o jG@sddlZddlZddlZddlZddlZddlmZddlmZddl m Z ddl m Z ddl mZddlmZddlmZdd lmZdd lmZmZmZdd lmZdd lmZdd lmZddZGdddZ GdddZ!ddede!fddZ"dS)N)logger)NTLMCredential)NTLMServerInfo)NegotiateFlags) NTLMNegotiate) NTLMChallenge)NTLMAuthenticate)NTLMCredentials) MsvAvFlags AVPAIRTypeAVPair)NTLMv2Response)ChannelBindingsStruct)Callablecst|dSN)print)msgr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/relay/native.py log_cb_dummys rc@seZdZefddZdS)NTLMRelaySettingscCsPtd|_||_d|_d|_d|_d|_d|_ d|_ d|_ d|_ d|_ dS)NF)osurandomhexlog_id log_callbackforce_signdisabledropmicdropmic2 reflectionmodify_negotiate_cbmodify_challenge_cbmodify_authenticate_cb guest_allowedtimeout)selfrrrr__init__s zNTLMRelaySettings.__init__N)__name__ __module__ __qualname__rr(rrrrrsrc@seZdZd6ddZddZd7ddZd7d d Zd7d d Zd7d dZddZ ddZ ddZ ddZ ddZ ddZddZd8ddZd8d d!Zd"d#Zd8d$d%Zd8d&d'Zd(d)Zd*d+Zd,d-Zd.d/Zd0d1Zd2d3Zd9d4d5ZdS):NTLMRelayHandlerNcCsLd|_|dur t}td|_||_|jj|_|jj|_|jj |_ |jj |_ |jj |_ |jj |_ |jj |_ |jj|_|jj|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_d|_ d|_!d|_"d|_#d|_$d|_%d|_&d|_'d|_(t)*|_+t)*|_,t)*|_-t)*|_.d|_/dS)Nrr)0 spnego_objrrrrrsettingsrrrr r!r"r#r$r%flags challenge ntlmNegotiate ntlmChallengentlmAuthenticatentlmNegotiate_rawntlmChallenge_rawntlmAuthenticate_rawntlmNegotiate_serverntlmChallenge_serverntlmAuthenticate_serverntlmNegotiate_server_rawntlmChallenge_server_rawntlmAuthenticate_server_rawEncryptedRandomSessionKeyRandomSessionKeySessionBaseKeyKeyExchangeKeySignKey_clientSealKey_clientSignKey_serverSealKey_server iteration_cntntlm_credentials extra_infoasyncioEvent negotiate_evt challenge_evtauthenticate_evtstart_client_evtclient_side_exception)r'r.rrrr('sX              zNTLMRelayHandler.__init__cCdSNFrr'rrris_guest^zNTLMRelayHandler.is_guestTcC2|dkr|jtjO_dS|jtjM_dSNT)r/rNEGOTIATE_SIGNr'tfrrrset_signazNTLMRelayHandler.set_signcCrTrU)r/rNEGOTIATE_SEALrWrrrset_sealgrZzNTLMRelayHandler.set_sealcCrTrU)r/rNEGOTIATE_VERSIONrWrrr set_versionmrZzNTLMRelayHandler.set_versioncCrTrU)r/rNEGOTIATE_KEY_EXCHrWrrrset_kexsrZzNTLMRelayHandler.set_kexcCstj|jjvSr)r"NEGOTIATE_EXTENDED_SESSIONSECURITYr2rQrrris_extended_securityysz%NTLMRelayHandler.is_extended_securitycCrOrP)rrVr2r[rQrrrsigning_needed|rSzNTLMRelayHandler.signing_neededcCrOrP)rr[r2rQrrrencryption_neededrSz"NTLMRelayHandler.encryption_neededcCsB|jdurdSt|j|_t|j|j|j}|d|j_|jS)Nr) r2rfrom_challengerGr constructr1r3creds)r'rgrrrget_extra_infos  zNTLMRelayHandler.get_extra_infocCtzO Not possible to perform this function due to unknown keys during relaying NotImplementedError)r'handle signingKeyseqNummessagerrrMACzNTLMRelayHandler.MACcCrirjrk)r'rn sealingKey messageToSignmessageToEncryptrocipher_encryptrrrSEALrrzNTLMRelayHandler.SEALcCrirjrk)r'rnrprorvrrrSIGNrrzNTLMRelayHandler.SIGNClientcCrirjrkr'moderrr calc_sealkeyrrzNTLMRelayHandler.calc_sealkeycCrirjrkrzrrr calc_signkeyrrzNTLMRelayHandler.calc_signkeycCrONsrrQrrrget_session_keyrSz NTLMRelayHandler.get_session_keycCrOr~rrzrrr get_sealkeyrSzNTLMRelayHandler.get_sealkeycCrOr~rrzrrr get_signkeyrSzNTLMRelayHandler.get_signkeycsD|jdurd|j}|d|||fIdHdSt||dS)NzNTLM-%sz [%s][%s] %s)rrrlog)r'levelrsrcrrr log_asyncs   zNTLMRelayHandler.log_asynccCsX|jdur |j|jdur|j|jdur|j|jdur*|jdSdSr)rJsetrKrLrMrQrrr terminates       zNTLMRelayHandler.terminatec sz|jdur&|tjdIdH||j|jIdH\|_|_}d|fWS|jdurb|tjdIdH|j|_|jj t j M_ |jj t j M_ |jj t j M_ |jj t j M_ n||jdur|tjdIdH|j|_|jj t j M_ |jj t j M_ nT|jdur|tjdIdH|j|_|jj t j M_ |jj t j M_ n,|jdur|tjdIdH|j|_|jj t jM_ n|tjdIdH|j|_|j|_Wd Sty}ztd |fWYd}~Sd}~ww) a\ By default we don't modify the structures because there can be all kinds of integrity protections. However, if you find some cool stuff then you can just populate the modify_negotiate_cb in the settings, but you MUST return both ntlmNegotiate and ntlmNegotiate_raw structures and/or indicate an error which must be of class Exception! NzEGOTIATE] MODIFY EXTERNALTz[NEGOTIATE] DISABLING SINGINGz[NEGOTIATE] Drop MICz[NEGOTIATE] Drop MIC 2z4[NEGOTIATE] Reflection. Disabling extended security.z[NEGOTIATE] NO MODSNNF)r"rloggingDEBUGr7r:r1r4rrNEGOTIATE_ALWAYS_SIGNr_r[rVrr r!rato_bytes Exception traceback print_excr'errerrrmodify_negotiatesH        z!NTLMRelayHandler.modify_negotiatec sz|jdur&|tjdIdH||j|jIdH\|_|_}d|fWS|jdur@|tjdIdH|j|_|j|_Wd S|tjdIdHt |j|_t }t j |_d|_|jjjt|7_|jjjt|7_|jjd}||7}||jj7}|jj}||jjjdd dd 7}||jj7}||jjjdd dd 7}||jj7}||jj7}||jj7}|jjrt|jjt r||jj7}n||jj7}||7}||_Wd St!y}zt"#d|fWYd}~Sd}~ww) am By default we don't modify the structures because there can be all kinds of integrity protections. However, if you find some cool stuff then you can just populate the modify_authenticate_cb in the settings, but you MUST return both ntlmChallenge_server and ntlmChallenge_server_raw structures and/or indicate an error which must be of class Exception! NzHALLENGE] MODIFY EXTERNALFz[CHALLENGE] NO MODSz[CHALLENGE] Drop MIC 2rzutf-16lerlittle) byteordersignedr)$r#rrrr2r5r8r;r copydeepcopyr r r typedataTargetInfoFieldslengthlenr maxLength TargetNameencode TargetInfo Signature MessageTypeTargetNameFieldsrServerChallengeReservedVersion isinstancebytesrrr)r'r extra_avpairpayloadbuffrrrrmodify_challengesP        z!NTLMRelayHandler.modify_challengec szT|jdur'|tjdIdH||j|jIdH\|_|_}d|fWS|jduro|tjdIdH|j|_|jj t j M_ |jj t j M_ |jj t j M_ |jj t j M_ d|j_|j|_Wd S|jdur|tjdIdH|j|_|jj t j M_ |jj t j M_ |jj t j M_ |jj t j M_ d|j_t|jjtrtj|jjjjvrtj|jjjjtjvr|jjjjtjtjM<|jjjjtjdkr|jjjjtj=|jjjjtj=|j|_Wd S|jdurB|tjdIdH|j|_|jj t j M_ |jj t j M_ |jj t j M_ |jj t j M_ |j|_Wd S|tjdIdH|j|_|j|_Wd Styq}ztd |fWYd}~Sd}~ww) ae By default we don't modify the structures because there can be all kinds of integrity protections. However, if you find some cool stuff then you can just populate the modify_authenticate_cb in the settings, but you MUST return both ntlmAuthenticate and ntlmAuthenticate_raw structures and/or indicate an error which must be of class Exception! Nz[AUTHENTICATE] MODIFY EXTERNALTz[AUTHENTICATE] Drop MIC 2z[AUTHENTICATE] Drop MICrz [AUTHENTICATE] DISABLING SINGINGz[AUTHENTICATE] NO MODSrF)r$rrrr9r<r3r6r rrrVr_r[MIC to_bytes_fullrr NTChallenger r r ChallengeFromClinetDetails MIC_PRESENTMsvAvSingleHostrrrrrrrrrmodify_authenticate2sd     '     z$NTLMRelayHandler.modify_authenticatec sNz|tjd|IdH|jdurp||_t|j|_|tjdIdH|j |tjdIdH|j |tjdIdH|j dIdHt|j|jjIdH|tjdIdH|jd|jfWS||_t|d|_|j |tjd IdHdd |jfWSty}z dd |fWYd}~Sd}~ww) z] This function is to be called by the server side which we obtain the auth material from z[SRV] AUTHDATA: %sNz[SRV] Negotiate event: setz[SRV] Client start event: setz[SRV] Waiting for challenge...NTLMz[SRV] Challenge in!Tz[SRV] Authenticate event: setF)rrrrr1r:r from_bytesr7rJrrMr- notify_relayrHwait_forrKwaitr.r&r;rNr<rr9rLr)r'authdatarrrrauthenticate_relay_serverts0    z*NTLMRelayHandler.authenticate_relay_serverc sz|jdkr(|jdur(|tjdIdH|jIdH|tjdIdH|jdkr\|dur5td|IdH\}}|durD||jd7_|tjdIdH|j ddfWS|tjd IdH|jd7_||_ t ||_ |tjd |j IdH|IdH\}}|dur||j|tjd IdH|jIdH|IdH\}}|dur||tjd IdH|jjd kr|jdurtd|_ddtdfWS|jddfWSty}zt||_|IdHdd|fWYd}~Sd}~ww)zL FRONT TOWARD ENEMY This function is to be called by the client side. rNz$[CLI] Waiting for negotiate event...z [CLI] Negotiate event triggered!z-First call as client MUST be with empty data!z[CLI] Sending Negotiate dataTz[CLI] Challenge data obtainedz[CLI] Challenge %sz'[CLI] Waiting for authenticate event...z#[CLI] Authenticate event triggered!Fz Guest auth!)rEr1rrrrJrrrr4r5rrr2rrKrrLrr3UserNamer%rNr6rrr) r'authDatar/cb_dataspnkwargs_rrrrr authenticatesR    zNTLMRelayHandler.authenticater)T)ry)NNN)r)r*r+r(rRrYr\r^r`rbrcrdrhrqrwrxr|r}rrrrrrrrrrrrrrr,&s4 7         45Br,ntlm_settings_factoryreturncCs"|durt}n|}t|}|Sr)rr,)r ntlm_settingsntlm_ctxrrrntlmrelay_factorys rr)#rrHrrrasyauthrasyauth.common.credentials.ntlmr,asyauth.protocols.ntlm.structures.serverinfor1asyauth.protocols.ntlm.structures.negotiate_flagsr)asyauth.protocols.ntlm.messages.negotiater)asyauth.protocols.ntlm.messages.challenger,asyauth.protocols.ntlm.messages.authenticater!asyauth.protocols.ntlm.creds_calcr (asyauth.protocols.ntlm.structures.avpairr r r 4asyauth.protocols.ntlm.structures.challenge_responser #minikerberos.gssapi.channelbindingsrtypingrrrr,rrrrrs0           $