[cifs-protocol] [MS-SAMR] SamrSetInformationUser2 over an authenticated DCERPC connection [119040819792364]

[Obaid Farooqi]

Hi Andreas:
Looks like 02_systemLibraryDTC...zip did not upload properly.
Can you please rename this file and try uploading again?

Regards,
Obaid Farooqi
Escalation Engineer | Microsoft

-----Original Message-----
From: Andreas Schneider <asn at samba.org> 
Sent: Wednesday, April 10, 2019 7:47 AM
To: Obaid Farooqi <obaidf at microsoft.com>
Cc: cifs-protocol <cifs-protocol at lists.samba.org>; support at mail.support.microsoft.com
Subject: Re: [MS-SAMR] SamrSetInformationUser2 over an authenticated DCERPC connection [119040819792364]

On Wednesday, April 10, 2019 12:35:35 AM CEST Obaid Farooqi wrote:
> Hi Andreas:

Hi Obaid,

> 10. Zip the network trace and lsass01.run file and upload them to the 
> workspace and let me know.

I've uploaded the logs as a zip file. It includes two traces. One which denies the login and the section works using "SystemLibraryDTC" as the session key to encrypt the password buffer with RC4.

Let me know if I can help with anything else.

Thanks.


Best regards,


	Andreas

-- 
Andreas Schneider                      asn at samba.org
Samba Team                             https://nam06.safelinks.protection.outlook.com/?url=www.samba.org&data=02%7C01%7Cobaidf%40microsoft.com%7C7823da16761a41629c6508d6bdb2b1fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636904972535716997&sdata=NmDLdv2dxDYJCoQOmcBA9ceXYhn9l7mmbOtXISa9YE0%3D&reserved=0
GPG-ID:     8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D