|
 |
b6b438 |
From c82322be0012f8bf467d75681bd82322eba11145 Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Tue, 9 Jul 2019 13:01:49 +0200
|
|
|
b6b438 |
Subject: [PATCH 020/187] s4:libnet: Use encode_rc4_passwd_buffer() in
|
|
|
b6b438 |
libnet_SetPassword_samr_handle_26()
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit 5afa402bb7ba11a8eefc6e14047eeec1f3327681)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
source4/libnet/libnet_passwd.c | 47 ++++++++--------------------------
|
|
|
b6b438 |
1 file changed, 11 insertions(+), 36 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
|
|
|
b6b438 |
index 97ce7f58ddf..0beea077bd0 100644
|
|
|
b6b438 |
--- a/source4/libnet/libnet_passwd.c
|
|
|
b6b438 |
+++ b/source4/libnet/libnet_passwd.c
|
|
|
b6b438 |
@@ -23,6 +23,7 @@
|
|
|
b6b438 |
#include "../lib/crypto/crypto.h"
|
|
|
b6b438 |
#include "libcli/auth/libcli_auth.h"
|
|
|
b6b438 |
#include "librpc/gen_ndr/ndr_samr_c.h"
|
|
|
b6b438 |
+#include "source4/librpc/rpc/dcerpc.h"
|
|
|
b6b438 |
|
|
|
b6b438 |
#include "lib/crypto/gnutls_helpers.h"
|
|
|
b6b438 |
#include <gnutls/gnutls.h>
|
|
|
b6b438 |
@@ -276,10 +277,6 @@ static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TA
|
|
|
b6b438 |
struct samr_SetUserInfo2 sui;
|
|
|
b6b438 |
union samr_UserInfo u_info;
|
|
|
b6b438 |
DATA_BLOB session_key;
|
|
|
b6b438 |
- DATA_BLOB confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
|
|
|
b6b438 |
- uint8_t confounder[16];
|
|
|
b6b438 |
- gnutls_hash_hd_t hash_hnd = NULL;
|
|
|
b6b438 |
- int rc;
|
|
|
b6b438 |
|
|
|
b6b438 |
if (r->samr_handle.in.info21) {
|
|
|
b6b438 |
return NT_STATUS_INVALID_PARAMETER_MIX;
|
|
|
b6b438 |
@@ -287,9 +284,8 @@ static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TA
|
|
|
b6b438 |
|
|
|
b6b438 |
/* prepare samr_SetUserInfo2 level 26 */
|
|
|
b6b438 |
ZERO_STRUCT(u_info);
|
|
|
b6b438 |
- encode_pw_buffer(u_info.info26.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
|
|
|
b6b438 |
u_info.info26.password_expired = 0;
|
|
|
b6b438 |
-
|
|
|
b6b438 |
+
|
|
|
b6b438 |
status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
|
|
|
b6b438 |
if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
|
|
|
b6b438 |
@@ -297,38 +293,18 @@ static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TA
|
|
|
b6b438 |
nt_errstr(status));
|
|
|
b6b438 |
return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- generate_random_buffer((uint8_t *)confounder, 16);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
|
|
|
b6b438 |
- if (rc < 0) {
|
|
|
b6b438 |
- status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
- }
|
|
|
b6b438 |
|
|
|
b6b438 |
- rc = gnutls_hash(hash_hnd, confounder, 16);
|
|
|
b6b438 |
- if (rc < 0) {
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, NULL);
|
|
|
b6b438 |
- status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
- }
|
|
|
b6b438 |
- rc = gnutls_hash(hash_hnd, session_key.data, session_key.length);
|
|
|
b6b438 |
- if (rc < 0) {
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, NULL);
|
|
|
b6b438 |
- status = gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
|
|
|
b6b438 |
- goto out;
|
|
|
b6b438 |
+ status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
|
|
|
b6b438 |
+ &session_key,
|
|
|
b6b438 |
+ &u_info.info26.password);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ r->samr_handle.out.error_string =
|
|
|
b6b438 |
+ talloc_asprintf(mem_ctx,
|
|
|
b6b438 |
+ "encode_rc4_passwd_buffer failed: %s",
|
|
|
b6b438 |
+ nt_errstr(status));
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- gnutls_hash_deinit(hash_hnd, confounded_session_key.data);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- arcfour_crypt_blob(u_info.info26.password.data, 516, &confounded_session_key);
|
|
|
b6b438 |
- ZERO_ARRAY_LEN(confounded_session_key.data,
|
|
|
b6b438 |
- confounded_session_key.length);
|
|
|
b6b438 |
- data_blob_free(&confounded_session_key);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- memcpy(&u_info.info26.password.data[516], confounder, 16);
|
|
|
b6b438 |
- ZERO_ARRAY(confounder);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
sui.in.user_handle = r->samr_handle.in.user_handle;
|
|
|
b6b438 |
sui.in.info = &u_info;
|
|
|
b6b438 |
sui.in.level = 26;
|
|
|
b6b438 |
@@ -346,7 +322,6 @@ static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TA
|
|
|
b6b438 |
r->samr_handle.in.account_name, nt_errstr(status));
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
-out:
|
|
|
b6b438 |
return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|