1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255
|
/*
* sampasswd.c - SAM database, add or remove user in a group
*
* Command line utility, non-interactive to reset user password and/or
* account bits for a user in the SAM database
*
* Changes:
* 2013 - aug: cleaned up a bit for release, some debug still there
* 2013 - apr-may: reset one, all and first features
* 2012 - oct: First version, some code from earlier chntpw.c. Not released.
*
*****
*
* Copyright (c) 1997-2014 Petter Nordahl-Hagen.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* See file GPL.txt for the full license.
*
*****
*/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include "ntreg.h"
#include "sam.h"
const char sampasswd_version[] = "sampasswd version 0.2 140201, (c) Petter N Hagen";
/* Global verbosity flag */
int gverbose = 0;
/* Array of loaded hives */
#define MAX_HIVES 10
struct hive *hive[MAX_HIVES+1];
int no_hives = 0;
int H_SAM = -1;
int do_reset(char *user, int inrid, int verb)
{
int rid = 0;
int ret;
char *resolvedname = NULL;
char s[200];
if ((H_SAM < 0) || (!user && !inrid) ) return(1);
if (inrid) {
rid = inrid;
} else {
if (*user == '0' && *(user+1) == 'x') sscanf(user,"%i",&rid);
}
if (!rid) { /* Look up username */
/* Extract the unnamed value out of the username-key, value is RID */
snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\Names\\%s\\@",user);
rid = get_dword(hive[H_SAM],0,s, TPF_VK_EXACT|TPF_VK_SHORT);
if (rid == -1) {
printf("ERROR: User <%s> not found\n",user);
return(1);
}
}
/* At this point we have a RID, so get the real username it maps to just to show it */
resolvedname = sam_get_username(hive[H_SAM], rid);
if (!resolvedname) return(1); /* RID lookup failed, no such user */
if (gverbose) printf("do_reset: Username: %s, RID = %d (0x%0x)\n",resolvedname,rid,rid);
ret = sam_reset_pw(hive[H_SAM], rid);
if (!ret && verb) printf("Password reset for user %s, RID = %d [0x%0x]\n",resolvedname,rid,rid);
FREE(resolvedname);
return(ret);
}
void usage(void)
{
printf(" [-r|-l] [-H] -u <user> <samhive>\n"
"Reset password or list users in SAM database\n"
"Mode:\n"
" -r = reset users password\n"
" -l = list users in sam\n"
"Parameters:\n"
" <user> can be given as a username or a RID in hex with 0x in front\n"
" Example:\n"
" -r -u theboss -> resets password of user named 'theboss' if found\n"
" -r -u 0x3ea -> resets password for user with RID 0x3ea (hex)\n"
" -r -a -> Reset password of all users in administrators group (0x220)\n"
" -r -f -> Reset password of admin user with lowest RID\n"
" not counting built-in admin (0x1f4) unless it is the only admin\n"
" Usernames with international characters usually fails to be found,\n"
" please use RID number instead\n"
" If success, there will be no output, and exit code is 0\n"
"Options:\n"
" -H : For list: Human readable listing (default is parsable table)\n"
" -H : For reset: Will output confirmation message if success\n"
" -N : No allocate mode, only allow edit of existing values with same size\n"
" -E : No expand mode, do not expand hive file (safe mode)\n"
" -t : Debug trace of allocated blocks\n"
" -v : Some more verbose messages/debug\n"
);
}
int main(int argc, char **argv)
{
extern int optind;
extern char* optarg;
int what = 0;
int reset = 0;
int list = 0;
int mode = 0;
int human = 0;
int adm = 0;
int all = 0;
int first = 0;
int ret, wret, il;
char *hivename;
char c;
char *usr = NULL;
char *options = "rlHu:vNEthaf";
while((c=getopt(argc,argv,options)) > 0) {
switch(c) {
case 'r': reset = 1; break;
case 'l': list = 2; break;
case 'u': usr = optarg; break;
case 'a': all = 1; break;
case 'f': first = 1; break;
case 'H': human = 1; break;
case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break;
case 'N': mode |= HMODE_NOALLOC; break;
case 'E': mode |= HMODE_NOEXPAND; break;
case 't': mode |= HMODE_TRACE; break;
case 'h': printf("%s\n%s ",sampasswd_version,argv[0]); usage(); exit(0); break;
default: printf("%s\n%s ",sampasswd_version,argv[0]); usage(); exit(1); break;
}
}
if (!reset && !list && !what) {
fprintf(stderr,"%s: ERROR: Mode -r or -l must be specified. -h for help\n",argv[0]);
exit(1);
}
#if 0 /* Should both be allowed at same time?? */
if (list && reset) {
fprintf(stderr,"%s: ERROR: Mode -r and -l impossible at the same time. -h for help\n",argv[0]);
exit(1);
}
#endif
if (reset && !all && !first && (!usr || !*usr)) {
fprintf(stderr,"%s: ERROR: Need a user for reset, -u must be specified.\n",argv[0]);
exit(1);
}
/* Load hives. Only first SAM hive will be used however */
hivename = argv[optind+no_hives];
if (!hivename || !*hivename) {
fprintf(stderr,"%s: ERROR: You must specify a SAM registry hive filename.\n",argv[0]);
exit(1);
}
do {
if (!(hive[no_hives] = openHive(hivename,
HMODE_RW|mode))) {
fprintf(stderr,"%s: ERROR: Unable to open/read registry hive, cannot continue\n",argv[0]);
exit(1);
}
switch(hive[no_hives]->type) {
case HTYPE_SAM: H_SAM = no_hives; break;
// case HTYPE_SOFTWARE: H_SOF = no_hives; break;
// case HTYPE_SYSTEM: H_SYS = no_hives; break;
// case HTYPE_SECURITY: H_SEC = no_hives; break;
}
no_hives++;
hivename = argv[optind+no_hives];
} while (hivename && *hivename && no_hives < MAX_HIVES);
if (H_SAM == -1) {
fprintf(stderr,"%s: WARNING: Hive file does not look like SAM, but continuing anyway in case detection was wrong\n"
"%s: WARNING: If it really is not a SAM file you will get strange errors or bad results\n",argv[0],argv[0]);
H_SAM = 0;
}
/* Do logic */
if (list) {
adm = sam_list_users(hive[H_SAM], human);
if (gverbose) printf(" sam_list_users found admin to be 0x%x\n",adm);
}
if (reset) {
if (all) {
ret = sam_reset_all_pw(hive[H_SAM], human);
if (ret) {
fprintf(stderr,"%s: ERROR: Failed reset password of ALL users\n",argv[0]);
}
} else if (first) {
adm = sam_list_users(hive[H_SAM], 2);
if (!adm) {
fprintf(stderr,"%s: ERROR: Unable to reset, no admin users found\n",argv[0]);
} else {
// printf("Resetting password of user with RID %x\n",adm);
ret = do_reset(usr, adm, human);
}
} else {
ret = do_reset(usr, 0, human);
if (ret) {
fprintf(stderr,"%s: ERROR: Failed reset password for %s\n",argv[0],usr);
}
}
}
/* write registry hive (if needed) */
wret = 0;
for (il = 0; il < no_hives; il++) {
// wret |= writeHive(hive[il]);
if (hive[il]->state & HMODE_DIDEXPAND)
fprintf(stderr," WARNING: Registry file %s was expanded! Experimental! Use at own risk!\n",hive[il]->filename);
while (no_hives > 0)
closeHive(hive[--no_hives]);
}
return(ret | wret);
}
|