From f0d05dc2dce30f851f9e1eb6a1952730dfe907f6 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Jul 2019 17:18:50 +1200
Subject: [PATCH 051/187] s4:torture: clarify comments and variable names in
"ChangePasswordUser3 tests
There is no session key here, the buffers are directly encrypted
with the long-term passwords.
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 8380668be7963b74cbbd31bfab3d01d1f3089034)
---
source4/torture/rpc/samr.c | 43 +++++++++++++++++++++++++++++---------
1 file changed, 33 insertions(+), 10 deletions(-)
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 55059a26b43..20afa9392e2 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -2472,7 +2472,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
NTTIME t;
struct samr_DomInfo1 *dominfo = NULL;
struct userPwdChangeFailureInformation *reject = NULL;
- DATA_BLOB session_key = data_blob_const(old_nt_hash, 16);
+ DATA_BLOB old_nt_hash_blob = data_blob_const(old_nt_hash, 16);
NTSTATUS status;
torture_comment(tctx, "Testing ChangePasswordUser3\n");
@@ -2502,22 +2502,45 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
E_deshash(oldpass, old_lm_hash);
E_deshash(newpass, new_lm_hash);
+ /*
+ * The new plaintext password is encrypted using RC4 with the
+ * old NT password hash (directly, with no confounder). The
+ * password is at the end of the random padded buffer,
+ * offering a little protection.
+ *
+ * This is almost certainly wrong, it should be the old LM
+ * hash, it was switched in an unrelated commit
+ * 579c13da43d5b40ac6d6c1436399fbc1d8dfd054 in 2004.
+ */
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&lm_pass);
torture_assert_ntstatus_ok(tctx,
status,
"init_samr_CryptPassword");
+ /*
+ * Now we prepare a DES cross-hash of the old LM and new NT
+ * passwords to link the two buffers
+ */
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
+ /*
+ * The new plaintext password is also encrypted using RC4 with
+ * the old NT password hash (directly, with no confounder).
+ * The password is at the end of the random padded buffer,
+ * offering a little protection.
+ */
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&nt_pass);
torture_assert_ntstatus_ok(tctx,
status,
"init_samr_CryptPassword");
+ /*
+ * Another DES based cross-hash
+ */
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
/* Break the verification */
@@ -2547,7 +2570,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
}
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&lm_pass);
torture_assert_ntstatus_ok(tctx,
status,
@@ -2555,18 +2578,18 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
- /* Break the session key */
- session_key.data[0]++;
+ /* Break the NT Hash */
+ old_nt_hash[0]++;
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&nt_pass);
torture_assert_ntstatus_ok(tctx,
status,
"init_samr_CryptPassword");
/* Unbreak it again */
- session_key.data[0]--;
+ old_nt_hash[0]--;
E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
@@ -2615,7 +2638,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
E_deshash(newpass, new_lm_hash);
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&lm_pass);
torture_assert_ntstatus_ok(tctx,
status,
@@ -2624,7 +2647,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct
E_old_pw_hash(new_nt_hash, old_lm_hash, lm_verifier.hash);
status = init_samr_CryptPassword(newpass,
- &session_key,
+ &old_nt_hash_blob,
&nt_pass);
torture_assert_ntstatus_ok(tctx,
status,
--
2.23.0