elif store_utdv.version == 2:
            cursors = []
            for i in range(0, store_utdv.ctr.count):
                cursor = drsuapi.DsReplicaCursor()
                cursor.source_dsa_invocation_id = store_utdv.ctr.cursors[i].source_dsa_invocation_id
                cursor.highest_usn = store_utdv.ctr.cursors[i].highest_usn
                cursors.append(cursor)
            uptodateness_vector.cursors = cursors

    req8 = drsuapi.DsGetNCChangesRequest8()

    req8.destination_dsa_guid           = null_guid
    req8.source_dsa_invocation_id       = null_guid
    req8.naming_context                 = naming_context
    req8.highwatermark                  = highwatermark
    req8.uptodateness_vector            = uptodateness_vector
    req8.replica_flags                  = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
                                           drsuapi.DRSUAPI_DRS_PER_SYNC |
                                           drsuapi.DRSUAPI_DRS_GET_ANC |
                                           drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
                                           drsuapi.DRSUAPI_DRS_WRIT_REP)
    req8.max_object_count = 402
    req8.max_ndr_size = 402116
    req8.extended_op = 0
    req8.fsmo_info = 0
    req8.partial_attribute_set = None
    req8.partial_attribute_set_ex = None
    req8.mapping_ctr.num_mappings = 0
    req8.mapping_ctr.mappings = None

    user_session_key = drs_conn.user_session_key

    print "# starting at usn[%d]" % (highwatermark.highest_usn)

    while True:
        (level, ctr) = drs_conn.DsGetNCChanges(drs_handle, 8, req8)
        if ctr.first_object == None and ctr.object_count != 0:
            raise RuntimeError("DsGetNCChanges: NULL first_object with object_count=%u" % (ctr.object_count))

        obj_item = ctr.first_object
        while obj_item is not None:
            obj = obj_item.object

            if obj.identifier is None:
                obj_item = obj_item.next_object
                continue

            #print '%s' % obj.identifier.dn

            is_deleted = False
            for i in range(0, obj.attribute_ctr.num_attributes):
                attr = obj.attribute_ctr.attributes[i]
                if attr.attid == drsuapi.DRSUAPI_ATTID_isDeleted:
                    is_deleted = True
            if is_deleted:
                obj_item = obj_item.next_object
                continue

            spl_crypt = None
            attvals = None
            for i in range(0, obj.attribute_ctr.num_attributes):
                attr = obj.attribute_ctr.attributes[i]
                if attr.attid == attid:
                    attvals = []
                    for j in range(0, attr.value_ctr.num_values):
                        assert attr.value_ctr.values[j].blob is not None
                        attvals.append(attr.value_ctr.values[j].blob)
                if attr.attid != drsuapi.DRSUAPI_ATTID_supplementalCredentials:
                    continue
                assert attr.value_ctr.num_values <= 1
                if attr.value_ctr.num_values == 0:
                    break
                assert attr.value_ctr.values[0].blob is not None
                spl_crypt = attr.value_ctr.values[0].blob
                break

            if spl_crypt is None:
                obj_item = obj_item.next_object
                continue

            assert len(spl_crypt) >= 20
            confounder = spl_crypt[0:16]
            enc_buffer = spl_crypt[16:]

            m5 = hashlib.md5()
            m5.update(user_session_key)
            m5.update(confounder)
            enc_key = m5.digest()

            rc4 = Crypto.Cipher.ARC4.new(enc_key)
            plain_buffer = rc4.decrypt(enc_buffer)

            (crc32_v) = struct.unpack("<L", plain_buffer[0:4])
            attr_val = plain_buffer[4:]
            crc32_c = binascii.crc32(attr_val) & 0xffffffff
            assert int(crc32_v[0]) == int(crc32_c), "CRC32 0x%08X != 0x%08X" % (crc32_v[0], crc32_c)

            spl = ndr_unpack(drsblobs.supplementalCredentialsBlob, attr_val)

            #print '%s' % ndr_print(spl)

            cleartext_hex = None

            for i in range(0, spl.sub.num_packages):
                pkg = spl.sub.packages[i]
                if pkg.name != "Primary:CLEARTEXT":
                    continue
                cleartext_hex = pkg.data

            if cleartext_hex is not None:
                cleartext_utf16 = binascii.a2b_hex(cleartext_hex)
                cleartext_unicode = unicode(cleartext_utf16, 'utf-16-le')
                cleartext_utf8 = cleartext_unicode.encode('utf-8')

                gls.add_attr(obj.identifier.dn, cleartext_name, [cleartext_utf8])

                if attvals is not None:
                    gls.add_attr(obj.identifier.dn, attname, attvals)

            krb5_old_hex = None

            for i in range(0, spl.sub.num_packages):
                pkg = spl.sub.packages[i]
                if pkg.name != "Primary:Kerberos":
                    continue
                krb5_old_hex = pkg.data

            if krb5_old_hex is not None:
                krb5_old_raw = binascii.a2b_hex(krb5_old_hex)
                krb5_old = ndr_unpack(drsblobs.package_PrimaryKerberosBlob, krb5_old_raw, allow_remaining=True)

                #print '%s' % ndr_print(krb5_old)

            krb5_new_hex = None

            for i in range(0, spl.sub.num_packages):
                pkg = spl.sub.packages[i]
                if pkg.name != "Primary:Kerberos-Newer-Keys":
                    continue
                krb5_new_hex = pkg.data

            if krb5_new_hex is not None:
                krb5_new_raw = binascii.a2b_hex(krb5_new_hex)
                krb5_new = ndr_unpack(drsblobs.package_PrimaryKerberosBlob, krb5_new_raw, allow_remaining=True)

                #print '%s' % ndr_print(krb5_new)

            obj_item = obj_item.next_object

        gls.print_all()

        if ctr.more_data == 0:
            store_hwm = ctr.new_highwatermark

            store_utdv = drsblobs.replUpToDateVectorBlob()
            store_utdv.version = ctr.uptodateness_vector.version
            store_utdv_ctr = store_utdv.ctr
            store_utdv_ctr.count = ctr.uptodateness_vector.count
            store_utdv_ctr.cursors = ctr.uptodateness_vector.cursors
            store_utdv.ctr = store_utdv_ctr

            #print "%s" % ndr_print(store_hwm)
            #print "%s" % ndr_print(store_utdv)

            store_hwm_blob = ndr_pack(store_hwm)
            store_utdv_blob = ndr_pack(store_utdv)

            #
            # uint32_t version '1'
            # uint32_t dn_str_len
            # uint32_t dn_str_ofs
            # uint32_t hwm_blob_len
            # uint32_t hwm_blob_ofs
            # uint32_t utdv_blob_len
            # uint32_t utdv_blob_ofs
            store_hdr_len = 7 * 4
            dn_ofs = store_hdr_len
            hwm_ofs = dn_ofs + len(dn)
            utdv_ofs = hwm_ofs + len(store_hwm_blob)
            store_blob = struct.pack("<LLLLLLL", 1, \
                                     len(dn), dn_ofs,
                                     len(store_hwm_blob), hwm_ofs, \
                                     len(store_utdv_blob), utdv_ofs) + \
                                     dn + store_hwm_blob + store_utdv_blob

            tmp_file = "%s.tmp" % cookie_file
            f = open(tmp_file, 'wb')
            f.write(store_blob)
            f.close()
            os.rename(tmp_file, cookie_file)

            print "# up to usn[%d]" % (ctr.new_highwatermark.highest_usn)
            break
        print "# up to tmp_usn[%d]" % (ctr.new_highwatermark.highest_usn)
        req8.highwatermark.tmp_highest_usn = ctr.new_highwatermark.tmp_highest_usn