?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbtorture: Directory Leases vs overwrite
[samba4-gss.git] / source4 / libnet / libnet_passwd.c
blobae41752b3d643e060e7b0b04f5ffae3f064c32b3
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23 #include "libcli/auth/libcli_auth.h"
24 #include "librpc/gen_ndr/ndr_samr_c.h"
25 #include "source4/librpc/rpc/dcerpc.h"
26 #include "auth/credentials/credentials.h"
27 #include "libcli/smb/smb_constants.h"
28 #include "librpc/rpc/dcerpc_samr.h"
29 #include "source3/rpc_client/init_samr.h"
30 #include "lib/param/loadparm.h"
31 #include "lib/param/param.h"
32
33 #include "lib/crypto/gnutls_helpers.h"
34 #include <gnutls/gnutls.h>
35 #include <gnutls/crypto.h>
36
37 static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
38 struct dcerpc_binding_handle *h,
39 struct lsa_String *server,
40 struct lsa_String *account,
41 const char *old_password,
42 const char *new_password,
43 const char **error_string)
44 {
45 struct samr_ChangePasswordUser4 r;
46 uint8_t old_nt_key_data[16] = {0};
47 gnutls_datum_t old_nt_key = {
48 .data = old_nt_key_data,
49 .size = sizeof(old_nt_key_data),
50 };
51 uint8_t cek_data[16] = {0};
52 DATA_BLOB cek = {
53 .data = cek_data,
54 .length = sizeof(cek_data),
55 };
56 struct samr_EncryptedPasswordAES pwd_buf = {
57 .cipher_len = 0
58 };
59 DATA_BLOB salt = {
60 .data = pwd_buf.salt,
61 .length = sizeof(pwd_buf.salt),
62 };
63 gnutls_datum_t salt_datum = {
64 .data = pwd_buf.salt,
65 .size = sizeof(pwd_buf.salt),
66 };
67 uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000);
68 NTSTATUS status;
69 int rc;
70
71 E_md4hash(old_password, old_nt_key_data);
72
73 generate_nonce_buffer(salt.data, salt.length);
74
75 rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
76 &old_nt_key,
77 &salt_datum,
78 pbkdf2_iterations,
79 cek.data,
80 cek.length);
81 BURN_DATA(old_nt_key_data);
82 if (rc < 0) {
83 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
84 if (!NT_STATUS_IS_OK(status)) {
85 goto done;
86 }
87 }
88
89 status = init_samr_CryptPasswordAES(mem_ctx,
90 new_password,
91 &salt,
92 &cek,
93 &pwd_buf);
94 data_blob_clear(&cek);
95 if (!NT_STATUS_IS_OK(status)) {
96 goto done;
97 }
98
99 pwd_buf.PBKDF2Iterations = pbkdf2_iterations;
100
101 r.in.server = server;
102 r.in.account = account;
103 r.in.password = &pwd_buf;
104
105 status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r);
106 if (!NT_STATUS_IS_OK(status)) {
107 goto done;
108 }
109 if (!NT_STATUS_IS_OK(r.out.result)) {
110 status = r.out.result;
111 *error_string = talloc_asprintf(mem_ctx,
112 "samr_ChangePasswordUser4 for "
113 "'%s\\%s' failed: %s",
114 server->string,
115 account->string,
116 nt_errstr(status));
117 goto done;
118 }
119
120 done:
121 BURN_DATA(pwd_buf);
122
123 return status;
124 }
125
126 static NTSTATUS libnet_ChangePassword_samr_rc4(TALLOC_CTX *mem_ctx,
127 struct dcerpc_binding_handle *h,
128 struct lsa_String *server,
129 struct lsa_String *account,
130 const char *old_password,
131 const char *new_password,
132 const char **error_string)
133 {
134 struct samr_OemChangePasswordUser2 oe2;
135 struct samr_ChangePasswordUser2 pw2;
136 struct samr_ChangePasswordUser3 pw3;
137 struct samr_CryptPassword nt_pass, lm_pass;
138 uint8_t old_nt_hash[16], new_nt_hash[16];
139 uint8_t old_lm_hash[16], new_lm_hash[16];
140 struct samr_Password nt_verifier, lm_verifier;
141 struct lsa_AsciiString a_server, a_account;
142 gnutls_cipher_hd_t cipher_hnd = NULL;
143 gnutls_datum_t nt_session_key = {
144 .data = old_nt_hash,
145 .size = sizeof(old_nt_hash),
146 };
147 gnutls_datum_t lm_session_key = {
148 .data = old_lm_hash,
149 .size = sizeof(old_lm_hash),
150 };
151 struct samr_DomInfo1 *dominfo = NULL;
152 struct userPwdChangeFailureInformation *reject = NULL;
153 NTSTATUS status;
154 int rc;
155
156 E_md4hash(old_password, old_nt_hash);
157 E_md4hash(new_password, new_nt_hash);
158
159 E_deshash(old_password, old_lm_hash);
160 E_deshash(new_password, new_lm_hash);
161
162 /* prepare samr_ChangePasswordUser3 */
163 encode_pw_buffer(lm_pass.data, new_password, STR_UNICODE);
164
165 rc = gnutls_cipher_init(&cipher_hnd,
166 GNUTLS_CIPHER_ARCFOUR_128,
167 &nt_session_key,
168 NULL);
169 if (rc < 0) {
170 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
171 goto done;
172 }
173
174 rc = gnutls_cipher_encrypt(cipher_hnd,
175 lm_pass.data,
176 516);
177 gnutls_cipher_deinit(cipher_hnd);
178 if (rc < 0) {
179 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
180 goto done;
181 }
182
183 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
184 if (rc != 0) {
185 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
186 goto done;
187 }
188
189 encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE);
190
191 rc = gnutls_cipher_init(&cipher_hnd,
192 GNUTLS_CIPHER_ARCFOUR_128,
193 &nt_session_key,
194 NULL);
195 if (rc < 0) {
196 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
197 goto done;
198 }
199
200 rc = gnutls_cipher_encrypt(cipher_hnd,
201 nt_pass.data,
202 516);
203 gnutls_cipher_deinit(cipher_hnd);
204 if (rc < 0) {
205 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
206 goto done;
207 }
208
209 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
210 if (rc != 0) {
211 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
212 goto done;
213 }
214
215 pw3.in.server = server;
216 pw3.in.account = account;
217 pw3.in.nt_password = &nt_pass;
218 pw3.in.nt_verifier = &nt_verifier;
219 pw3.in.lm_change = 1;
220 pw3.in.lm_password = &lm_pass;
221 pw3.in.lm_verifier = &lm_verifier;
222 pw3.in.password3 = NULL;
223 pw3.out.dominfo = &dominfo;
224 pw3.out.reject = &reject;
225
226 /* 2. try samr_ChangePasswordUser3 */
227 status = dcerpc_samr_ChangePasswordUser3_r(h, mem_ctx, &pw3);
228 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
229 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw3.out.result)) {
230 status = pw3.out.result;
231 }
232 if (!NT_STATUS_IS_OK(status)) {
233 *error_string = talloc_asprintf(
234 mem_ctx,
235 "samr_ChangePasswordUser3 failed: %s",
236 nt_errstr(status));
237 *error_string =
238 talloc_asprintf(mem_ctx,
239 "samr_ChangePasswordUser3 for "
240 "'%s\\%s' failed: %s",
241 server->string,
242 account->string,
243 nt_errstr(status));
244 }
245 goto done;
246 }
247
248 /* prepare samr_ChangePasswordUser2 */
249 encode_pw_buffer(lm_pass.data, new_password, STR_ASCII | STR_TERMINATE);
250
251 rc = gnutls_cipher_init(&cipher_hnd,
252 GNUTLS_CIPHER_ARCFOUR_128,
253 &lm_session_key,
254 NULL);
255 if (rc < 0) {
256 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
257 goto done;
258 }
259
260 rc = gnutls_cipher_encrypt(cipher_hnd,
261 lm_pass.data,
262 516);
263 gnutls_cipher_deinit(cipher_hnd);
264 if (rc < 0) {
265 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
266 goto done;
267 }
268
269 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
270 if (rc != 0) {
271 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
272 goto done;
273 }
274
275 encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE);
276
277 rc = gnutls_cipher_init(&cipher_hnd,
278 GNUTLS_CIPHER_ARCFOUR_128,
279 &nt_session_key,
280 NULL);
281 if (rc < 0) {
282 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
283 goto done;
284 }
285 rc = gnutls_cipher_encrypt(cipher_hnd,
286 nt_pass.data,
287 516);
288 gnutls_cipher_deinit(cipher_hnd);
289 if (rc < 0) {
290 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
291 goto done;
292 }
293
294 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
295 if (rc != 0) {
296 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
297 goto done;
298 }
299
300 pw2.in.server = server;
301 pw2.in.account = account;
302 pw2.in.nt_password = &nt_pass;
303 pw2.in.nt_verifier = &nt_verifier;
304 pw2.in.lm_change = 1;
305 pw2.in.lm_password = &lm_pass;
306 pw2.in.lm_verifier = &lm_verifier;
307
308 /* 3. try samr_ChangePasswordUser2 */
309 status = dcerpc_samr_ChangePasswordUser2_r(h, mem_ctx, &pw2);
310 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
311 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw2.out.result)) {
312 status = pw2.out.result;
313 }
314 if (!NT_STATUS_IS_OK(status)) {
315 *error_string =
316 talloc_asprintf(mem_ctx,
317 "samr_ChangePasswordUser2 for "
318 "'%s\\%s' failed: %s",
319 server->string,
320 account->string,
321 nt_errstr(status));
322 }
323 goto done;
324 }
325
326
327 /* prepare samr_OemChangePasswordUser2 */
328 a_server.string = server->string;
329 a_account.string = account->string;
330
331 encode_pw_buffer(lm_pass.data, new_password, STR_ASCII);
332
333 rc = gnutls_cipher_init(&cipher_hnd,
334 GNUTLS_CIPHER_ARCFOUR_128,
335 &lm_session_key,
336 NULL);
337 if (rc < 0) {
338 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
339 goto done;
340 }
341
342 rc = gnutls_cipher_encrypt(cipher_hnd,
343 lm_pass.data,
344 516);
345 gnutls_cipher_deinit(cipher_hnd);
346 if (rc < 0) {
347 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
348 goto done;
349 }
350
351 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
352 if (rc != 0) {
353 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
354 goto done;
355 }
356
357 oe2.in.server = &a_server;
358 oe2.in.account = &a_account;
359 oe2.in.password = &lm_pass;
360 oe2.in.hash = &lm_verifier;
361
362 /* 4. try samr_OemChangePasswordUser2 */
363 status = dcerpc_samr_OemChangePasswordUser2_r(h, mem_ctx, &oe2);
364 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
365 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(oe2.out.result)) {
366 status = oe2.out.result;
367 }
368 if (!NT_STATUS_IS_OK(oe2.out.result)) {
369 *error_string =
370 talloc_asprintf(mem_ctx,
371 "samr_OemChangePasswordUser2 "
372 "for '%s\\%s' failed: %s",
373 server->string,
374 account->string,
375 nt_errstr(status));
376 }
377 goto done;
378 }
379
380 status = NT_STATUS_OK;
381 done:
382 return status;
383 }
384
385 /*
386 * do a password change using DCERPC/SAMR calls
387 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
388 * 2. try samr_ChangePasswordUser3
389 * 3. try samr_ChangePasswordUser2
390 * 4. try samr_OemChangePasswordUser2
391 */
392 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
393 {
394 NTSTATUS status;
395 struct libnet_RpcConnect c;
396 struct lsa_String server, account;
397
398 ZERO_STRUCT(c);
399
400 /* prepare connect to the SAMR pipe of the users domain PDC */
401 c.level = LIBNET_RPC_CONNECT_PDC;
402 c.in.name = r->samr.in.domain_name;
403 c.in.dcerpc_iface = &ndr_table_samr;
404 c.in.dcerpc_flags = DCERPC_ANON_FALLBACK;
405
406 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
407 status = libnet_RpcConnect(ctx, mem_ctx, &c);
408 if (!NT_STATUS_IS_OK(status)) {
409 r->samr.out.error_string = talloc_asprintf(mem_ctx,
410 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
411 r->samr.in.domain_name, nt_errstr(status));
412 return status;
413 }
414
415 /* prepare password change for account */
416 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
417 account.string = r->samr.in.account_name;
418
419 status = libnet_ChangePassword_samr_aes(
420 mem_ctx,
421 c.out.dcerpc_pipe->binding_handle,
422 &server,
423 &account,
424 r->samr.in.oldpassword,
425 r->samr.in.newpassword,
426 &(r->samr.out.error_string));
427 if (NT_STATUS_IS_OK(status)) {
428 goto disconnect;
429 } else if (NT_STATUS_EQUAL(status,
430 NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
431 NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
432 NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
433 /*
434 * Don't fallback to RC4 based SAMR if weak crypto is not
435 * allowed.
436 */
437 if (lpcfg_weak_crypto(ctx->lp_ctx) ==
438 SAMBA_WEAK_CRYPTO_DISALLOWED) {
439 goto disconnect;
440 }
441 } else {
442 /* libnet_ChangePassword_samr_aes is implemented and failed */
443 goto disconnect;
444 }
445
446 status = libnet_ChangePassword_samr_rc4(
447 mem_ctx,
448 c.out.dcerpc_pipe->binding_handle,
449 &server,
450 &account,
451 r->samr.in.oldpassword,
452 r->samr.in.newpassword,
453 &(r->samr.out.error_string));
454 if (!NT_STATUS_IS_OK(status)) {
455 goto disconnect;
456 }
457
458 disconnect:
459 /* close connection */
460 talloc_unlink(ctx, c.out.dcerpc_pipe);
461
462 return status;
463 }
464
465 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
466 {
467 NTSTATUS status;
468 union libnet_ChangePassword r2;
469
470 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
471 r2.samr.in.account_name = r->generic.in.account_name;
472 r2.samr.in.domain_name = r->generic.in.domain_name;
473 r2.samr.in.oldpassword = r->generic.in.oldpassword;
474 r2.samr.in.newpassword = r->generic.in.newpassword;
475
476 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
477
478 r->generic.out.error_string = r2.samr.out.error_string;
479
480 return status;
481 }
482
483 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
484 {
485 switch (r->generic.level) {
486 case LIBNET_CHANGE_PASSWORD_GENERIC:
487 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
488 case LIBNET_CHANGE_PASSWORD_SAMR:
489 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
490 case LIBNET_CHANGE_PASSWORD_KRB5:
491 return NT_STATUS_NOT_IMPLEMENTED;
492 case LIBNET_CHANGE_PASSWORD_LDAP:
493 return NT_STATUS_NOT_IMPLEMENTED;
494 case LIBNET_CHANGE_PASSWORD_RAP:
495 return NT_STATUS_NOT_IMPLEMENTED;
496 }
497
498 return NT_STATUS_INVALID_LEVEL;
499 }
500
501 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
502 {
503 struct dcerpc_binding_handle *b =
504 r->samr_handle.in.dcerpc_pipe->binding_handle;
505 NTSTATUS status;
506 struct samr_SetUserInfo2 sui;
507 union samr_UserInfo u_info;
508 DATA_BLOB session_key;
509
510 if (r->samr_handle.in.info21) {
511 return NT_STATUS_INVALID_PARAMETER_MIX;
512 }
513
514 /* prepare samr_SetUserInfo2 level 26 */
515 ZERO_STRUCT(u_info);
516 u_info.info26.password_expired = 0;
517
518 status = dcerpc_binding_handle_transport_session_key(b,
519 mem_ctx,
520 &session_key);
521 if (!NT_STATUS_IS_OK(status)) {
522 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
523 "transport_session_key failed: %s",
524 nt_errstr(status));
525 return status;
526 }
527
528 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
529 &session_key,
530 &u_info.info26.password);
531 data_blob_clear_free(&session_key);
532 if (!NT_STATUS_IS_OK(status)) {
533 r->samr_handle.out.error_string =
534 talloc_asprintf(mem_ctx,
535 "encode_rc4_passwd_buffer failed: %s",
536 nt_errstr(status));
537 return status;
538 }
539
540 sui.in.user_handle = r->samr_handle.in.user_handle;
541 sui.in.info = &u_info;
542 sui.in.level = 26;
543
544 /* 7. try samr_SetUserInfo2 level 26 to set the password */
545 status = dcerpc_samr_SetUserInfo2_r(b, mem_ctx, &sui);
546 /* check result of samr_SetUserInfo2 level 26 */
547 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
548 status = sui.out.result;
549 }
550 if (!NT_STATUS_IS_OK(status)) {
551 r->samr_handle.out.error_string
552 = talloc_asprintf(mem_ctx,
553 "SetUserInfo2 level 26 for [%s] failed: %s",
554 r->samr_handle.in.account_name, nt_errstr(status));
555 }
556
557 return status;
558 }
559
560 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
561 {
562 struct dcerpc_binding_handle *b =
563 r->samr_handle.in.dcerpc_pipe->binding_handle;
564 NTSTATUS status;
565 struct samr_SetUserInfo2 sui;
566 union samr_UserInfo u_info;
567 DATA_BLOB session_key;
568
569 if (!r->samr_handle.in.info21) {
570 return NT_STATUS_INVALID_PARAMETER_MIX;
571 }
572
573 /* prepare samr_SetUserInfo2 level 25 */
574 ZERO_STRUCT(u_info);
575 u_info.info25.info = *r->samr_handle.in.info21;
576 u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
577
578 status = dcerpc_binding_handle_transport_session_key(b,
579 mem_ctx,
580 &session_key);
581 if (!NT_STATUS_IS_OK(status)) {
582 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
583 "transport_session_key failed: %s",
584 nt_errstr(status));
585 return status;
586 }
587
588 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
589 &session_key,
590 &u_info.info25.password);
591 data_blob_clear_free(&session_key);
592 if (!NT_STATUS_IS_OK(status)) {
593 r->samr_handle.out.error_string =
594 talloc_asprintf(mem_ctx,
595 "encode_rc4_passwd_buffer failed: %s",
596 nt_errstr(status));
597 return status;
598 }
599
600
601 sui.in.user_handle = r->samr_handle.in.user_handle;
602 sui.in.info = &u_info;
603 sui.in.level = 25;
604
605 /* 8. try samr_SetUserInfo2 level 25 to set the password */
606 status = dcerpc_samr_SetUserInfo2_r(b, mem_ctx, &sui);
607 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
608 status = sui.out.result;
609 }
610 if (!NT_STATUS_IS_OK(status)) {
611 r->samr_handle.out.error_string
612 = talloc_asprintf(mem_ctx,
613 "SetUserInfo2 level 25 for [%s] failed: %s",
614 r->samr_handle.in.account_name, nt_errstr(status));
615 }
616
617 return status;
618 }
619
620 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
621 {
622 struct dcerpc_binding_handle *b =
623 r->samr_handle.in.dcerpc_pipe->binding_handle;
624 NTSTATUS status;
625 struct samr_SetUserInfo2 sui;
626 union samr_UserInfo u_info;
627 DATA_BLOB session_key;
628 gnutls_cipher_hd_t cipher_hnd = NULL;
629 gnutls_datum_t enc_session_key;
630 int rc;
631
632 if (r->samr_handle.in.info21) {
633 return NT_STATUS_INVALID_PARAMETER_MIX;
634 }
635
636 /* prepare samr_SetUserInfo2 level 24 */
637 ZERO_STRUCT(u_info);
638 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
639 u_info.info24.password_expired = 0;
640
641 status = dcerpc_binding_handle_transport_session_key(b,
642 mem_ctx,
643 &session_key);
644 if (!NT_STATUS_IS_OK(status)) {
645 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
646 "transport_session_key failed: %s",
647 nt_errstr(status));
648 return status;
649 }
650
651 enc_session_key = (gnutls_datum_t) {
652 .data = session_key.data,
653 .size = session_key.length,
654 };
655
656 rc = gnutls_cipher_init(&cipher_hnd,
657 GNUTLS_CIPHER_ARCFOUR_128,
658 &enc_session_key,
659 NULL);
660 data_blob_clear_free(&session_key);
661 if (rc < 0) {
662 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
663 goto out;
664 }
665
666 rc = gnutls_cipher_encrypt(cipher_hnd,
667 u_info.info24.password.data,
668 516);
669 gnutls_cipher_deinit(cipher_hnd);
670 if (rc < 0) {
671 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
672 goto out;
673 }
674
675 sui.in.user_handle = r->samr_handle.in.user_handle;
676 sui.in.info = &u_info;
677 sui.in.level = 24;
678
679 /* 9. try samr_SetUserInfo2 level 24 to set the password */
680 status = dcerpc_samr_SetUserInfo2_r(b, mem_ctx, &sui);
681 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
682 status = sui.out.result;
683 }
684 if (!NT_STATUS_IS_OK(status)) {
685 r->samr_handle.out.error_string
686 = talloc_asprintf(mem_ctx,
687 "SetUserInfo2 level 24 for [%s] failed: %s",
688 r->samr_handle.in.account_name, nt_errstr(status));
689 }
690
691 out:
692 data_blob_clear(&session_key);
693 return status;
694 }
695
696 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
697 {
698 struct dcerpc_binding_handle *b =
699 r->samr_handle.in.dcerpc_pipe->binding_handle;
700 NTSTATUS status;
701 struct samr_SetUserInfo2 sui;
702 union samr_UserInfo u_info;
703 DATA_BLOB session_key;
704 gnutls_cipher_hd_t cipher_hnd = NULL;
705 gnutls_datum_t _session_key;
706 int rc;
707
708 if (!r->samr_handle.in.info21) {
709 return NT_STATUS_INVALID_PARAMETER_MIX;
710 }
711
712 /* prepare samr_SetUserInfo2 level 23 */
713 ZERO_STRUCT(u_info);
714 u_info.info23.info = *r->samr_handle.in.info21;
715 u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
716 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
717
718 status = dcerpc_binding_handle_transport_session_key(b,
719 mem_ctx,
720 &session_key);
721 if (!NT_STATUS_IS_OK(status)) {
722 r->samr_handle.out.error_string
723 = talloc_asprintf(mem_ctx,
724 "transport_session_key failed: %s",
725 nt_errstr(status));
726 return status;
727 }
728
729 _session_key = (gnutls_datum_t) {
730 .data = session_key.data,
731 .size = session_key.length,
732 };
733
734 rc = gnutls_cipher_init(&cipher_hnd,
735 GNUTLS_CIPHER_ARCFOUR_128,
736 &_session_key,
737 NULL);
738 data_blob_clear_free(&session_key);
739 if (rc < 0) {
740 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
741 goto out;
742 }
743
744 rc = gnutls_cipher_encrypt(cipher_hnd,
745 u_info.info23.password.data,
746 516);
747 data_blob_clear_free(&session_key);
748 gnutls_cipher_deinit(cipher_hnd);
749 if (rc < 0) {
750 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
751 goto out;
752 }
753
754 sui.in.user_handle = r->samr_handle.in.user_handle;
755 sui.in.info = &u_info;
756 sui.in.level = 23;
757
758 /* 10. try samr_SetUserInfo2 level 23 to set the password */
759 status = dcerpc_samr_SetUserInfo2_r(b, mem_ctx, &sui);
760 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
761 status = sui.out.result;
762 }
763 if (!NT_STATUS_IS_OK(status)) {
764 r->samr_handle.out.error_string
765 = talloc_asprintf(mem_ctx,
766 "SetUserInfo2 level 23 for [%s] failed: %s",
767 r->samr_handle.in.account_name, nt_errstr(status));
768 }
769
770 out:
771 return status;
772 }
773
774 static NTSTATUS libnet_SetPassword_samr_handle_18(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
775 {
776 struct dcerpc_binding_handle *b =
777 r->samr_handle.in.dcerpc_pipe->binding_handle;
778 NTSTATUS status;
779 struct samr_SetUserInfo2 sui;
780 union samr_UserInfo u_info;
781 struct samr_Password ntpwd;
782 DATA_BLOB ntpwd_in;
783 DATA_BLOB ntpwd_out;
784 DATA_BLOB session_key;
785 int rc;
786
787 if (r->samr_handle.in.info21) {
788 return NT_STATUS_INVALID_PARAMETER_MIX;
789 }
790
791 /* prepare samr_SetUserInfo2 level 18 (nt_hash) */
792 ZERO_STRUCT(u_info);
793 E_md4hash(r->samr_handle.in.newpassword, ntpwd.hash);
794 ntpwd_in = data_blob_const(ntpwd.hash, sizeof(ntpwd.hash));
795 ntpwd_out = data_blob_const(u_info.info18.nt_pwd.hash,
796 sizeof(u_info.info18.nt_pwd.hash));
797 u_info.info18.nt_pwd_active = 1;
798 u_info.info18.password_expired = 0;
799
800 status = dcerpc_binding_handle_transport_session_key(b,
801 mem_ctx,
802 &session_key);
803 if (!NT_STATUS_IS_OK(status)) {
804 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
805 "transport_session_key failed: %s",
806 nt_errstr(status));
807 return status;
808 }
809
810 rc = sess_crypt_blob(&ntpwd_out, &ntpwd_in,
811 &session_key, SAMBA_GNUTLS_ENCRYPT);
812 data_blob_clear_free(&session_key);
813 if (rc < 0) {
814 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
815 goto out;
816 }
817
818 sui.in.user_handle = r->samr_handle.in.user_handle;
819 sui.in.info = &u_info;
820 sui.in.level = 18;
821
822 /* 9. try samr_SetUserInfo2 level 18 to set the password */
823 status = dcerpc_samr_SetUserInfo2_r(b, mem_ctx, &sui);
824 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
825 status = sui.out.result;
826 }
827 if (!NT_STATUS_IS_OK(status)) {
828 r->samr_handle.out.error_string
829 = talloc_asprintf(mem_ctx,
830 "SetUserInfo2 level 18 for [%s] failed: %s",
831 r->samr_handle.in.account_name, nt_errstr(status));
832 }
833
834 out:
835 data_blob_clear(&session_key);
836 return status;
837 }
838
839 /*
840 * 1. try samr_SetUserInfo2 level 26 to set the password
841 * 2. try samr_SetUserInfo2 level 25 to set the password
842 * 3. try samr_SetUserInfo2 level 24 to set the password
843 * 4. try samr_SetUserInfo2 level 23 to set the password
844 */
845 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
846 {
847
848 NTSTATUS status;
849 enum libnet_SetPassword_level levels[] = {
850 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
851 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
852 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
853 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
854 };
855 unsigned int i;
856
857 if (r->samr_handle.samr_level != 0) {
858 r->generic.level = r->samr_handle.samr_level;
859 return libnet_SetPassword(ctx, mem_ctx, r);
860 }
861
862 for (i=0; i < ARRAY_SIZE(levels); i++) {
863 r->generic.level = levels[i];
864 status = libnet_SetPassword(ctx, mem_ctx, r);
865 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
866 || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
867 || NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
868 /* Try another password set mechanism */
869 continue;
870 }
871 break;
872 }
873
874 return status;
875 }
876 /*
877 * set a password with DCERPC/SAMR calls
878 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
879 * is it correct to contact the the pdc of the domain of the user who's password should be set?
880 * 2. do a samr_Connect to get a policy handle
881 * 3. do a samr_LookupDomain to get the domain sid
882 * 4. do a samr_OpenDomain to get a domain handle
883 * 5. do a samr_LookupNames to get the users rid
884 * 6. do a samr_OpenUser to get a user handle
885 * 7 call libnet_SetPassword_samr_handle to set the password
886 */
887 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
888 {
889 NTSTATUS status;
890 struct libnet_RpcConnect c;
891 struct samr_Connect sc;
892 struct policy_handle p_handle;
893 struct samr_LookupDomain ld;
894 struct dom_sid2 *sid = NULL;
895 struct lsa_String d_name;
896 struct samr_OpenDomain od;
897 struct policy_handle d_handle;
898 struct samr_LookupNames ln;
899 struct samr_Ids rids, types;
900 struct samr_OpenUser ou;
901 struct policy_handle u_handle;
902 union libnet_SetPassword r2;
903
904 ZERO_STRUCT(c);
905 /* prepare connect to the SAMR pipe of users domain PDC */
906 c.level = LIBNET_RPC_CONNECT_PDC;
907 c.in.name = r->samr.in.domain_name;
908 c.in.dcerpc_iface = &ndr_table_samr;
909
910 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
911 status = libnet_RpcConnect(ctx, mem_ctx, &c);
912 if (!NT_STATUS_IS_OK(status)) {
913 r->samr.out.error_string = talloc_asprintf(mem_ctx,
914 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
915 r->samr.in.domain_name, nt_errstr(status));
916 return status;
917 }
918
919 /* prepare samr_Connect */
920 ZERO_STRUCT(p_handle);
921 sc.in.system_name = NULL;
922 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
923 sc.out.connect_handle = &p_handle;
924
925 /* 2. do a samr_Connect to get a policy handle */
926 status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc);
927 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) {
928 status = sc.out.result;
929 }
930 if (!NT_STATUS_IS_OK(status)) {
931 r->samr.out.error_string = talloc_asprintf(mem_ctx,
932 "samr_Connect failed: %s",
933 nt_errstr(status));
934 goto disconnect;
935 }
936
937 /* prepare samr_LookupDomain */
938 d_name.string = r->samr.in.domain_name;
939 ld.in.connect_handle = &p_handle;
940 ld.in.domain_name = &d_name;
941 ld.out.sid = &sid;
942
943 /* 3. do a samr_LookupDomain to get the domain sid */
944 status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld);
945 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ld.out.result)) {
946 status = ld.out.result;
947 }
948 if (!NT_STATUS_IS_OK(status)) {
949 r->samr.out.error_string = talloc_asprintf(mem_ctx,
950 "samr_LookupDomain for [%s] failed: %s",
951 r->samr.in.domain_name, nt_errstr(status));
952 goto disconnect;
953 }
954
955 /* prepare samr_OpenDomain */
956 ZERO_STRUCT(d_handle);
957 od.in.connect_handle = &p_handle;
958 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
959 od.in.sid = *ld.out.sid;
960 od.out.domain_handle = &d_handle;
961
962 /* 4. do a samr_OpenDomain to get a domain handle */
963 status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od);
964 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) {
965 status = od.out.result;
966 }
967 if (!NT_STATUS_IS_OK(status)) {
968 r->samr.out.error_string = talloc_asprintf(mem_ctx,
969 "samr_OpenDomain for [%s] failed: %s",
970 r->samr.in.domain_name, nt_errstr(status));
971 goto disconnect;
972 }
973
974 /* prepare samr_LookupNames */
975 ln.in.domain_handle = &d_handle;
976 ln.in.num_names = 1;
977 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
978 ln.out.rids = &rids;
979 ln.out.types = &types;
980 if (!ln.in.names) {
981 r->samr.out.error_string = "Out of Memory";
982 return NT_STATUS_NO_MEMORY;
983 }
984 ln.in.names[0].string = r->samr.in.account_name;
985
986 /* 5. do a samr_LookupNames to get the users rid */
987 status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln);
988 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) {
989 status = ln.out.result;
990 }
991 if (!NT_STATUS_IS_OK(status)) {
992 r->samr.out.error_string = talloc_asprintf(mem_ctx,
993 "samr_LookupNames for [%s] failed: %s",
994 r->samr.in.account_name, nt_errstr(status));
995 goto disconnect;
996 }
997
998 /* check if we got one RID for the user */
999 if (ln.out.rids->count != 1) {
1000 r->samr.out.error_string = talloc_asprintf(mem_ctx,
1001 "samr_LookupNames for [%s] returns %d RIDs",
1002 r->samr.in.account_name, ln.out.rids->count);
1003 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1004 goto disconnect;
1005 }
1006
1007 if (ln.out.types->count != 1) {
1008 r->samr.out.error_string = talloc_asprintf(mem_ctx,
1009 "samr_LookupNames for [%s] returns %d RID TYPEs",
1010 r->samr.in.account_name, ln.out.types->count);
1011 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1012 goto disconnect;
1013 }
1014
1015 /* prepare samr_OpenUser */
1016 ZERO_STRUCT(u_handle);
1017 ou.in.domain_handle = &d_handle;
1018 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1019 ou.in.rid = ln.out.rids->ids[0];
1020 ou.out.user_handle = &u_handle;
1021
1022 /* 6. do a samr_OpenUser to get a user handle */
1023 status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou);
1024 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) {
1025 status = ou.out.result;
1026 }
1027 if (!NT_STATUS_IS_OK(status)) {
1028 r->samr.out.error_string = talloc_asprintf(mem_ctx,
1029 "samr_OpenUser for [%s] failed: %s",
1030 r->samr.in.account_name, nt_errstr(status));
1031 goto disconnect;
1032 }
1033
1034 ZERO_STRUCT(r2);
1035 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
1036 r2.samr_handle.samr_level = r->samr.samr_level;
1037 r2.samr_handle.in.account_name = r->samr.in.account_name;
1038 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
1039 r2.samr_handle.in.user_handle = &u_handle;
1040 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
1041 r2.samr_handle.in.info21 = NULL;
1042
1043 status = libnet_SetPassword(ctx, mem_ctx, &r2);
1044
1045 r->generic.out.error_string = r2.samr_handle.out.error_string;
1046
1047 disconnect:
1048 /* close connection */
1049 talloc_unlink(ctx, c.out.dcerpc_pipe);
1050
1051 return status;
1052 }
1053
1054 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
1055 {
1056 NTSTATUS status;
1057 union libnet_SetPassword r2;
1058
1059 ZERO_STRUCT(r2);
1060 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
1061 r2.samr.samr_level = r->generic.samr_level;
1062 r2.samr.in.account_name = r->generic.in.account_name;
1063 r2.samr.in.domain_name = r->generic.in.domain_name;
1064 r2.samr.in.newpassword = r->generic.in.newpassword;
1065
1066 r->generic.out.error_string = "Unknown Error";
1067 status = libnet_SetPassword(ctx, mem_ctx, &r2);
1068
1069 r->generic.out.error_string = r2.samr.out.error_string;
1070
1071 return status;
1072 }
1073
1074 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
1075 {
1076 enum smb_encryption_setting encryption_state =
1077 cli_credentials_get_smb_encryption(ctx->cred);
1078 NTSTATUS status = NT_STATUS_INVALID_LEVEL;
1079
1080 switch (r->generic.level) {
1081 case LIBNET_SET_PASSWORD_GENERIC:
1082 status = libnet_SetPassword_generic(ctx, mem_ctx, r);
1083 break;
1084 case LIBNET_SET_PASSWORD_SAMR:
1085 status = libnet_SetPassword_samr(ctx, mem_ctx, r);
1086 break;
1087 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
1088 status = libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
1089 break;
1090 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
1091 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1092 GNUTLS_FIPS140_SET_LAX_MODE();
1093 }
1094 status = libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
1095 break;
1096 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
1097 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1098 GNUTLS_FIPS140_SET_LAX_MODE();
1099 }
1100 status = libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
1101 break;
1102 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
1103 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1104 GNUTLS_FIPS140_SET_LAX_MODE();
1105 }
1106 status = libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
1107 break;
1108 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
1109 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1110 GNUTLS_FIPS140_SET_LAX_MODE();
1111 }
1112 status = libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
1113 break;
1114 case LIBNET_SET_PASSWORD_SAMR_HANDLE_18:
1115 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1116 GNUTLS_FIPS140_SET_LAX_MODE();
1117 }
1118 status = libnet_SetPassword_samr_handle_18(ctx, mem_ctx, r);
1119 break;
1120 case LIBNET_SET_PASSWORD_KRB5:
1121 status = NT_STATUS_NOT_IMPLEMENTED;
1122 break;
1123 case LIBNET_SET_PASSWORD_LDAP:
1124 status = NT_STATUS_NOT_IMPLEMENTED;
1125 break;
1126 case LIBNET_SET_PASSWORD_RAP:
1127 status = NT_STATUS_NOT_IMPLEMENTED;
1128 break;
1129 }
1130
1131 GNUTLS_FIPS140_SET_STRICT_MODE();
1132 return status;
1133 }
GSS-enabled samba4