ntlmssp

Documentation

Index

• Constants
• func Flags(n NegotiateFlag) []string
• func GenerateClientSigningKey(clientNTLMV2Hash, generatedNTLMV2Response []byte) []byte
• func NTLMV2Hash(password, hash, username, target string) ([]byte, error)
• func NTLMV2Response(hash, servChal, timestamp, targetInfo []byte) []byte
• type AVID
• type AV_Pair
• type ChallengePayload
  • func (c ChallengePayload) GetTargetInfoBytes() []byte
  • func (c ChallengePayload) GetTimeBytes() []byte
• type MessageSignatureExtended
  • func NewMessageSignature(value, key []byte, seq uint32) MessageSignatureExtended
  • func (m MessageSignatureExtended) Bytes() []byte
  • func (m *MessageSignatureExtended) SignValue(seq, value, key []byte)
• type NegotiateFlag
  • func (i NegotiateFlag) String() string
• type NegotiatePayload
• type SSP_Authenticate
  • func NewSSPAuthenticate(response, domainName, username, workstation, sessionkey []byte) SSP_Authenticate
  • func (s SSP_Authenticate) Bytes() []byte
• type SSP_Challenge
  • func ParseSSPChallenge(b []byte) SSP_Challenge
• type SSP_FeildInformation
  • func NewSSPFeildInformation(len uint16, offset uint32) SSP_FeildInformation
• type SSP_Negotiate
  • func NewSSPNegotiate(flags NegotiateFlag) SSP_Negotiate
  • func (s SSP_Negotiate) Bytes() []byte
• type Version

Constants

const (
	MsvAvEOL             = 0x0000 //Indicates that this is the last AV_PAIR in the list. AvLen MUST be 0. This type of information MUST be present in the AV pair list.
	MsvAvNbComputerName  = 0x0001 //The server's NetBIOS computer name. The name MUST be in Unicode, and is not null-terminated. This type of information MUST be present in the AV_pair list.
	MsvAvNbDomainName    = 0x0002 //The server's NetBIOS domain name. The name MUST be in Unicode, and is not null-terminated. This type of information MUST be present in the AV_pair list.
	MsvAvDnsComputerName = 0x0003 //The fully qualified domain name (FQDN) of the computer. The name MUST be in Unicode, and is not null-terminated.
	MsvAvDnsDomainName   = 0x0004 //The FQDN of the domain. The name MUST be in Unicode, and is not null-terminated.
	MsvAvDnsTreeName     = 0x0005 //The FQDN of the forest. The name MUST be in Unicode, and is not null-terminated.<13>
	MsvAvFlags           = 0x0006 //A 32-bit value indicating server or client configuration. 0x00000001: Indicates to the client that the account authentication is constrained. 0x00000002: Indicates that the client is providing message integrity in the MIC field (section 2.2.1.3) in the AUTHENTICATE_MESSAGE.<14> 0x00000004: Indicates that the client is providing a target SPN generated from an untrusted source.<15>
	MsvAvTimestamp       = 0x0007 //A FILETIME structure ([MS-DTYP] section 2.3.3) in little-endian byte order that contains the server local time. This structure is always sent in the CHALLENGE_MESSAGE.<16>
	MsvAvSingleHost      = 0x0008 //A Single_Host_Data (section 2.2.2.2) structure. The Value field contains a platform-specific blob, as well as a MachineID created at computer startup to identify the calling machine.<17>
	MsvAvTargetName      = 0x0009 //The SPN of the target server. The name MUST be in Unicode and is not null-terminated.<18>
	MsvAvChannelBindings = 0x000A //A channel bindings hash. The Value field contains an MD5 hash ([RFC4121] section 4.1.1.2) of a gss_channel_bindings_struct ([RFC2744] section 3.11). An all-zero value of the hash is used to indicate absence of channel bindings.<19>
)

Functions

func Flags

func Flags(n NegotiateFlag) []string

func GenerateClientSigningKey

func GenerateClientSigningKey(clientNTLMV2Hash, generatedNTLMV2Response []byte) []byte

func NTLMV2Hash

func NTLMV2Hash(password, hash, username, target string) ([]byte, error)

NTLMV2Hash returns the NTLMV2 hash provided a password or hash (if both are provided, the hash takes precidence), username and target info. Assumes all strings are UTF8, and have not yet been converted to UTF16

func NTLMV2Response

func NTLMV2Response(hash, servChal, timestamp, targetInfo []byte) []byte

Types

type AVID

type AVID uint16

type AV_Pair

type AV_Pair struct {
	AvID  AVID
	AvLen uint16
	Value []byte
}

type ChallengePayload

type ChallengePayload struct {
	TargetName []byte
	TargetInfo []AV_Pair
}

func (ChallengePayload) GetTargetInfoBytes

func (c ChallengePayload) GetTargetInfoBytes() []byte

func (ChallengePayload) GetTimeBytes

func (c ChallengePayload) GetTimeBytes() []byte

type MessageSignatureExtended

type MessageSignatureExtended struct {
	Version  uint32
	Checksum [8]byte
	SeqNum   uint32
}

func NewMessageSignature

func NewMessageSignature(value, key []byte, seq uint32) MessageSignatureExtended

func (MessageSignatureExtended) Bytes

func (m MessageSignatureExtended) Bytes() []byte

func (*MessageSignatureExtended) SignValue

func (m *MessageSignatureExtended) SignValue(seq, value, key []byte)

type NegotiateFlag

type NegotiateFlag uint32

const (
	NTLMSSP_NEGOTIATE_UNICODE NegotiateFlag = 1 << iota
	NTLM_NEGOTIATE_OEM
	NTLMSSP_REQUEST_TARGET

	NTLMSSP_NEGOTIATE_SIGN
	NTLMSSP_NEGOTIATE_SEAL
	NTLMSSP_NEGOTIATE_DATAGRAM
	NTLMSSP_NEGOTIATE_LM_KEY

	NTLMSSP_NEGOTIATE_NTLM

	NTLMSSP_ANONYMOUS_CONNECTIONS
	NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
	NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED

	NTLMSSP_NEGOTIATE_ALWAYS_SIGN
	NTLMSSP_TARGET_TYPE_DOMAIN
	NTLMSSP_TARGET_TYPE_SERVER

	NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
	NTLMSSP_NEGOTIATE_IDENTIFY

	NTLMSSP_REQUEST_NON_NT_SESSION_KEY
	NTLMSSP_NEGOTIATE_TARGET_INFO

	NTLMSSP_NEGOTIATE_VERSION

	NTLMSSP_NEGOTIATE_128
	NTLMSSP_NEGOTIATE_KEY_EXCH
	NTLMSSP_NEGOTIATE_56
)

func (NegotiateFlag) String

func (i NegotiateFlag) String() string

type NegotiatePayload

type NegotiatePayload struct {
	DomainName      []byte
	WorkstationName []byte
}

type SSP_Authenticate

type SSP_Authenticate struct {
	Signature                       [8]byte              //8
	MessageType                     uint32               //12
	LmChallengeResponseFields       SSP_FeildInformation //20
	NtChallengeResponseFields       SSP_FeildInformation //28
	DomainNameFields                SSP_FeildInformation //36
	UsernameFields                  SSP_FeildInformation //44
	WorkstationFields               SSP_FeildInformation //52
	EncryptedRandomSessionKeyFields SSP_FeildInformation //60
	NegotiateFlags                  uint32               //64
	//Version                         [8]byte              //72
	//MIC     [16]byte //88 //https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/a211d894-21bc-4b8b-86ba-b83d0c167b00#Appendix_A_12 HMMMM
	Payload authenticatePayload
}

func NewSSPAuthenticate

func NewSSPAuthenticate(response, domainName, username, workstation, sessionkey []byte) SSP_Authenticate

func (SSP_Authenticate) Bytes

func (s SSP_Authenticate) Bytes() []byte

type SSP_Challenge

type SSP_Challenge struct {
	Signature        [8]byte
	MessageType      uint32
	TargetNameFields SSP_FeildInformation
	NegotiateFlags   uint32
	ServerChallenge  [8]byte
	Reserved         [8]byte
	TargetInfoFields SSP_FeildInformation
	Version          [8]byte
	Payload          ChallengePayload
}

func ParseSSPChallenge

func ParseSSPChallenge(b []byte) SSP_Challenge

type SSP_FeildInformation

type SSP_FeildInformation struct {
	Len          uint16
	MaxLen       uint16
	BufferOffset uint32
}

func NewSSPFeildInformation

func NewSSPFeildInformation(len uint16, offset uint32) SSP_FeildInformation

type SSP_Negotiate

type SSP_Negotiate struct {
	Signature         [8]byte
	MessageType       uint32
	NegotiateFlags    NegotiateFlag
	DomainNameFields  SSP_FeildInformation
	WorkstationFields SSP_FeildInformation
	Version           Version
	Payload           NegotiatePayload
}

func NewSSPNegotiate

func NewSSPNegotiate(flags NegotiateFlag) SSP_Negotiate

func (SSP_Negotiate) Bytes

func (s SSP_Negotiate) Bytes() []byte

type Version

type Version struct {
	ProductMajor        byte
	ProductMinor        byte
	Build               uint16
	Reserved            [3]byte
	NTLMRevisionCurrent byte
}