OpenVAS Libraries  9.0.3
ntlmssp.c
Go to the documentation of this file.
1 /* OpenVAS
2  *
3  * $Id$
4  * Description: Implementation for NTLMSSP support
5  *
6  * Author:
7  * Preeti Subramanian <spreeti@secpod.com>
8  *
9  * Copyright:
10  * Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net
11  *
12  * This program is free software; you can redistribute it and/or
13  * modify it under the terms of the GNU General Public License
14  * as published by the Free Software Foundation; either version 2
15  * of the License, or (at your option) any later version.
16  *
17  * This program is distributed in the hope that it will be useful,
18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20  * GNU General Public License for more details.
21  *
22  * You should have received a copy of the GNU General Public License
23  * along with this program; if not, write to the Free Software
24  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
25  */
26 
27 /*
28  * Functions to support Authentication(type3 message) for NTLMSSP (NTLMv2, NTLM2, NTLM, KEY GEN)
29  */
30 
31 #include <glib.h>
32 
33 #include "ntlmssp.h"
34 
35 #define NTLMSSP_NEGOTIATE_LM_KEY 0x00000080
36 
37 void ntlmssp_genauth_ntlmv2(char* user, char *domain, char* address_list, int address_list_len, char *challenge_data, uint8_t *lm_response,
38  uint8_t *nt_response, uint8_t* session_key, unsigned char* ntlmv2_hash)
39 {
40  SMBNTLMv2encrypt_hash_ntlmssp(user, domain, ntlmv2_hash, challenge_data, address_list, address_list_len, lm_response, nt_response, session_key);
41 }
42 
43 void ntlmssp_genauth_ntlm2 (char *password, uint8_t pass_len,
44  uint8_t *lm_response, uint8_t *nt_response,
45  uint8_t *session_key, char *challenge_data,
46  unsigned char* nt_hash)
47 {
48  unsigned char lm_hash[16];
49 
50  E_deshash_ntlmssp (password, pass_len, lm_hash);
51 
52  struct MD5Context md5_session_nonce_ctx;
53  uchar session_nonce_hash[16];
54  uchar session_nonce[16];
55  uchar user_session_key[16];
56 
57  generate_random_buffer_ntlmssp(lm_response, 8);
58  memset(lm_response+8, 0, 16);
59 
60  memcpy(session_nonce, challenge_data, 8);
61  memcpy(&session_nonce[8], lm_response, 8);
62 
63  MD5Init(&md5_session_nonce_ctx);
64  MD5Update(&md5_session_nonce_ctx, (unsigned char const*)challenge_data, 8);
65  MD5Update(&md5_session_nonce_ctx, (unsigned char const*)lm_response, 8);
66  MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
67 
69  session_nonce_hash,
70  nt_response);
71  SMBsesskeygen_ntv1_ntlmssp(nt_hash, NULL, user_session_key);
72  hmac_md5(user_session_key, session_nonce, sizeof(session_nonce), session_key);
73 }
74 
75 
76 void ntlmssp_genauth_ntlm (char *password, uint8_t pass_len,
77  uint8_t *lm_response, uint8_t *nt_response,
78  uint8_t *session_key, char *challenge_data,
79  unsigned char* nt_hash, int neg_flags)
80 {
81  unsigned char lm_hash[16];
82 
83  E_deshash_ntlmssp (password, pass_len, lm_hash);
84 
85  SMBencrypt_hash_ntlmssp(lm_hash, (const uchar*)challenge_data, lm_response);
86  SMBNTencrypt_hash_ntlmssp(nt_hash, (uchar*)challenge_data, nt_response);
87 
88  if (neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
89  SMBsesskeygen_lm_sess_key_ntlmssp(lm_hash, lm_response, session_key);
90  } else {
91  SMBsesskeygen_ntv1_ntlmssp(nt_hash, NULL, session_key);
92  }
93 }
94 
95 uint8_t * ntlmssp_genauth_keyexchg(uint8_t *session_key, char *challenge_data, unsigned char* nt_hash, uint8_t *new_sess_key)
96 {
97  /* Make up a new session key */
98  uint8 client_session_key[16];
99 
100  generate_random_buffer_ntlmssp(client_session_key, sizeof(client_session_key));
101  /* Encrypt the new session key with the old one */
102 
103  size_t length = sizeof(client_session_key);
104  uint8_t * encrypted_session_key = g_malloc0 (length);
105 
106  memcpy(encrypted_session_key, client_session_key, length);
107  SamOEMhash(encrypted_session_key, session_key, length);
108  memcpy(new_sess_key, client_session_key, 16);
109  return encrypted_session_key;
110 }
#define uchar
Definition: hmacmd5.h:28
uint8_t * ntlmssp_genauth_keyexchg(uint8_t *session_key, char *challenge_data, unsigned char *nt_hash, uint8_t *new_sess_key)
Definition: ntlmssp.c:95
void SamOEMhash(uchar *data, const uchar *key, int val)
Definition: smb_crypt.c:337
bool E_deshash_ntlmssp(const char *passwd, uint8_t pass_len, uchar p16[16])
Definition: smb_crypt.c:444
void SMBNTLMv2encrypt_hash_ntlmssp(const char *user, const char *domain, uchar ntlm_v2_hash[16], const char *server_chal, const char *address_list, int address_list_len, uint8_t *lm_response, uint8_t *nt_response, uint8_t *user_session_key)
Definition: smb_crypt.c:547
void generate_random_buffer_ntlmssp(unsigned char *out, int len)
Definition: genrand.c:167
void SMBencrypt_hash_ntlmssp(const uchar lm_hash[16], const uchar *c8, uchar p24[24])
Definition: smb_crypt.c:406
void ntlmssp_genauth_ntlm2(char *password, uint8_t pass_len, uint8_t *lm_response, uint8_t *nt_response, uint8_t *session_key, char *challenge_data, unsigned char *nt_hash)
Definition: ntlmssp.c:43
#define NTLMSSP_NEGOTIATE_LM_KEY
Definition: ntlmssp.c:35
void MD5Final(unsigned char digest[16], struct MD5Context *ctx)
Definition: md5.c:107
void MD5Init(struct MD5Context *ctx)
Definition: md5.c:44
void hmac_md5(uchar key[16], uchar *data, int data_len, uchar *digest)
Function to calculate an HMAC MD5 digest from data. Use the microsoft hmacmd5 init method because the...
Definition: hmacmd5.c:88
void ntlmssp_genauth_ntlm(char *password, uint8_t pass_len, uint8_t *lm_response, uint8_t *nt_response, uint8_t *session_key, char *challenge_data, unsigned char *nt_hash, int neg_flags)
Definition: ntlmssp.c:76
Definition: md5.h:46
void MD5Update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
Definition: md5.c:59
void ntlmssp_genauth_ntlmv2(char *user, char *domain, char *address_list, int address_list_len, char *challenge_data, uint8_t *lm_response, uint8_t *nt_response, uint8_t *session_key, unsigned char *ntlmv2_hash)
Definition: ntlmssp.c:37
void SMBsesskeygen_ntv1_ntlmssp(const uchar kr[16], const uchar *nt_resp, uint8 sess_key[16])
Definition: smb_crypt.c:386
#define uint8
Definition: charcnv.c:46
void SMBsesskeygen_lm_sess_key_ntlmssp(const uchar lm_hash[16], const uchar lm_resp[24], uint8 sess_key[16])
Definition: smb_crypt.c:426
void SMBNTencrypt_hash_ntlmssp(const uchar nt_hash[16], uchar *c8, uchar *p24)
Definition: smb_crypt.c:417