sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-09-10 05:44:20 +03:00
Code Activity

samba-tool: Add support for getting the generated unicodePwd for a gMSA account

Browse Source 
This pre-hashed value may be more practical to use than the random "UTF-16"
password.  In particular it is easy to compare with the DB values.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett
2023-12-11 20:49:44 +13:00
committed by Douglas Bagnall
parent 9557140f19
commit 8b67a86584
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/samba/netcmd/user/readpasswords/common.py
View File

@@ -99,6 +99,9 @@ virtual_attributes = {
"virtualSambaGPG": { "virtualSambaGPG": {
"flags": ldb.ATTR_FLAG_FORCE_BASE64_LDIF, "flags": ldb.ATTR_FLAG_FORCE_BASE64_LDIF,
}, },
"unicodePwd": {
"flags": ldb.ATTR_FLAG_FORCE_BASE64_LDIF,
},
} }
@@ -725,6 +728,13 @@ class GetPasswordCommand(Command):
v = kerberos_salt v = kerberos_salt
if v is None: if v is None:
continue continue
elif a == "unicodePwd" and "Primary:CLEARTEXT" in calculated and unicodePwd is None:
# We can't read unicodePwd directly, but we can regenerate
# it from msDS-ManagedPassword
tmp = credentials.Credentials()
tmp.set_anonymous()
tmp.set_utf16_password(calculated["Primary:CLEARTEXT"])
v = tmp.get_nt_hash()
elif a.startswith("virtualWDigest"): elif a.startswith("virtualWDigest"):
primary_wdigest = get_package("Primary:WDigest") primary_wdigest = get_package("Primary:WDigest")
if primary_wdigest is None: if primary_wdigest is None:

1
selftest/knownfail.d/samba_tool_user Normal file
View File

@@ -0,0 +1 @@
^samba.tests.samba_tool.user.samba.tests.samba_tool.user.UserCmdTestCase.test_setpassword\(ad_dc_no_ntlm