sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Code
054195df9b
samba-mirror/source/rpcclient/cmd_lsarpc.c

378 lines
8.7 KiB
C
Raw Normal View History

added rpcclient program
0001-01-01 02:30:17 +02:30
/*
Unix SMB/Netbios implementation.
Version 1.9.
NT Domain Authentication SMB / MSRPC client
adding experimental set user password command to rpcclient, it returns error wrong password against nt. ????
0001-01-01 02:30:17 +02:30
Copyright (C) Andrew Tridgell 1994-1999
Copyright (C) Luke Kenneth Casson Leighton 1996-1999
added rpcclient program
0001-01-01 02:30:17 +02:30
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#ifdef SYSLOG
#undef SYSLOG
#endif
#include "includes.h"
#include "nterr.h"
extern int DEBUGLEVEL;
#define DEBUG_TESTING
extern FILE* out_hnd;
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
/****************************************************************************
nt enumerate trusted domains
****************************************************************************/
okay :) all cmd_() functions now take int argc, char **argv :) that means that some commands need more work, as they still use next_token(), the use of which i wish to avoid. plus, i was getting fed up of the poor command-line processing in some of these commands. i'm starting to need getopt() in them, especially in samsetuser. WARNING: only cmd_samr has been modded to use getopt() so far! reg commands won't work, esp.
0001-01-01 02:30:17 +02:30
void cmd_lsa_enum_trust_dom(struct client_info *info, int argc, char *argv[])
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
{
fstring srv_name;
uint32 num_doms = 0;
char **domains = NULL;
DOM_SID **sids = NULL;
uint32 enum_ctx = 0;
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
POLICY_HND lsa_pol;
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
BOOL res = True;
fstrcpy(srv_name, "\\\\");
ok. *whew*. this is the first completed part of the restructure. verified that lsaquery, lsalookupsids work, and found some bugs in the parameters of these commands :-) soo... we now have an lsa_* api that has the same arguments as the nt Lsa* api! cool! the only significant coding difference is the introduction of a user_credentials structure, containing user, domain, pass and ntlmssp flags.
0001-01-01 02:30:17 +02:30
fstrcat(srv_name, info->dest_host);
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
strupper(srv_name);
DEBUG(4,("cmd_lsa_enum_trust_dom: server:%s\n", srv_name));
/* lookup domain controller; receive a policy handle */
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
res = res ? lsa_open_policy( srv_name,
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
&lsa_pol, False) : False;
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
do
{
/* send enum trusted domains query */
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_enum_trust_dom( &lsa_pol,
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
&enum_ctx,
&num_doms, &domains, &sids) : False;
} while (res && enum_ctx != 0);
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_close(&lsa_pol) : False;
added lsaenumdomains command. attempting to get blood out of a stone^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H querysecret to work, it keeps returning access denied.
0001-01-01 02:30:17 +02:30
if (res)
{
uint32 i;
DEBUG(5,("cmd_lsa_enum_trust_dom: query succeeded\n"));
report(out_hnd, "LSA Enumerate Trusted Domains\n");
for (i = 0; i < num_doms; i++)
{
fstring sid;
sid_to_string(sid, sids[i]);
report(out_hnd, "Domain:\t%s\tSID:\t%s\n",
domains[i], sid);
}
}
else
{
DEBUG(5,("cmd_lsa_enum_trust_dom: query failed\n"));
}
free_char_array(num_doms, domains);
free_sid_array(num_doms, sids);
}
added rpcclient program
0001-01-01 02:30:17 +02:30
/****************************************************************************
nt lsa query
****************************************************************************/
okay :) all cmd_() functions now take int argc, char **argv :) that means that some commands need more work, as they still use next_token(), the use of which i wish to avoid. plus, i was getting fed up of the poor command-line processing in some of these commands. i'm starting to need getopt() in them, especially in samsetuser. WARNING: only cmd_samr has been modded to use getopt() so far! reg commands won't work, esp.
0001-01-01 02:30:17 +02:30
void cmd_lsa_query_info(struct client_info *info, int argc, char *argv[])
added rpcclient program
0001-01-01 02:30:17 +02:30
{
fstring srv_name;
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
POLICY_HND lsa_pol;
added rpcclient program
0001-01-01 02:30:17 +02:30
BOOL res = True;
fstrcpy(info->dom.level3_dom, "");
fstrcpy(info->dom.level5_dom, "");
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
ZERO_STRUCT(info->dom.level3_sid);
ZERO_STRUCT(info->dom.level5_sid);
added rpcclient program
0001-01-01 02:30:17 +02:30
fstrcpy(srv_name, "\\\\");
ok. *whew*. this is the first completed part of the restructure. verified that lsaquery, lsalookupsids work, and found some bugs in the parameters of these commands :-) soo... we now have an lsa_* api that has the same arguments as the nt Lsa* api! cool! the only significant coding difference is the introduction of a user_credentials structure, containing user, domain, pass and ntlmssp flags.
0001-01-01 02:30:17 +02:30
fstrcat(srv_name, info->dest_host);
added rpcclient program
0001-01-01 02:30:17 +02:30
strupper(srv_name);
DEBUG(4,("cmd_lsa_query_info: server:%s\n", srv_name));
/* lookup domain controller; receive a policy handle */
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
res = res ? lsa_open_policy( srv_name,
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
&lsa_pol, False) : False;
added rpcclient program
0001-01-01 02:30:17 +02:30
/* send client info query, level 3. receive domain name and sid */
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_query_info_pol( &lsa_pol, 0x03,
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
info->dom.level3_dom,
&info->dom.level3_sid) : False;
added rpcclient program
0001-01-01 02:30:17 +02:30
/* send client info query, level 5. receive domain name and sid */
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_query_info_pol( &lsa_pol, 0x05,
added rpcclient program
0001-01-01 02:30:17 +02:30
info->dom.level5_dom,
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
&info->dom.level5_sid) : False;
added rpcclient program
0001-01-01 02:30:17 +02:30
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_close(&lsa_pol) : False;
added rpcclient program
0001-01-01 02:30:17 +02:30
if (res)
{
BOOL domain_something = False;
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
fstring sid;
added rpcclient program
0001-01-01 02:30:17 +02:30
DEBUG(5,("cmd_lsa_query_info: query succeeded\n"));
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "LSA Query Info Policy\n");
added rpcclient program
0001-01-01 02:30:17 +02:30
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
if (info->dom.level3_dom[0] != 0)
added rpcclient program
0001-01-01 02:30:17 +02:30
{
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
sid_to_string(sid, &info->dom.level3_sid);
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "Domain Member - Domain: %s SID: %s\n",
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
info->dom.level3_dom, sid);
added rpcclient program
0001-01-01 02:30:17 +02:30
domain_something = True;
}
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
if (info->dom.level5_dom[0] != 0)
added rpcclient program
0001-01-01 02:30:17 +02:30
{
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
sid_to_string(sid, &info->dom.level5_sid);
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "Domain Controller - Domain: %s SID: %s\n",
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
info->dom.level5_dom, sid);
added rpcclient program
0001-01-01 02:30:17 +02:30
domain_something = True;
}
if (!domain_something)
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "%s is not a Domain Member or Controller\n",
added rpcclient program
0001-01-01 02:30:17 +02:30
info->dest_host);
}
}
else
{
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
DEBUG(5,("cmd_lsa_query_info: query failed\n"));
}
}
/****************************************************************************
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
lookup names
****************************************************************************/
okay :) all cmd_() functions now take int argc, char **argv :) that means that some commands need more work, as they still use next_token(), the use of which i wish to avoid. plus, i was getting fed up of the poor command-line processing in some of these commands. i'm starting to need getopt() in them, especially in samsetuser. WARNING: only cmd_samr has been modded to use getopt() so far! reg commands won't work, esp.
0001-01-01 02:30:17 +02:30
void cmd_lsa_lookup_names(struct client_info *info, int argc, char *argv[])
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
{
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
POLICY_HND lsa_pol;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
fstring temp;
int i;
fstring srv_name;
int num_names = 0;
another two.
0001-01-01 02:30:17 +02:30
char **names;
uninitialised pointer being freed if lookupnames failed. oops.
0001-01-01 02:30:17 +02:30
DOM_SID *sids = NULL;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
int num_sids = 0;
#if 0
DOM_SID sid[10];
DOM_SID *sids[10];
#endif
BOOL res = True;
fstrcpy(srv_name, "\\\\");
ok. *whew*. this is the first completed part of the restructure. verified that lsaquery, lsalookupsids work, and found some bugs in the parameters of these commands :-) soo... we now have an lsa_* api that has the same arguments as the nt Lsa* api! cool! the only significant coding difference is the introduction of a user_credentials structure, containing user, domain, pass and ntlmssp flags.
0001-01-01 02:30:17 +02:30
fstrcat(srv_name, info->dest_host);
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
strupper(srv_name);
DEBUG(4,("cmd_lsa_lookup_names: server: %s\n", srv_name));
another two.
0001-01-01 02:30:17 +02:30
argc--;
argv++;
num_names = argc;
names = argv;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
another two.
0001-01-01 02:30:17 +02:30
if (num_names <= 0)
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "lookupnames <name> [<name> ...]\n");
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
return;
}
/* lookup domain controller; receive a policy handle */
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
res = res ? lsa_open_policy( srv_name,
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
&lsa_pol, True) : False;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
/* send lsa lookup sids call */
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_lookup_names( &lsa_pol,
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
num_names, names,
added sid_name_use array argument to lsa_lookup_names and lsa_lookup_sids.
0001-01-01 02:30:17 +02:30
&sids, NULL, &num_sids) : False;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_close(&lsa_pol) : False;
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
if (res)
{
DEBUG(5,("cmd_lsa_lookup_names: query succeeded\n"));
}
else
{
DEBUG(5,("cmd_lsa_lookup_names: query failed\n"));
}
if (sids != NULL)
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "Lookup Names:\n");
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
for (i = 0; i < num_sids; i++)
{
sid_to_string(temp, &sids[i]);
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "SID: %s -> %s\n", names[i], temp);
LsaLookupNames client call (first used as lookupnames command in rpcclient).
0001-01-01 02:30:17 +02:30
#if 0
if (sids[i] != NULL)
{
free(sids[i]);
}
#endif
}
free(sids);
}
}
/****************************************************************************
lookup sids
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
****************************************************************************/
okay :) all cmd_() functions now take int argc, char **argv :) that means that some commands need more work, as they still use next_token(), the use of which i wish to avoid. plus, i was getting fed up of the poor command-line processing in some of these commands. i'm starting to need getopt() in them, especially in samsetuser. WARNING: only cmd_samr has been modded to use getopt() so far! reg commands won't work, esp.
0001-01-01 02:30:17 +02:30
void cmd_lsa_lookup_sids(struct client_info *info, int argc, char *argv[])
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
{
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
POLICY_HND lsa_pol;
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
int i;
pstring sid_name;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
fstring srv_name;
another two.
0001-01-01 02:30:17 +02:30
DOM_SID **sids = NULL;
uint32 num_sids = 0;
Fix another possibly unitialized variable ...
0001-01-01 02:30:17 +02:30
char **names = NULL;
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
int num_names = 0;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
BOOL res = True;
fstrcpy(srv_name, "\\\\");
ok. *whew*. this is the first completed part of the restructure. verified that lsaquery, lsalookupsids work, and found some bugs in the parameters of these commands :-) soo... we now have an lsa_* api that has the same arguments as the nt Lsa* api! cool! the only significant coding difference is the introduction of a user_credentials structure, containing user, domain, pass and ntlmssp flags.
0001-01-01 02:30:17 +02:30
fstrcat(srv_name, info->dest_host);
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
strupper(srv_name);
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
DEBUG(4,("cmd_lsa_lookup_sids: server: %s\n", srv_name));
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
another two.
0001-01-01 02:30:17 +02:30
argv++;
argc--;
while (argc > 0)
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
{
another two.
0001-01-01 02:30:17 +02:30
DOM_SID sid;
if (strnequal("S-", argv[0], 2))
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
{
another two.
0001-01-01 02:30:17 +02:30
fstrcpy(sid_name, argv[0]);
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
}
else
{
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
sid_to_string(sid_name, &info->dom.level5_sid);
if (sid_name[0] == 0)
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "please use lsaquery first or specify a complete SID\n");
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
return;
}
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
fstrcat(sid_name, "-");
another two.
0001-01-01 02:30:17 +02:30
fstrcat(sid_name, argv[0]);
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
}
another two.
0001-01-01 02:30:17 +02:30
string_to_sid(&sid, sid_name);
add_sid_to_array(&num_sids, &sids, &sid);
argc--;
argv++;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
}
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
if (num_sids == 0)
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "lookupsid RID or SID\n");
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
return;
}
/* lookup domain controller; receive a policy handle */
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
res = res ? lsa_open_policy( srv_name,
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
&lsa_pol, True) : False;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
/* send lsa lookup sids call */
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_lookup_sids( &lsa_pol,
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
num_sids, sids,
added sid_name_use array argument to lsa_lookup_names and lsa_lookup_sids.
0001-01-01 02:30:17 +02:30
&names, NULL, &num_names) : False;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
remove use of client_info lsa_info_pol.
0001-01-01 02:30:17 +02:30
res = res ? lsa_close(&lsa_pol) : False;
lsa_lookup_sids command added. severe debugging needed on lookup_sids code. added "quality of service" capability to lsa_open_policy code. different lsa_open_policy queries are *not* dealt with in the server code. answers like "0xC000 0022" - access denied - will have to be made to lsa_lookup_sids calls when a "quality of service" request is *not* specified in the lsa_open_policy call.
0001-01-01 02:30:17 +02:30
if (res)
{
DEBUG(5,("cmd_lsa_lookup_sids: query succeeded\n"));
}
else
{
DEBUG(5,("cmd_lsa_lookup_sids: query failed\n"));
added rpcclient program
0001-01-01 02:30:17 +02:30
}
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
if (names != NULL)
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "Lookup SIDS:\n");
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
for (i = 0; i < num_names; i++)
{
another two.
0001-01-01 02:30:17 +02:30
fstring temp;
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
sid_to_string(temp, sids[i]);
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "SID: %s -> %s\n", temp, names[i]);
changed syntax of registry commands so keys can start with HKLM or HKU. sorted lookupsids command
0001-01-01 02:30:17 +02:30
if (names[i] != NULL)
{
free(names[i]);
}
}
free(names);
}
another two.
0001-01-01 02:30:17 +02:30
free_sid_array(num_sids, sids);
added rpcclient program
0001-01-01 02:30:17 +02:30
}
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
/****************************************************************************
nt lsa query
****************************************************************************/
okay :) all cmd_() functions now take int argc, char **argv :) that means that some commands need more work, as they still use next_token(), the use of which i wish to avoid. plus, i was getting fed up of the poor command-line processing in some of these commands. i'm starting to need getopt() in them, especially in samsetuser. WARNING: only cmd_samr has been modded to use getopt() so far! reg commands won't work, esp.
0001-01-01 02:30:17 +02:30
void cmd_lsa_query_secret(struct client_info *info, int argc, char *argv[])
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
{
another two.
0001-01-01 02:30:17 +02:30
char *secret_name;
querysecret now shows the real, fairdinkum, decrypted secret :-)
0001-01-01 02:30:17 +02:30
STRING2 secret;
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
NTTIME last_update;
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
fstring srv_name;
fstrcpy(srv_name, "\\\\");
fstrcat(srv_name, info->dest_host);
strupper(srv_name);
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
another two.
0001-01-01 02:30:17 +02:30
if (argc > 2)
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "querysecret <secret name>\n");
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
return;
}
another two.
0001-01-01 02:30:17 +02:30
secret_name = argv[1];
first stages of removing struct cli_state* and uint16 fnum from all msrpc client code. the intent is to hide / abstract / associate connection info behind policy handles. this makes the msrpc functions look more and more like their nt equivalents. who-hou!
0001-01-01 02:30:17 +02:30
if (msrpc_lsa_query_secret(srv_name, secret_name, &secret, &last_update))
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
{
shuffling msrpc code around so that it can be used independently of rpcclient
0001-01-01 02:30:17 +02:30
int i;
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "\tValue : ");
querysecret now shows the real, fairdinkum, decrypted secret :-)
0001-01-01 02:30:17 +02:30
for (i = 0; i < secret.str_str_len; i++)
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "%02X", secret.buffer[i]);
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
}
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "\n\tLast Updated: %s\n\n",
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
http_timestring(nt_time_to_unix(&last_update)));
}
else
{
- initialising mach_passwd_file locks to zero (prev. uninit.) - cleanup - #defined report to sprintf as it's #defined to another function in other uses of cmd_lsarpc.c
0001-01-01 02:30:17 +02:30
report(out_hnd, "LSA Query Secret: failed\n");
Adding LSA_OPENSECRET (-> LsarOpenSecret) and LSA_QUERYSECRET (-> LsarQuerySecret) on client side, including rpcclient command "querysecret" for others to play with. The major obstacle is working out the encryption algorithm used for the secret value. It definitely uses the NT hash as part of the key, and it seems the block size is 64 bits - probably DES based - but I can't work out what's done in between. Help required.
0001-01-01 02:30:17 +02:30
}
}
Copy Permalink