2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libnet/libnet.h"
25 #include "lib/crypto/crypto.h"
26 #include "auth/credentials/credentials.h"
27 #include "libcli/auth/proto.h"
30 * do a password change using DCERPC/SAMR calls
31 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
32 * 2. try samr_ChangePasswordUser3
33 * 3. try samr_ChangePasswordUser2
34 * 4. try samr_OemChangePasswordUser2
35 * (not yet: 5. try samr_ChangePasswordUser)
37 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
40 struct libnet_RpcConnect c;
42 struct policy_handle user_handle;
43 struct samr_Password hash1, hash2, hash3, hash4, hash5, hash6;
44 struct samr_ChangePasswordUser pw;
46 struct samr_OemChangePasswordUser2 oe2;
47 struct samr_ChangePasswordUser2 pw2;
48 struct samr_ChangePasswordUser3 pw3;
49 struct lsa_String server, account;
50 struct lsa_AsciiString a_server, a_account;
51 struct samr_CryptPassword nt_pass, lm_pass;
52 struct samr_Password nt_verifier, lm_verifier;
53 uint8_t old_nt_hash[16], new_nt_hash[16];
54 uint8_t old_lm_hash[16], new_lm_hash[16];
56 /* prepare connect to the SAMR pipe of the users domain PDC */
57 c.level = LIBNET_RPC_CONNECT_PDC;
58 c.in.name = r->samr.in.domain_name;
59 c.in.dcerpc_iface = &dcerpc_table_samr;
61 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
62 status = libnet_RpcConnect(ctx, mem_ctx, &c);
63 if (!NT_STATUS_IS_OK(status)) {
64 r->samr.out.error_string = talloc_asprintf(mem_ctx,
65 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
66 r->samr.in.domain_name, nt_errstr(status));
70 /* prepare password change for account */
71 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
72 account.string = r->samr.in.account_name;
74 E_md4hash(r->samr.in.oldpassword, old_nt_hash);
75 E_md4hash(r->samr.in.newpassword, new_nt_hash);
77 E_deshash(r->samr.in.oldpassword, old_lm_hash);
78 E_deshash(r->samr.in.newpassword, new_lm_hash);
80 /* prepare samr_ChangePasswordUser3 */
81 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_UNICODE);
82 arcfour_crypt(lm_pass.data, old_nt_hash, 516);
83 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
85 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
86 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
87 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
89 pw3.in.server = &server;
90 pw3.in.account = &account;
91 pw3.in.nt_password = &nt_pass;
92 pw3.in.nt_verifier = &nt_verifier;
94 pw3.in.lm_password = &lm_pass;
95 pw3.in.lm_verifier = &lm_verifier;
96 pw3.in.password3 = NULL;
98 /* 2. try samr_ChangePasswordUser3 */
99 status = dcerpc_samr_ChangePasswordUser3(c.out.dcerpc_pipe, mem_ctx, &pw3);
100 if (!NT_STATUS_IS_OK(status)) {
101 r->samr.out.error_string = talloc_asprintf(mem_ctx,
102 "samr_ChangePasswordUser3 failed: %s\n",
104 goto ChangePasswordUser2;
107 /* check result of samr_ChangePasswordUser3 */
108 if (!NT_STATUS_IS_OK(pw3.out.result)) {
109 r->samr.out.error_string = talloc_asprintf(mem_ctx,
110 "samr_ChangePasswordUser3 for '%s\\%s' failed: %s\n",
111 r->samr.in.domain_name, r->samr.in.account_name,
112 nt_errstr(pw3.out.result));
113 /* TODO: give the reason of the reject */
114 if (NT_STATUS_EQUAL(pw3.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
115 status = pw3.out.result;
118 goto ChangePasswordUser2;
124 /* prepare samr_ChangePasswordUser2 */
125 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII|STR_TERMINATE);
126 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
127 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
129 encode_pw_buffer(nt_pass.data, r->samr.in.newpassword, STR_UNICODE);
130 arcfour_crypt(nt_pass.data, old_nt_hash, 516);
131 E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
133 pw2.in.server = &server;
134 pw2.in.account = &account;
135 pw2.in.nt_password = &nt_pass;
136 pw2.in.nt_verifier = &nt_verifier;
137 pw2.in.lm_change = 1;
138 pw2.in.lm_password = &lm_pass;
139 pw2.in.lm_verifier = &lm_verifier;
141 /* 3. try samr_ChangePasswordUser2 */
142 status = dcerpc_samr_ChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &pw2);
143 if (!NT_STATUS_IS_OK(status)) {
144 r->samr.out.error_string = talloc_asprintf(mem_ctx,
145 "samr_ChangePasswordUser2 failed: %s\n",
147 goto OemChangePasswordUser2;
150 /* check result of samr_ChangePasswordUser2 */
151 if (!NT_STATUS_IS_OK(pw2.out.result)) {
152 r->samr.out.error_string = talloc_asprintf(mem_ctx,
153 "samr_ChangePasswordUser2 for '%s\\%s' failed: %s\n",
154 r->samr.in.domain_name, r->samr.in.account_name,
155 nt_errstr(pw2.out.result));
156 if (NT_STATUS_EQUAL(pw2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
157 status = pw2.out.result;
160 goto OemChangePasswordUser2;
165 OemChangePasswordUser2:
166 /* prepare samr_OemChangePasswordUser2 */
167 a_server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
168 a_account.string = r->samr.in.account_name;
170 encode_pw_buffer(lm_pass.data, r->samr.in.newpassword, STR_ASCII);
171 arcfour_crypt(lm_pass.data, old_lm_hash, 516);
172 E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
174 oe2.in.server = &a_server;
175 oe2.in.account = &a_account;
176 oe2.in.password = &lm_pass;
177 oe2.in.hash = &lm_verifier;
179 /* 4. try samr_OemChangePasswordUser2 */
180 status = dcerpc_samr_OemChangePasswordUser2(c.out.dcerpc_pipe, mem_ctx, &oe2);
181 if (!NT_STATUS_IS_OK(status)) {
182 r->samr.out.error_string = talloc_asprintf(mem_ctx,
183 "samr_OemChangePasswordUser2 failed: %s\n",
185 goto ChangePasswordUser;
188 /* check result of samr_OemChangePasswordUser2 */
189 if (!NT_STATUS_IS_OK(oe2.out.result)) {
190 r->samr.out.error_string = talloc_asprintf(mem_ctx,
191 "samr_OemChangePasswordUser2 for '%s\\%s' failed: %s\n",
192 r->samr.in.domain_name, r->samr.in.account_name,
193 nt_errstr(oe2.out.result));
194 if (NT_STATUS_EQUAL(oe2.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
195 status = oe2.out.result;
198 goto ChangePasswordUser;
205 /* prepare samr_ChangePasswordUser */
206 E_old_pw_hash(new_lm_hash, old_lm_hash, hash1.hash);
207 E_old_pw_hash(old_lm_hash, new_lm_hash, hash2.hash);
208 E_old_pw_hash(new_nt_hash, old_nt_hash, hash3.hash);
209 E_old_pw_hash(old_nt_hash, new_nt_hash, hash4.hash);
210 E_old_pw_hash(old_lm_hash, new_nt_hash, hash5.hash);
211 E_old_pw_hash(old_nt_hash, new_lm_hash, hash6.hash);
213 /* TODO: ask for a user_handle */
214 pw.in.handle = &user_handle;
215 pw.in.lm_present = 1;
216 pw.in.old_lm_crypted = &hash1;
217 pw.in.new_lm_crypted = &hash2;
218 pw.in.nt_present = 1;
219 pw.in.old_nt_crypted = &hash3;
220 pw.in.new_nt_crypted = &hash4;
221 pw.in.cross1_present = 1;
222 pw.in.nt_cross = &hash5;
223 pw.in.cross2_present = 1;
224 pw.in.lm_cross = &hash6;
226 /* 5. try samr_ChangePasswordUser */
227 status = dcerpc_samr_ChangePasswordUser(c.pdc.out.dcerpc_pipe, mem_ctx, &pw);
228 if (!NT_STATUS_IS_OK(status)) {
229 r->samr.out.error_string = talloc_asprintf(mem_ctx,
230 "samr_ChangePasswordUser failed: %s\n",
235 /* check result of samr_ChangePasswordUser */
236 if (!NT_STATUS_IS_OK(pw.out.result)) {
237 r->samr.out.error_string = talloc_asprintf(mem_ctx,
238 "samr_ChangePasswordUser for '%s\\%s' failed: %s\n",
239 r->samr.in.domain_name, r->samr.in.account_name,
240 nt_errstr(pw.out.result));
241 if (NT_STATUS_EQUAL(pw.out.result, NT_STATUS_PASSWORD_RESTRICTION)) {
242 status = pw.out.result;
249 /* close connection */
250 talloc_free(c.out.dcerpc_pipe);
255 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
258 union libnet_ChangePassword r2;
260 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
261 r2.samr.in.account_name = r->generic.in.account_name;
262 r2.samr.in.domain_name = r->generic.in.domain_name;
263 r2.samr.in.oldpassword = r->generic.in.oldpassword;
264 r2.samr.in.newpassword = r->generic.in.newpassword;
266 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
268 r->generic.out.error_string = r2.samr.out.error_string;
273 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
275 switch (r->generic.level) {
276 case LIBNET_CHANGE_PASSWORD_GENERIC:
277 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
278 case LIBNET_CHANGE_PASSWORD_SAMR:
279 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
280 case LIBNET_CHANGE_PASSWORD_KRB5:
281 return NT_STATUS_NOT_IMPLEMENTED;
282 case LIBNET_CHANGE_PASSWORD_LDAP:
283 return NT_STATUS_NOT_IMPLEMENTED;
284 case LIBNET_CHANGE_PASSWORD_RAP:
285 return NT_STATUS_NOT_IMPLEMENTED;
288 return NT_STATUS_INVALID_LEVEL;
291 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
294 struct samr_SetUserInfo sui;
295 union samr_UserInfo u_info;
296 DATA_BLOB session_key;
297 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
298 uint8_t confounder[16];
299 struct MD5Context md5;
301 /* prepare samr_SetUserInfo level 26 */
303 encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
304 u_info.info26.pw_len = strlen(r->samr_handle.in.newpassword);
306 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
307 if (!NT_STATUS_IS_OK(status)) {
308 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
309 "dcerpc_fetch_session_key failed: %s\n",
314 generate_random_buffer((uint8_t *)confounder, 16);
317 MD5Update(&md5, confounder, 16);
318 MD5Update(&md5, session_key.data, session_key.length);
319 MD5Final(confounded_session_key.data, &md5);
321 arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
322 memcpy(&u_info.info26.password.data[516], confounder, 16);
324 sui.in.user_handle = r->samr_handle.in.user_handle;
325 sui.in.info = &u_info;
328 /* 7. try samr_SetUserInfo level 26 to set the password */
329 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
330 /* check result of samr_SetUserInfo level 26 */
331 if (!NT_STATUS_IS_OK(status)) {
332 r->samr_handle.out.error_string
333 = talloc_asprintf(mem_ctx,
334 "SetUserInfo level 26 for [%s] failed: %s\n",
335 r->samr_handle.in.account_name, nt_errstr(status));
340 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
343 struct samr_SetUserInfo sui;
344 union samr_UserInfo u_info;
345 DATA_BLOB session_key;
346 DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
347 uint8_t confounder[16];
348 struct MD5Context md5;
350 /* prepare samr_SetUserInfo level 25 */
352 u_info.info25.info.fields_present = SAMR_FIELD_PASSWORD;
353 encode_pw_buffer(u_info.info25.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
355 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
356 if (!NT_STATUS_IS_OK(status)) {
357 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
358 "dcerpc_fetch_session_key failed: %s\n",
363 generate_random_buffer((uint8_t *)confounder, 16);
366 MD5Update(&md5, confounder, 16);
367 MD5Update(&md5, session_key.data, session_key.length);
368 MD5Final(confounded_session_key.data, &md5);
370 arcfour_crypt_blob(u_info.info25.password.data, 516, &confounded_session_key);
371 memcpy(&u_info.info25.password.data[516], confounder, 16);
373 sui.in.user_handle = r->samr_handle.in.user_handle;
374 sui.in.info = &u_info;
377 /* 8. try samr_SetUserInfo level 25 to set the password */
378 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
379 if (!NT_STATUS_IS_OK(status)) {
380 r->samr_handle.out.error_string
381 = talloc_asprintf(mem_ctx,
382 "SetUserInfo level 25 for [%s] failed: %s\n",
383 r->samr_handle.in.account_name, nt_errstr(status));
388 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
391 struct samr_SetUserInfo sui;
392 union samr_UserInfo u_info;
393 DATA_BLOB session_key;
395 /* prepare samr_SetUserInfo level 24 */
397 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
398 /* w2k3 ignores this length */
399 u_info.info24.pw_len = strlen_m(r->samr_handle.in.newpassword)*2;
401 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
402 if (!NT_STATUS_IS_OK(status)) {
403 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
404 "dcerpc_fetch_session_key failed: %s\n",
409 arcfour_crypt_blob(u_info.info24.password.data, 516, &session_key);
411 sui.in.user_handle = r->samr_handle.in.user_handle;
412 sui.in.info = &u_info;
415 /* 9. try samr_SetUserInfo level 24 to set the password */
416 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
417 if (!NT_STATUS_IS_OK(status)) {
418 r->samr_handle.out.error_string
419 = talloc_asprintf(mem_ctx,
420 "SetUserInfo level 24 for [%s] failed: %s\n",
421 r->samr_handle.in.account_name, nt_errstr(status));
426 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
429 struct samr_SetUserInfo sui;
430 union samr_UserInfo u_info;
431 DATA_BLOB session_key;
433 /* prepare samr_SetUserInfo level 23 */
435 u_info.info23.info.fields_present = SAMR_FIELD_PASSWORD;
436 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
438 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
439 if (!NT_STATUS_IS_OK(status)) {
440 r->samr_handle.out.error_string
441 = talloc_asprintf(mem_ctx,
442 "dcerpc_fetch_session_key failed: %s\n",
447 arcfour_crypt_blob(u_info.info23.password.data, 516, &session_key);
449 sui.in.user_handle = r->samr_handle.in.user_handle;
450 sui.in.info = &u_info;
453 /* 10. try samr_SetUserInfo level 23 to set the password */
454 status = dcerpc_samr_SetUserInfo(r->samr_handle.in.dcerpc_pipe, mem_ctx, &sui);
455 if (!NT_STATUS_IS_OK(status)) {
456 r->samr_handle.out.error_string
457 = talloc_asprintf(mem_ctx,
458 "SetUserInfo level 23 for [%s] failed: %s\n",
459 r->samr_handle.in.account_name, nt_errstr(status));
465 * 1. try samr_SetUserInfo level 26 to set the password
466 * 2. try samr_SetUserInfo level 25 to set the password
467 * 3. try samr_SetUserInfo level 24 to set the password
468 * 4. try samr_SetUserInfo level 23 to set the password
470 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
473 enum libnet_SetPassword_level levels[] = {
474 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
475 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
476 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
477 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
481 for (i=0; i < ARRAY_SIZE(levels); i++) {
482 r->generic.level = levels[i];
483 status = libnet_SetPassword(ctx, mem_ctx, r);
484 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
485 || NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
486 /* Try another password set mechanism */
495 * set a password with DCERPC/SAMR calls
496 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
497 * is it correct to contact the the pdc of the domain of the user who's password should be set?
498 * 2. do a samr_Connect to get a policy handle
499 * 3. do a samr_LookupDomain to get the domain sid
500 * 4. do a samr_OpenDomain to get a domain handle
501 * 5. do a samr_LookupNames to get the users rid
502 * 6. do a samr_OpenUser to get a user handle
503 * 7 call libnet_SetPassword_samr_handle to set the password
505 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
508 struct libnet_RpcConnect c;
509 struct samr_Connect sc;
510 struct policy_handle p_handle;
511 struct samr_LookupDomain ld;
512 struct lsa_String d_name;
513 struct samr_OpenDomain od;
514 struct policy_handle d_handle;
515 struct samr_LookupNames ln;
516 struct samr_OpenUser ou;
517 struct policy_handle u_handle;
518 union libnet_SetPassword r2;
520 /* prepare connect to the SAMR pipe of users domain PDC */
521 c.level = LIBNET_RPC_CONNECT_PDC;
522 c.in.name = r->samr.in.domain_name;
523 c.in.dcerpc_iface = &dcerpc_table_samr;
525 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
526 status = libnet_RpcConnect(ctx, mem_ctx, &c);
527 if (!NT_STATUS_IS_OK(status)) {
528 r->samr.out.error_string = talloc_asprintf(mem_ctx,
529 "Connection to SAMR pipe of PDC of domain '%s' failed: %s\n",
530 r->samr.in.domain_name, nt_errstr(status));
534 /* prepare samr_Connect */
535 ZERO_STRUCT(p_handle);
536 sc.in.system_name = NULL;
537 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
538 sc.out.connect_handle = &p_handle;
540 /* 2. do a samr_Connect to get a policy handle */
541 status = dcerpc_samr_Connect(c.out.dcerpc_pipe, mem_ctx, &sc);
542 if (!NT_STATUS_IS_OK(status)) {
543 r->samr.out.error_string = talloc_asprintf(mem_ctx,
544 "samr_Connect failed: %s\n",
549 /* prepare samr_LookupDomain */
550 d_name.string = r->samr.in.domain_name;
551 ld.in.connect_handle = &p_handle;
552 ld.in.domain_name = &d_name;
554 /* 3. do a samr_LookupDomain to get the domain sid */
555 status = dcerpc_samr_LookupDomain(c.out.dcerpc_pipe, mem_ctx, &ld);
556 if (!NT_STATUS_IS_OK(status)) {
557 r->samr.out.error_string = talloc_asprintf(mem_ctx,
558 "samr_LookupDomain for [%s] failed: %s\n",
559 r->samr.in.domain_name, nt_errstr(status));
563 /* prepare samr_OpenDomain */
564 ZERO_STRUCT(d_handle);
565 od.in.connect_handle = &p_handle;
566 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
567 od.in.sid = ld.out.sid;
568 od.out.domain_handle = &d_handle;
570 /* 4. do a samr_OpenDomain to get a domain handle */
571 status = dcerpc_samr_OpenDomain(c.out.dcerpc_pipe, mem_ctx, &od);
572 if (!NT_STATUS_IS_OK(status)) {
573 r->samr.out.error_string = talloc_asprintf(mem_ctx,
574 "samr_OpenDomain for [%s] failed: %s\n",
575 r->samr.in.domain_name, nt_errstr(status));
579 /* prepare samr_LookupNames */
580 ln.in.domain_handle = &d_handle;
582 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
584 r->samr.out.error_string = "Out of Memory";
585 return NT_STATUS_NO_MEMORY;
587 ln.in.names[0].string = r->samr.in.account_name;
589 /* 5. do a samr_LookupNames to get the users rid */
590 status = dcerpc_samr_LookupNames(c.out.dcerpc_pipe, mem_ctx, &ln);
591 if (!NT_STATUS_IS_OK(status)) {
592 r->samr.out.error_string = talloc_asprintf(mem_ctx,
593 "samr_LookupNames for [%s] failed: %s\n",
594 r->samr.in.account_name, nt_errstr(status));
598 /* check if we got one RID for the user */
599 if (ln.out.rids.count != 1) {
600 r->samr.out.error_string = talloc_asprintf(mem_ctx,
601 "samr_LookupNames for [%s] returns %d RIDs\n",
602 r->samr.in.account_name, ln.out.rids.count);
603 status = NT_STATUS_INVALID_PARAMETER;
607 /* prepare samr_OpenUser */
608 ZERO_STRUCT(u_handle);
609 ou.in.domain_handle = &d_handle;
610 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
611 ou.in.rid = ln.out.rids.ids[0];
612 ou.out.user_handle = &u_handle;
614 /* 6. do a samr_OpenUser to get a user handle */
615 status = dcerpc_samr_OpenUser(c.out.dcerpc_pipe, mem_ctx, &ou);
616 if (!NT_STATUS_IS_OK(status)) {
617 r->samr.out.error_string = talloc_asprintf(mem_ctx,
618 "samr_OpenUser for [%s] failed: %s\n",
619 r->samr.in.account_name, nt_errstr(status));
623 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
624 r2.samr_handle.in.account_name = r->samr.in.account_name;
625 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
626 r2.samr_handle.in.user_handle = &u_handle;
627 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
629 status = libnet_SetPassword(ctx, mem_ctx, &r2);
631 r->generic.out.error_string = r2.samr_handle.out.error_string;
634 /* close connection */
635 talloc_free(c.out.dcerpc_pipe);
640 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
643 union libnet_SetPassword r2;
645 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
646 r2.samr.in.account_name = r->generic.in.account_name;
647 r2.samr.in.domain_name = r->generic.in.domain_name;
648 r2.samr.in.newpassword = r->generic.in.newpassword;
650 r->generic.out.error_string = "Unknown Error";
651 status = libnet_SetPassword(ctx, mem_ctx, &r2);
653 r->generic.out.error_string = r2.samr.out.error_string;
658 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
660 switch (r->generic.level) {
661 case LIBNET_SET_PASSWORD_GENERIC:
662 return libnet_SetPassword_generic(ctx, mem_ctx, r);
663 case LIBNET_SET_PASSWORD_SAMR:
664 return libnet_SetPassword_samr(ctx, mem_ctx, r);
665 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
666 return libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
667 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
668 return libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
669 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
670 return libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
671 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
672 return libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
673 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
674 return libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
675 case LIBNET_SET_PASSWORD_KRB5:
676 return NT_STATUS_NOT_IMPLEMENTED;
677 case LIBNET_SET_PASSWORD_LDAP:
678 return NT_STATUS_NOT_IMPLEMENTED;
679 case LIBNET_SET_PASSWORD_RAP:
680 return NT_STATUS_NOT_IMPLEMENTED;
683 return NT_STATUS_INVALID_LEVEL;