|
 |
b6b438 |
From 6eb8a45387ae6400d4b48d838ec89510afe2b37a Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Wed, 15 May 2019 14:04:31 +0200
|
|
|
b6b438 |
Subject: [PATCH 034/187] s3:rpc_server: Use GnuTLS RC4 to decrypt samr
|
|
|
b6b438 |
password buffers
|
|
|
b6b438 |
|
|
|
b6b438 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
b6b438 |
(cherry picked from commit cd0b5e5d9377bc79b4468081f3999ad39be3cb8f)
|
|
|
b6b438 |
---
|
|
|
b6b438 |
source3/rpc_server/samr/srv_samr_nt.c | 58 ++++++++++++++++++++++++---
|
|
|
b6b438 |
1 file changed, 52 insertions(+), 6 deletions(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
|
|
|
b6b438 |
index fd5c453e0eb..ad1d1853bda 100644
|
|
|
b6b438 |
--- a/source3/rpc_server/samr/srv_samr_nt.c
|
|
|
b6b438 |
+++ b/source3/rpc_server/samr/srv_samr_nt.c
|
|
|
b6b438 |
@@ -37,7 +37,6 @@
|
|
|
b6b438 |
#include "ntdomain.h"
|
|
|
b6b438 |
#include "../librpc/gen_ndr/srv_samr.h"
|
|
|
b6b438 |
#include "rpc_server/samr/srv_samr_util.h"
|
|
|
b6b438 |
-#include "../lib/crypto/arcfour.h"
|
|
|
b6b438 |
#include "secrets.h"
|
|
|
b6b438 |
#include "rpc_client/init_lsa.h"
|
|
|
b6b438 |
#include "../libcli/security/security.h"
|
|
|
b6b438 |
@@ -47,6 +46,10 @@
|
|
|
b6b438 |
#include "../lib/tsocket/tsocket.h"
|
|
|
b6b438 |
#include "lib/util/base64.h"
|
|
|
b6b438 |
|
|
|
b6b438 |
+#include "lib/crypto/gnutls_helpers.h"
|
|
|
b6b438 |
+#include <gnutls/gnutls.h>
|
|
|
b6b438 |
+#include <gnutls/crypto.h>
|
|
|
b6b438 |
+
|
|
|
b6b438 |
#undef DBGC_CLASS
|
|
|
b6b438 |
#define DBGC_CLASS DBGC_RPC_SRV
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -4946,6 +4949,41 @@ static uint32_t samr_set_user_info_map_fields_to_access_mask(uint32_t fields)
|
|
|
b6b438 |
return acc_required;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
+static NTSTATUS arc4_decrypt_data(DATA_BLOB session_key,
|
|
|
b6b438 |
+ uint8_t *data,
|
|
|
b6b438 |
+ size_t data_size)
|
|
|
b6b438 |
+{
|
|
|
b6b438 |
+ gnutls_cipher_hd_t cipher_hnd = NULL;
|
|
|
b6b438 |
+ gnutls_datum_t my_session_key = {
|
|
|
b6b438 |
+ .data = session_key.data,
|
|
|
b6b438 |
+ .size = session_key.length,
|
|
|
b6b438 |
+ };
|
|
|
b6b438 |
+ NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
|
|
|
b6b438 |
+ int rc;
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ rc = gnutls_cipher_init(&cipher_hnd,
|
|
|
b6b438 |
+ GNUTLS_CIPHER_ARCFOUR_128,
|
|
|
b6b438 |
+ &my_session_key,
|
|
|
b6b438 |
+ NULL);
|
|
|
b6b438 |
+ if (rc < 0) {
|
|
|
b6b438 |
+ status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
|
b6b438 |
+ goto out;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ rc = gnutls_cipher_decrypt(cipher_hnd,
|
|
|
b6b438 |
+ data,
|
|
|
b6b438 |
+ data_size);
|
|
|
b6b438 |
+ gnutls_cipher_deinit(cipher_hnd);
|
|
|
b6b438 |
+ if (rc < 0) {
|
|
|
b6b438 |
+ status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
|
|
|
b6b438 |
+ goto out;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ status = NT_STATUS_OK;
|
|
|
b6b438 |
+out:
|
|
|
b6b438 |
+ return status;
|
|
|
b6b438 |
+}
|
|
|
b6b438 |
+
|
|
|
b6b438 |
/*******************************************************************
|
|
|
b6b438 |
samr_SetUserInfo
|
|
|
b6b438 |
********************************************************************/
|
|
|
b6b438 |
@@ -5153,8 +5191,12 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
|
b6b438 |
if(!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
break;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
- arcfour_crypt_blob(info->info23.password.data, 516,
|
|
|
b6b438 |
- &session_key);
|
|
|
b6b438 |
+ status = arc4_decrypt_data(session_key,
|
|
|
b6b438 |
+ info->info23.password.data,
|
|
|
b6b438 |
+ 516);
|
|
|
b6b438 |
+ if(!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ break;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
|
|
|
b6b438 |
dump_data(100, info->info23.password.data, 516);
|
|
|
b6b438 |
|
|
|
b6b438 |
@@ -5165,13 +5207,17 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p,
|
|
|
b6b438 |
break;
|
|
|
b6b438 |
|
|
|
b6b438 |
case 24:
|
|
|
b6b438 |
+
|
|
|
b6b438 |
status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES);
|
|
|
b6b438 |
if(!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
break;
|
|
|
b6b438 |
}
|
|
|
b6b438 |
- arcfour_crypt_blob(info->info24.password.data,
|
|
|
b6b438 |
- 516,
|
|
|
b6b438 |
- &session_key);
|
|
|
b6b438 |
+ status = arc4_decrypt_data(session_key,
|
|
|
b6b438 |
+ info->info24.password.data,
|
|
|
b6b438 |
+ 516);
|
|
|
b6b438 |
+ if(!NT_STATUS_IS_OK(status)) {
|
|
|
b6b438 |
+ break;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
|
|
|
b6b438 |
dump_data(100, info->info24.password.data, 516);
|
|
|
b6b438 |
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|