ntlm

Documentation

Index

• Constants
• func ComputeNTLMv2Response(h hash.Hash, clientChallenge, serverChallenge, timestamp, serverName []byte) (NTChallengeResponse, LMChallengeResponse, SessionBaseKey []byte)
• func LMOWFv2(password, user, userDomain string) []byte
• func NTOWFv1(pass string) []byte
• func NTOWFv2(password, user, userDomain string) []byte
• func NTOWFv2Hash(hash, user, userDomain string) []byte
• type AvPair
  • func (p AvPair) Size() uint64
• type AvPairSlice
  • func (s *AvPairSlice) MarshalBinary(meta *encoder.Metadata) ([]byte, error)
  • func (s *AvPairSlice) UnmarshalBinary(buf []byte, meta *encoder.Metadata) error
• type Challenge
  • func NewChallenge() Challenge
• type Header
• type NTLMv2Authentication
  • func NewAuthenticateHash(domain, user, workstation, hash string, c Challenge) NTLMv2Authentication
  • func NewAuthenticatePass(domain, user, workstation, password string, c Challenge) NTLMv2Authentication
• type Negotiate
  • func NewNegotiate(domainName, workstation string) Negotiate

Constants

const (
	NTLMNegotiate    = 0x00000001
	NTLMChallenge    = 0x00000002
	NTLMAuthenticate = 0x00000003
)

ntlm协议头类型

const (
	FlgNegUNICODE uint32 = 1 << iota
	FlgNegOEM
	FlgRequestTarget
	FlgRequest0x00000008
	FlgNegSign
	FlgNegSeal
	FLgNegDatagram
	FlgNegLanManagerKey
	FlgNeg0x000001
	FlgNegNTLMKey
	FlgNegNtOnly
	FlgNegAnonymous
	FlgNegOEMDomainSupplied
	FlgNegOEMWorkstationSupplied
	FlgNeg0x00004
	FlgNegAlwaysSign
	FlgTypeDomain
	FlgTypeServer
	FlgTypeShare
	FlgNegExtendedSecurity
	FlgNegIdentify
	FlgNeg0x002
	FlgNonNTSession
	FlgNegTargetInfo
	FlgNeg0x01
	FlgNegVersion
	FlgNeg0x04
	FlgNeg0x08
	FlgNeg0x1
	FlgNeg128
	FlgNegKeyExchange
	FlgNeg56
)

ntlm flag标识位 https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832

const (
	MsvAvEOL uint16 = iota
	MsvAvNbComputerName
	MsvAvNbDomainName
	MsvAvDnsComputerName
	MsvAvDnsDomainName
	MsvAvDnsTreeName
	MsvAvFlags
	MsvAvTimestamp
	MsvAvSingleHost
	MsvAvTargetName
	MsvChannelBindings
)

const NTLMSSPMECHTYPEOID = "1.3.6.1.4.1.311.2.2.10"

ntlm对象标识符

const NTLMSecSignature = "NTLMSSP\x00"

ssp安全签名

Functions

func ComputeNTLMv2Response

func ComputeNTLMv2Response(h hash.Hash, clientChallenge, serverChallenge, timestamp, serverName []byte) (NTChallengeResponse, LMChallengeResponse, SessionBaseKey []byte)

计算ntlmv2响应 Set temp to ConcatenationOf(Responserversion, HiResponserversion,

Z(6), Time, ClientChallenge, Z(4), ServerName, Z(4))

Set NTProofStr to HMAC_MD5(ResponseKeyNT,

ConcatenationOf(CHALLENGE_MESSAGE.ServerChallenge,temp))

Set NtChallengeResponse to ConcatenationOf(NTProofStr, temp) Set LmChallengeResponse to ConcatenationOf(HMAC_MD5(ResponseKeyLM,

ConcatenationOf(CHALLENGE_MESSAGE.ServerChallenge, ClientChallenge)),
ClientChallenge )

func LMOWFv2

func LMOWFv2(password, user, userDomain string) []byte

Define LMOWFv2(Passwd, User, UserDom) as NTOWFv2(Passwd, User, UserDom)

func NTOWFv1

func NTOWFv1(pass string) []byte

NTLMv1 认证 Define NTOWFv1(Passwd, User, UserDom) as MD4(UNICODE(Passwd))

func NTOWFv2

func NTOWFv2(password, user, userDomain string) []byte

NTLMv2 认证 Define NTOWFv2(Passwd, User, UserDom) as HMAC_MD5( MD4(UNICODE(Passwd)), UNICODE(ConcatenationOf( Uppercase(User), UserDom ) ) )

func NTOWFv2Hash

func NTOWFv2Hash(hash, user, userDomain string) []byte

NTLMv2 hash认证

Types

type AvPair

type AvPair struct {
	AvID  uint16
	AvLen uint16 `smb:"len:Value"`
	Value []byte
}

服务器响应检查

func (AvPair) Size

func (p AvPair) Size() uint64

type AvPairSlice

type AvPairSlice []AvPair

func (*AvPairSlice) MarshalBinary

func (s *AvPairSlice) MarshalBinary(meta *encoder.Metadata) ([]byte, error)

func (*AvPairSlice) UnmarshalBinary

func (s *AvPairSlice) UnmarshalBinary(buf []byte, meta *encoder.Metadata) error

type Challenge

type Challenge struct {
	Header
	TargetNameLen          uint16 `smb:"len:TargetName"`
	TargetNameMaxLen       uint16 `smb:"len:TargetName"`
	TargetNameBufferOffset uint32 `smb:"offset:TargetName"`
	NegotiateFlags         uint32
	ServerChallenge        uint64
	Reserved               uint64
	TargetInfoLen          uint16 `smb:"len:TargetInfo"`
	TargetInfoMaxLen       uint16 `smb:"len:TargetInfo"`
	TargetInfoBufferOffset uint32 `smb:"offset:TargetInfo"`
	Version                uint64
	TargetName             []byte
	TargetInfo             *AvPairSlice
}

func NewChallenge

func NewChallenge() Challenge

协商密钥

type Header

type Header struct {
	Signature   []byte `smb:"fixed:8"`
	MessageType uint32
}

通用头

type NTLMv2Authentication

type NTLMv2Authentication struct {
	Header
	LmChallengeResponseLen                uint16 `smb:"len:LmChallengeResponse"`
	LmChallengeResponseMaxLen             uint16 `smb:"len:LmChallengeResponse"`
	LmChallengeResponseBufferOffset       uint32 `smb:"offset:LmChallengeResponse"`
	NtChallengeResponseLen                uint16 `smb:"len:NtChallengeResponse"`
	NtChallengeResponseMaxLen             uint16 `smb:"len:NtChallengeResponse"`
	NtChallengResponseBufferOffset        uint32 `smb:"offset:NtChallengeResponse"`
	DomainNameLen                         uint16 `smb:"len:DomainName"`
	DomainNameMaxLen                      uint16 `smb:"len:DomainName"`
	DomainNameBufferOffset                uint32 `smb:"offset:DomainName"`
	UserNameLen                           uint16 `smb:"len:UserName"`
	UserNameMaxLen                        uint16 `smb:"len:UserName"`
	UserNameBufferOffset                  uint32 `smb:"offset:UserName"`
	WorkstationLen                        uint16 `smb:"len:Workstation"`
	WorkstationMaxLen                     uint16 `smb:"len:Workstation"`
	WorkstationBufferOffset               uint32 `smb:"offset:Workstation"`
	EncryptedRandomSessionKeyLen          uint16 `smb:"len:EncryptedRandomSessionKey"`
	EncryptedRandomSessionKeyMaxLen       uint16 `smb:"len:EncryptedRandomSessionKey"`
	EncryptedRandomSessionKeyBufferOffset uint32 `smb:"offset:EncryptedRandomSessionKey"`
	NegotiateFlags                        uint32
	DomainName                            []byte `smb:"unicode"`
	UserName                              []byte `smb:"unicode"`
	Workstation                           []byte `smb:"unicode"`
	EncryptedRandomSessionKey             []byte //16字节，会话加密密钥，可以为空
	LmChallengeResponse                   []byte //24字节，lm协商响应
	NtChallengeResponse                   []byte //24字节，nt协商响应
	MIC                                   []byte `smb:"fixed:16"` //16字节，会话完整性校验
}

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3 ntlm v2认证结构

func NewAuthenticateHash

func NewAuthenticateHash(domain, user, workstation, hash string, c Challenge) NTLMv2Authentication

func NewAuthenticatePass

func NewAuthenticatePass(domain, user, workstation, password string, c Challenge) NTLMv2Authentication

type Negotiate

type Negotiate struct {
	Header
	NegotiateFlags          uint32
	DomainNameLen           uint16 `smb:"len:DomainName"`
	DomainNameMaxLen        uint16 `smb:"len:DomainName"`
	DomainNameBufferOffset  uint32 `smb:"len:DomainName"`
	WorkstationLen          uint16 `smb:"len:Workstation"`
	WorkstationMaxLen       uint16 `smb:"len:Workstation"`
	WorkstationBufferOffset uint32 `smb:"len:Workstation"`
	DomainName              []byte
	Workstation             []byte
}

func NewNegotiate

func NewNegotiate(domainName, workstation string) Negotiate

协商版本