dash/rdpy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add some usefull methods

Browse Source
This commit is contained in:
citronneur
2015-03-03 21:57:40 +01:00
parent 98494d0e73
commit 30a16fbb7a
1 changed files with 44 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
rdpy/protocol/rdp/nla/ntlm.py
View File

@@ -298,6 +298,13 @@ def KXKEY(SessionBaseKey, LmChallengeResponse, ServerChallenge):
@see: https://msdn.microsoft.com/en-us/library/cc236710.aspx @see: https://msdn.microsoft.com/en-us/library/cc236710.aspx
""" """
return HMAC_MD5(SessionBaseKey, ServerChallenge + LmChallengeResponse[:8]) return HMAC_MD5(SessionBaseKey, ServerChallenge + LmChallengeResponse[:8])
def SEALKEY(ExportedSessionKey):
return MD5(ExportedSessionKey + "session key to client-to-server sealing key magic constant")
def SIGNKEY(ExportedSessionKey):
return MD5(ExportedSessionKey + "session key to client-to-server signing key magic constant")
def NTOWFv1(Passwd, User, UserDom): def NTOWFv1(Passwd, User, UserDom):
""" """
@@ -383,7 +390,6 @@ def createAuthenticationMessage(method, challengeResponse, domain, user, passwor
offset = sizeof(message) offset = sizeof(message)
message.NegotiateFlags.value = challengeResponse.NegotiateFlags.value message.NegotiateFlags.value = challengeResponse.NegotiateFlags.value
message.NegotiateFlags.value &= ~Negotiate.NTLMSSP_NEGOTIATE_VERSION
message.LmChallengeResponseLen.value = len(LmChallengeResponse) message.LmChallengeResponseLen.value = len(LmChallengeResponse)
message.LmChallengeResponseBufferOffset.value = offset message.LmChallengeResponseBufferOffset.value = offset
@@ -559,41 +565,49 @@ if __name__ == "__main__":
ServerName2 = temp[28:-4] ServerName2 = temp[28:-4]
LmChallengeResponse = authenticate.getLmChallengeResponse() LmChallengeResponse = authenticate.getLmChallengeResponse()
SessionBaseKey = authenticate.getEncryptedRandomSession() EncryptedRandom = authenticate.getEncryptedRandomSession()
encryptedPubKey = cssp.getPubKeyAuth(authenticate_data_request) encryptedPubKey = cssp.getPubKeyAuth(authenticate_data_request)
NtChallengeResponse2, LmChallengeResponse2, SessionBaseKey2 = NTLMv2Authenticate(None, "coco", "toto", "lolo", ServerChallenge, ServerName, Time, ClientChallenge) NtChallengeResponse2, LmChallengeResponse2, SessionBaseKey2 = NTLMv2Authenticate(None, "coco", "toto", "lolo", ServerChallenge, ServerName, Time, ClientChallenge)
KeyExchangeKey = HMAC_MD5(SessionBaseKey2, ServerChallenge + LmChallengeResponse[:7]) KeyExchangeKey = KXKEY(SessionBaseKey2, LmChallengeResponse2, ServerChallenge)
ExportedSessionKey = RC4K(KeyExchangeKey, SessionBaseKey) #decrypt
sealingKey = MD5(ExportedSessionKey + "session key to client-to-server sealing key magic constant") ExportedSessionKey = RC4K(KeyExchangeKey, EncryptedRandom)
#sealingKey = MD5(sealingKey + "\x00" + "\x00" * 3)
sealingKey = SEALKEY(ExportedSessionKey)
signingKey = SIGNKEY(ExportedSessionKey)
key = rc4.RC4Key(sealingKey)
encryptedPubKey2 = rc4.crypt(key, pubKey)
signature = rc4.crypt(key, HMAC_MD5(signingKey, "\x00\x00\x00\x00" + pubKey)[:8])
encryptedPubKey2 = RC4K(sealingKey, pubKey)
hexdump.hexdump(encryptedPubKey) hexdump.hexdump(encryptedPubKey)
print "\n" print "\n"
hexdump.hexdump(signature)
print "\n"
hexdump.hexdump(encryptedPubKey2) hexdump.hexdump(encryptedPubKey2)
print "-"*40 # print "-"*40
print "NtChallengeResponse" # print "NtChallengeResponse"
print "\n" # print "\n"
hexdump.hexdump(NtChallengeResponse) # hexdump.hexdump(NtChallengeResponse)
print "\n" # print "\n"
hexdump.hexdump(NtChallengeResponse2) # hexdump.hexdump(NtChallengeResponse2)
print "-"*40 # print "-"*40
#
print "-"*40 # print "-"*40
print "LmChallengeResponse" # print "LmChallengeResponse"
print "\n" # print "\n"
hexdump.hexdump(LmChallengeResponse) # hexdump.hexdump(LmChallengeResponse)
print "\n" # print "\n"
hexdump.hexdump(LmChallengeResponse2) # hexdump.hexdump(LmChallengeResponse2)
print "-"*40 # print "-"*40
#
print "-"*40 # print "-"*40
print "SessionBaseKey" # print "SessionBaseKey"
print "\n" # print "\n"
hexdump.hexdump(SessionBaseKey) # hexdump.hexdump(SessionBaseKey)
print "\n" # print "\n"
hexdump.hexdump(SessionBaseKey2) # hexdump.hexdump(SessionBaseKey2)
print "-"*40 # print "-"*40