From 41b3af8267bd075d7a8b54f8ea7b3a423e70de29 Mon Sep 17 00:00:00 2001
From: Eric Kohl <eric.kohl@reactos.org>
Date: Sun, 26 May 2013 10:48:54 +0000
Subject: [PATCH] [SAMSRV] Calculate NT and LM hashes of the empty password
 string and use them as default passwords hashes in new user accounts.

svn path=/trunk/; revision=59083
---
 reactos/dll/win32/samsrv/samrpc.c |  8 +++---
 reactos/dll/win32/samsrv/samsrv.c | 42 ++++++++++++++++++++++++++++++-
 reactos/dll/win32/samsrv/samsrv.h | 15 +++++++++++
 reactos/dll/win32/samsrv/setup.c  |  8 +++---
 4 files changed, 64 insertions(+), 9 deletions(-)

diff --git a/reactos/dll/win32/samsrv/samrpc.c b/reactos/dll/win32/samsrv/samrpc.c
index cdce9b44cc0..9de3b92a3d6 100644
--- a/reactos/dll/win32/samsrv/samrpc.c
+++ b/reactos/dll/win32/samsrv/samrpc.c
@@ -2371,8 +2371,8 @@ SamrCreateUserInDomain(IN SAMPR_HANDLE DomainHandle,
     Status = SampSetObjectAttribute(UserObject,
                                     L"LMPwd",
                                     REG_BINARY,
-                                    NULL,
-                                    0);
+                                    &EmptyLmHash,
+                                    sizeof(ENCRYPTED_LM_OWF_PASSWORD));
     if (!NT_SUCCESS(Status))
     {
         TRACE("failed with status 0x%08lx\n", Status);
@@ -2383,8 +2383,8 @@ SamrCreateUserInDomain(IN SAMPR_HANDLE DomainHandle,
     Status = SampSetObjectAttribute(UserObject,
                                     L"NTPwd",
                                     REG_BINARY,
-                                    NULL,
-                                    0);
+                                    &EmptyNtHash,
+                                    sizeof(ENCRYPTED_NT_OWF_PASSWORD));
     if (!NT_SUCCESS(Status))
     {
         TRACE("failed with status 0x%08lx\n", Status);
diff --git a/reactos/dll/win32/samsrv/samsrv.c b/reactos/dll/win32/samsrv/samsrv.c
index 490f6167607..07d9974ec6e 100644
--- a/reactos/dll/win32/samsrv/samsrv.c
+++ b/reactos/dll/win32/samsrv/samsrv.c
@@ -23,7 +23,43 @@
 
 WINE_DEFAULT_DEBUG_CHANNEL(samsrv);
 
-/* FUNCTIONS ****************************************************************/
+
+/* GLOBALS *******************************************************************/
+
+ENCRYPTED_NT_OWF_PASSWORD EmptyNtHash;
+ENCRYPTED_LM_OWF_PASSWORD EmptyLmHash;
+
+
+/* FUNCTIONS *****************************************************************/
+
+static
+NTSTATUS
+SampInitHashes(VOID)
+{
+    UNICODE_STRING EmptyNtPassword = {0, 0, NULL};
+    CHAR EmptyLmPassword[15] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,};
+    NTSTATUS Status;
+
+    /* Calculate the NT hash value of the empty password */
+    Status = SystemFunction007(&EmptyNtPassword,
+                               (LPBYTE)&EmptyNtHash);
+    if (!NT_SUCCESS(Status))
+    {
+        ERR("Calculation of the empty NT hash failed (Status 0x%08lx)\n", Status);
+        return Status;
+    }
+
+    /* Calculate the LM hash value of the empty password */
+    Status = SystemFunction006(EmptyLmPassword,
+                               (LPSTR)&EmptyLmHash);
+    if (!NT_SUCCESS(Status))
+    {
+        ERR("Calculation of the empty LM hash failed (Status 0x%08lx)\n", Status);
+    }
+
+    return Status;
+}
+
 
 NTSTATUS
 NTAPI
@@ -70,6 +106,10 @@ SamIInitialize(VOID)
 
     TRACE("SamIInitialize() called\n");
 
+    Status = SampInitHashes();
+    if (!NT_SUCCESS(Status))
+        return Status;
+
     if (SampIsSetupRunning())
     {
         Status = SampInitializeRegistry();
diff --git a/reactos/dll/win32/samsrv/samsrv.h b/reactos/dll/win32/samsrv/samsrv.h
index dffc65ec816..8d942fa7a56 100644
--- a/reactos/dll/win32/samsrv/samsrv.h
+++ b/reactos/dll/win32/samsrv/samsrv.h
@@ -118,6 +118,8 @@ typedef struct _SAM_USER_FIXED_DATA
 
 
 extern PGENERIC_MAPPING pServerMapping;
+extern ENCRYPTED_NT_OWF_PASSWORD EmptyNtHash;
+extern ENCRYPTED_LM_OWF_PASSWORD EmptyLmHash;
 
 
 /* alias.c */
@@ -371,4 +373,17 @@ NTSTATUS
 SampGetRidFromSid(IN PSID Sid,
                   OUT PULONG Rid);
 
+
+/* Undocumented advapi32 functions */
+
+NTSTATUS
+WINAPI
+SystemFunction006(LPCSTR password,
+                  LPSTR hash);
+
+NTSTATUS
+WINAPI
+SystemFunction007(PUNICODE_STRING string,
+                  LPBYTE hash);
+
 /* EOF */
diff --git a/reactos/dll/win32/samsrv/setup.c b/reactos/dll/win32/samsrv/setup.c
index 97f7436ab2a..416551ced5a 100644
--- a/reactos/dll/win32/samsrv/setup.c
+++ b/reactos/dll/win32/samsrv/setup.c
@@ -301,16 +301,16 @@ SampSetupCreateUserAccount(HKEY hDomainKey,
                       L"LMPwd",
                       0,
                       REG_BINARY,
-                      NULL,
-                      0);
+                      (LPVOID)&EmptyLmHash,
+                      sizeof(ENCRYPTED_LM_OWF_PASSWORD));
 
         /* Set NTPwd attribute*/
         RegSetValueEx(hAccountKey,
                       L"NTPwd",
                       0,
                       REG_BINARY,
-                      NULL,
-                      0);
+                      (LPVOID)&EmptyNtHash,
+                      sizeof(ENCRYPTED_NT_OWF_PASSWORD));
 
         /* Set LMPwdHistory attribute*/
         RegSetValueEx(hAccountKey,