1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
/*
samr rpc utility functions
*/
/*
helper function to setup a rpc io object, ready for input
*/
function irpcObj()
{
var o = new Object();
o.input = new Object();
return o;
}
/*
check that a status result is OK
*/
function check_status_ok(status)
{
if (status.is_ok != true) {
printVars(status);
}
assert(status.is_ok == true);
}
/*
return a list of names and indexes from a samArray
*/
function samArray(output)
{
var list = new Array(output.num_entries);
if (output.sam == NULL) {
return list;
}
var entries = output.sam.entries;
for (i=0;i<output.num_entries;i++) {
list[i] = new Object();
list[i].name = entries[i].name;
list[i].idx = entries[i].idx;
}
return list;
}
/*
connect to the sam database
*/
function samrConnect(conn)
{
var io = irpcObj();
io.input.system_name = NULL;
io.input.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
status = dcerpc_samr_Connect(conn, io);
check_status_ok(status);
return io.output.connect_handle;
}
/*
close a handle
*/
function samrClose(conn, handle)
{
var io = irpcObj();
io.input.handle = handle;
status = dcerpc_samr_Close(conn, io);
check_status_ok(status);
}
/*
get the sid for a domain
*/
function samrLookupDomain(conn, handle, domain)
{
var io = irpcObj();
io.input.connect_handle = handle;
io.input.domain_name = domain;
status = dcerpc_samr_LookupDomain(conn, io);
check_status_ok(status);
return io.output.sid;
}
/*
open a domain by sid
*/
function samrOpenDomain(conn, handle, sid)
{
var io = irpcObj();
io.input.connect_handle = handle;
io.input.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
io.input.sid = sid;
status = dcerpc_samr_OpenDomain(conn, io);
check_status_ok(status);
return io.output.domain_handle;
}
/*
open a user by rid
*/
function samrOpenUser(conn, handle, rid)
{
var io = irpcObj();
io.input.domain_handle = handle;
io.input.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
io.input.rid = rid;
status = dcerpc_samr_OpenUser(conn, io);
check_status_ok(status);
return io.output.user_handle;
}
/*
return a list of all users
*/
function samrEnumDomainUsers(conn, dom_handle)
{
var io = irpcObj();
io.input.domain_handle = dom_handle;
io.input.resume_handle = 0;
io.input.acct_flags = 0;
io.input.max_size = -1;
status = dcerpc_samr_EnumDomainUsers(conn, io);
check_status_ok(status);
return samArray(io.output);
}
/*
return a list of domains
*/
function samrEnumDomains(conn, handle)
{
var io = irpcObj();
io.input.connect_handle = handle;
io.input.resume_handle = 0;
io.input.buf_size = -1;
status = dcerpc_samr_EnumDomains(conn, io);
check_status_ok(status);
return samArray(io.output);
}
/*
return information about a user
*/
function samrQueryUserInfo(conn, user_handle, level)
{
var r, io = irpcObj();
io.input.user_handle = user_handle;
io.input.level = level;
status = dcerpc_samr_QueryUserInfo(conn, io);
check_status_ok(status);
return io.output.info.info3;
}
/*
fill a user array with user information from samrQueryUserInfo
*/
function samrFillUserInfo(conn, dom_handle, users, level)
{
var i;
for (i=0;i<users.length;i++) {
var r, user_handle, info;
user_handle = samrOpenUser(conn, dom_handle, users[i].idx);
info = samrQueryUserInfo(conn, user_handle, level);
info.name = users[i].name;
info.idx = users[i].idx;
users[i] = info;
samrClose(conn, user_handle);
}
}
|
