ntlm

Documentation

Overview

Package ntlm implements the NTLMSSP message types and NTLMv2 verification needed for SMB3 SESSION_SETUP. Pure crypto — no I/O, no logging.

Index

• Constants
• Variables
• func EncodeAVList(pairs []AVPair) []byte
• func EncodeChallenge(m ChallengeMessage) []byte
• func NTOWFv2(ntHash [16]byte, username, domain string) [16]byte
• func UTF16LE(s string) []byte
• func VerifyNTLMv2(ntHash [16]byte, username, domain string, serverChallenge [8]byte, ...) ([16]byte, error)
• type AVID
• type AVPair
  • func DecodeAVList(b []byte) ([]AVPair, error)
• type AuthenticateMessage
  • func DecodeAuthenticate(b []byte) (AuthenticateMessage, error)
• type ChallengeMessage
• type NegotiateMessage
  • func DecodeNegotiate(b []byte) (NegotiateMessage, error)

Constants

const (
	MessageTypeNegotiate    uint32 = 0x00000001
	MessageTypeChallenge    uint32 = 0x00000002
	MessageTypeAuthenticate uint32 = 0x00000003
)

Message types.

const (
	NegotiateUnicode                 uint32 = 0x00000001
	NegotiateOEM                     uint32 = 0x00000002
	RequestTarget                    uint32 = 0x00000004
	NegotiateSign                    uint32 = 0x00000010
	NegotiateSeal                    uint32 = 0x00000020
	NegotiateLMKey                   uint32 = 0x00000080
	NegotiateNTLM                    uint32 = 0x00000200
	NegotiateAlwaysSign              uint32 = 0x00008000
	TargetTypeServer                 uint32 = 0x00020000
	NegotiateExtendedSessionSecurity uint32 = 0x00080000
	NegotiateTargetInfo              uint32 = 0x00800000
	NegotiateVersion                 uint32 = 0x02000000
	Negotiate128                     uint32 = 0x20000000
	NegotiateKeyExch                 uint32 = 0x40000000
	Negotiate56                      uint32 = 0x80000000
)

Negotiate flags (commonly-used subset).

Variables

var ErrAuthFailure = errors.New("ntlm: authentication failed")

var ErrShortMessage = errors.New("ntlm: message truncated")

var Signature = [8]byte{'N', 'T', 'L', 'M', 'S', 'S', 'P', 0x00}

Signature is the 8-byte NTLMSSP message signature: "NTLMSSP\x00".

Functions

func EncodeAVList

func EncodeAVList(pairs []AVPair) []byte

EncodeAVList serializes a list, appending a terminating EOL pair.

func EncodeChallenge

func EncodeChallenge(m ChallengeMessage) []byte

EncodeChallenge serializes a Type 2 NTLMSSP message.

func NTOWFv2

func NTOWFv2(ntHash [16]byte, username, domain string) [16]byte

NTOWFv2 = HMAC_MD5(NT_HASH, UTF16LE(uppercase(USER) || DOMAIN)).

func UTF16LE

func UTF16LE(s string) []byte

UTF16LE encodes s as UTF-16LE.

func VerifyNTLMv2

func VerifyNTLMv2(ntHash [16]byte, username, domain string, serverChallenge [8]byte, ntResponse []byte) ([16]byte, error)

VerifyNTLMv2 checks the NtResponse against NT hash + server challenge. Returns SessionBaseKey on success.

Types

type AVID

type AVID uint16

AVID identifies an AV pair type.

const (
	AVEOL             AVID = 0x0000
	AVNbComputerName  AVID = 0x0001
	AVNbDomainName    AVID = 0x0002
	AVDnsComputerName AVID = 0x0003
	AVDnsDomainName   AVID = 0x0004
	AVDnsTreeName     AVID = 0x0005
	AVFlags           AVID = 0x0006
	AVTimestamp       AVID = 0x0007
	AVSingleHost      AVID = 0x0008
	AVTargetName      AVID = 0x0009
	AVChannelBindings AVID = 0x000A
)

type AVPair

type AVPair struct {
	ID    AVID
	Value []byte
}

AVPair is one entry in an AV_PAIR list.

func DecodeAVList

func DecodeAVList(b []byte) ([]AVPair, error)

DecodeAVList parses an AV-pair list, stopping at EOL.

type AuthenticateMessage

type AuthenticateMessage struct {
	LmResponse                []byte
	NtResponse                []byte
	DomainName                string
	UserName                  string
	Workstation               string
	EncryptedRandomSessionKey []byte
	Flags                     uint32
	MIC                       [16]byte
	HasMIC                    bool
}

AuthenticateMessage is type 3 (client → server).

func DecodeAuthenticate

func DecodeAuthenticate(b []byte) (AuthenticateMessage, error)

type ChallengeMessage

type ChallengeMessage struct {
	TargetName string
	Flags      uint32
	Challenge  [8]byte
	TargetInfo []AVPair
}

ChallengeMessage is type 2 (server → client).

type NegotiateMessage

type NegotiateMessage struct {
	Flags uint32
}

NegotiateMessage is type 1 (client → server).

func DecodeNegotiate

func DecodeNegotiate(b []byte) (NegotiateMessage, error)