|
 |
b6b438 |
From 36dfd6496dc9b954b2243bbb5293af8ce332cf4f Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Wed, 16 Jan 2019 12:41:32 +0100
|
|
|
b6b438 |
Subject: [PATCH 032/187] s3:rpc_client: Use init_samr_CryptPassword in
|
|
|
b6b438 |
cli_samr rpc_client
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit a95647e12ac75ffda42d95b41144596a078aebd6)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
source3/rpc_client/cli_samr.c | 59 ++++++++++++++++++++++++++++-------
|
|
|
b6b438 |
source3/wscript_build | 2 +-
|
|
|
b6b438 |
2 files changed, 48 insertions(+), 13 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c
|
|
|
b6b438 |
index 7764e1a8540..452e9593f6a 100644
|
|
|
b6b438 |
--- a/source3/rpc_client/cli_samr.c
|
|
|
b6b438 |
+++ b/source3/rpc_client/cli_samr.c
|
|
|
b6b438 |
@@ -26,8 +26,8 @@
|
|
|
b6b438 |
#include "../libcli/auth/libcli_auth.h"
|
|
|
b6b438 |
#include "../librpc/gen_ndr/ndr_samr_c.h"
|
|
|
b6b438 |
#include "rpc_client/cli_samr.h"
|
|
|
b6b438 |
-#include "../lib/crypto/arcfour.h"
|
|
|
b6b438 |
#include "rpc_client/init_lsa.h"
|
|
|
b6b438 |
+#include "rpc_client/init_samr.h"
|
|
|
b6b438 |
|
|
|
b6b438 |
/* User change password */
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -128,6 +128,8 @@ NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
uint8_t new_lanman_hash[16];
|
|
|
b6b438 |
struct lsa_String server, account;
|
|
|
b6b438 |
|
|
|
b6b438 |
+ DATA_BLOB session_key = data_blob_const(old_nt_hash, 16);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
DEBUG(10,("rpccli_samr_chgpasswd_user2\n"));
|
|
|
b6b438 |
|
|
|
b6b438 |
init_lsa_String(&server, srv_name_slash);
|
|
|
b6b438 |
@@ -144,19 +146,25 @@ NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
DOS chars). This allows us to match Win2k, which
|
|
|
b6b438 |
does not store a LM hash for these passwords (which
|
|
|
b6b438 |
would reduce the effective password length to 14) */
|
|
|
b6b438 |
+ status = init_samr_CryptPassword(newpassword,
|
|
|
b6b438 |
+ &session_key,
|
|
|
b6b438 |
+ &new_lm_password);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
|
|
|
b6b438 |
- encode_pw_buffer(new_lm_password.data, newpassword, STR_UNICODE);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- arcfour_crypt(new_lm_password.data, old_nt_hash, 516);
|
|
|
b6b438 |
E_old_pw_hash(new_nt_hash, old_lanman_hash, old_lanman_hash_enc.hash);
|
|
|
b6b438 |
} else {
|
|
|
b6b438 |
ZERO_STRUCT(new_lm_password);
|
|
|
b6b438 |
ZERO_STRUCT(old_lanman_hash_enc);
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- encode_pw_buffer(new_nt_password.data, newpassword, STR_UNICODE);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- arcfour_crypt(new_nt_password.data, old_nt_hash, 516);
|
|
|
b6b438 |
+ status = init_samr_CryptPassword(newpassword,
|
|
|
b6b438 |
+ &session_key,
|
|
|
b6b438 |
+ &new_nt_password);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
|
|
|
b6b438 |
|
|
|
b6b438 |
status = dcerpc_samr_ChangePasswordUser2(h,
|
|
|
b6b438 |
@@ -170,6 +178,15 @@ NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
&old_lanman_hash_enc,
|
|
|
b6b438 |
presult);
|
|
|
b6b438 |
|
|
|
b6b438 |
+ ZERO_STRUCT(new_nt_password);
|
|
|
b6b438 |
+ ZERO_STRUCT(new_lm_password);
|
|
|
b6b438 |
+ ZERO_STRUCT(old_nt_hash_enc);
|
|
|
b6b438 |
+ ZERO_STRUCT(old_lanman_hash_enc);
|
|
|
b6b438 |
+ ZERO_ARRAY(new_nt_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(new_lanman_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(old_nt_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(old_lanman_hash);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -308,6 +325,8 @@ NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
|
|
|
b6b438 |
struct lsa_String server, account;
|
|
|
b6b438 |
|
|
|
b6b438 |
+ DATA_BLOB session_key = data_blob_const(old_nt_hash, 16);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
DEBUG(10,("rpccli_samr_chgpasswd_user3\n"));
|
|
|
b6b438 |
|
|
|
b6b438 |
init_lsa_String(&server, srv_name_slash);
|
|
|
b6b438 |
@@ -324,19 +343,26 @@ NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
DOS chars). This allows us to match Win2k, which
|
|
|
b6b438 |
does not store a LM hash for these passwords (which
|
|
|
b6b438 |
would reduce the effective password length to 14) */
|
|
|
b6b438 |
+ status = init_samr_CryptPassword(newpassword,
|
|
|
b6b438 |
+ &session_key,
|
|
|
b6b438 |
+ &new_lm_password);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
|
|
|
b6b438 |
- encode_pw_buffer(new_lm_password.data, newpassword, STR_UNICODE);
|
|
|
b6b438 |
-
|
|
|
b6b438 |
- arcfour_crypt(new_lm_password.data, old_nt_hash, 516);
|
|
|
b6b438 |
E_old_pw_hash(new_nt_hash, old_lanman_hash, old_lanman_hash_enc.hash);
|
|
|
b6b438 |
} else {
|
|
|
b6b438 |
ZERO_STRUCT(new_lm_password);
|
|
|
b6b438 |
ZERO_STRUCT(old_lanman_hash_enc);
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
- encode_pw_buffer(new_nt_password.data, newpassword, STR_UNICODE);
|
|
|
b6b438 |
+ status = init_samr_CryptPassword(newpassword,
|
|
|
b6b438 |
+ &session_key,
|
|
|
b6b438 |
+ &new_nt_password);
|
|
|
b6b438 |
+ if (!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
|
|
|
b6b438 |
- arcfour_crypt(new_nt_password.data, old_nt_hash, 516);
|
|
|
b6b438 |
E_old_pw_hash(new_nt_hash, old_nt_hash, old_nt_hash_enc.hash);
|
|
|
b6b438 |
|
|
|
b6b438 |
status = dcerpc_samr_ChangePasswordUser3(h,
|
|
|
b6b438 |
@@ -353,6 +379,15 @@ NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h,
|
|
|
b6b438 |
reject,
|
|
|
b6b438 |
presult);
|
|
|
b6b438 |
|
|
|
b6b438 |
+ ZERO_STRUCT(new_nt_password);
|
|
|
b6b438 |
+ ZERO_STRUCT(new_lm_password);
|
|
|
b6b438 |
+ ZERO_STRUCT(old_nt_hash_enc);
|
|
|
b6b438 |
+ ZERO_STRUCT(old_lanman_hash_enc);
|
|
|
b6b438 |
+ ZERO_ARRAY(new_nt_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(new_lanman_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(old_nt_hash);
|
|
|
b6b438 |
+ ZERO_ARRAY(old_lanman_hash);
|
|
|
b6b438 |
+
|
|
|
b6b438 |
return status;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/source3/wscript_build b/source3/wscript_build
|
|
|
b6b438 |
index aa3c7175202..b73f6dc0664 100644
|
|
|
b6b438 |
--- a/source3/wscript_build
|
|
|
b6b438 |
+++ b/source3/wscript_build
|
|
|
b6b438 |
@@ -1009,7 +1009,7 @@ bld.SAMBA3_SUBSYSTEM('errors3',
|
|
|
b6b438 |
|
|
|
b6b438 |
bld.SAMBA3_SUBSYSTEM('LIBCLI_SAMR',
|
|
|
b6b438 |
source='rpc_client/cli_samr.c',
|
|
|
b6b438 |
- deps='RPC_NDR_SAMR')
|
|
|
b6b438 |
+ deps='RPC_NDR_SAMR INIT_SAMR')
|
|
|
b6b438 |
|
|
|
b6b438 |
bld.SAMBA3_LIBRARY('libcli_lsa3',
|
|
|
b6b438 |
source='rpc_client/cli_lsarpc.c',
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|