|
 |
b6b438 |
From 13dfa7d5a1c96d78eca81eb0eb97bc0668561738 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Tue, 9 Jul 2019 13:01:10 +0200
|
|
|
b6b438 |
Subject: [PATCH 017/187] libcli:auth: Add encode_rc4_passwd_buffer()
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit 06d46c447e69a6b384c0089863c343b4924c7caf)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
libcli/auth/proto.h | 7 +++++++
|
|
|
b6b438 |
libcli/auth/smbencrypt.c | 42 ++++++++++++++++++++++++++++++++++++++++
|
|
|
b6b438 |
2 files changed, 49 insertions(+)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/libcli/auth/proto.h b/libcli/auth/proto.h
|
|
|
b6b438 |
index a67c89d8552..67caaca8c41 100644
|
|
|
b6b438 |
--- a/libcli/auth/proto.h
|
|
|
b6b438 |
+++ b/libcli/auth/proto.h
|
|
|
b6b438 |
@@ -181,6 +181,13 @@ bool decode_pw_buffer(TALLOC_CTX *ctx,
|
|
|
b6b438 |
size_t *new_pw_len,
|
|
|
b6b438 |
charset_t string_charset);
|
|
|
b6b438 |
|
|
|
b6b438 |
+/***********************************************************
|
|
|
b6b438 |
+ Encode an arc4 password change buffer.
|
|
|
b6b438 |
+************************************************************/
|
|
|
b6b438 |
+NTSTATUS encode_rc4_passwd_buffer(const char *passwd,
|
|
|
b6b438 |
+ const DATA_BLOB *session_key,
|
|
|
b6b438 |
+ struct samr_CryptPasswordEx *out_crypt_pwd);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
/***********************************************************
|
|
|
b6b438 |
Decode an arc4 encrypted password change buffer.
|
|
|
b6b438 |
************************************************************/
|
|
|
b6b438 |
diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
index b7b17130f07..793012553b2 100644
|
|
|
b6b438 |
--- a/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
+++ b/libcli/auth/smbencrypt.c
|
|
|
b6b438 |
@@ -839,6 +839,48 @@ bool decode_pw_buffer(TALLOC_CTX *ctx,
|
|
|
b6b438 |
return true;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
+/***********************************************************
|
|
|
b6b438 |
+ Encode an arc4 password change buffer.
|
|
|
b6b438 |
+************************************************************/
|
|
|
b6b438 |
+NTSTATUS encode_rc4_passwd_buffer(const char *passwd,
|
|
|
b6b438 |
+ const DATA_BLOB *session_key,
|
|
|
b6b438 |
+ struct samr_CryptPasswordEx *out_crypt_pwd)
|
|
|
b6b438 |
+{
|
|
|
b6b438 |
+ uint8_t _confounder[16] = {0};
|
|
|
b6b438 |
+ DATA_BLOB confounder = data_blob_const(_confounder, 16);
|
|
|
b6b438 |
+ DATA_BLOB pw_data = data_blob_const(out_crypt_pwd->data, 516);
|
|
|
b6b438 |
+ bool ok;
|
|
|
b6b438 |
+ int rc;
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ ok = encode_pw_buffer(pw_data.data, passwd, STR_UNICODE);
|
|
|
b6b438 |
+ if (!ok) {
|
|
|
b6b438 |
+ return NT_STATUS_INVALID_PARAMETER;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ generate_random_buffer(confounder.data, confounder.length);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ rc = samba_gnutls_arcfour_confounded_md5(&confounder,
|
|
|
b6b438 |
+ session_key,
|
|
|
b6b438 |
+ &pw_data,
|
|
|
b6b438 |
+ SAMBA_GNUTLS_ENCRYPT);
|
|
|
b6b438 |
+ if (rc < 0) {
|
|
|
b6b438 |
+ ZERO_ARRAY(_confounder);
|
|
|
b6b438 |
+ data_blob_clear(&pw_data);
|
|
|
b6b438 |
+ return gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ /*
|
|
|
b6b438 |
+ * The packet format is the 516 byte RC4 encrypted
|
|
|
b6b438 |
+ * pasword followed by the 16 byte counfounder
|
|
|
b6b438 |
+ * The confounder is a salt to prevent pre-computed hash attacks on the
|
|
|
b6b438 |
+ * database.
|
|
|
b6b438 |
+ */
|
|
|
b6b438 |
+ memcpy(&out_crypt_pwd->data[516], confounder.data, confounder.length);
|
|
|
b6b438 |
+ ZERO_ARRAY(_confounder);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ return NT_STATUS_OK;
|
|
|
b6b438 |
+}
|
|
|
b6b438 |
+
|
|
|
b6b438 |
/***********************************************************
|
|
|
b6b438 |
Decode an arc4 encrypted password change buffer.
|
|
|
b6b438 |
************************************************************/
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|