/// <summary>
/// Client X.224 Connection Request PDU
/// </summary>
private static void sendConnectNegotiation(NegotiationProtocol NegotiationFlags, byte[] loadBalanceToken)
{
string domainAndUsername = Options.DomainAndUsername;
if (domainAndUsername.Length > 9)
{
domainAndUsername = domainAndUsername.Substring(0, 9);
}
RdpPacket packet = new RdpPacket();
packet.WriteByte(3);
packet.WriteByte(0);
long position = packet.Position;
packet.WriteBigEndian16((short)0);
packet.WriteByte(0);
packet.WriteByte(0xe0);
packet.WriteBigEndian16((short)0);
packet.WriteBigEndian16((short)0);
packet.WriteByte(0);
if (loadBalanceToken != null)
{
packet.Write(loadBalanceToken, 0, loadBalanceToken.Length);
packet.WriteString("\r\n", false);
}
else
{
packet.WriteString("Cookie: mstshash=" + domainAndUsername + "\r\n", true);
}
// RDP Negotiation Request
packet.WriteByte(0x01);
packet.WriteByte(0);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian32((int)NegotiationFlags); // Standard RDP Security, TLS 1.0, CredSSP
long num2 = packet.Position;
packet.Position = position;
packet.WriteBigEndian16((short)num2);
packet.WriteByte((byte)(num2 - 5L));
IsoLayer.Write(packet);
}
public byte[] Negotiate()
{
RdpPacket packet = new RdpPacket();
uint num = (((((((0xe2000000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_OEM) | NTLMSSP_NEGOTIATE_UNICODE;
int position = (int)packet.Position;
packet.WriteString("NTLMSSP", false);
packet.WriteByte(0);
packet.WriteLittleEndian32(1);
packet.WriteLittleEndian32(num);
int num3 = ((int)packet.Position) - position;
num3 += 8;
num3 += 8;
if ((num & 0x2000000) != 0)
{
num3 += 8;
}
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian16((short)0);
packet.WriteLittleEndian32(0);
if ((num & 0x2000000) != 0)
{
this.WriteVersion(packet);
}
packet.Position = 0L;
this.m_NegotiateMsg = new byte[packet.Length];
packet.Read(this.m_NegotiateMsg, 0, this.m_NegotiateMsg.Length);
return(this.m_NegotiateMsg);
}
/// <summary>
/// Client MCS Connect Initial PDU
/// Part 2
///
/// Create packet
/// </summary>
internal static RdpPacket sendMcsData(bool useRdp5, int num_channels, int serverSelectedProtocol)
{
RdpPacket packet = new RdpPacket();
// Проверка длины Client Name
string clientName = Options.ClientName;
if (clientName.Length > 15)
{
clientName = clientName.Substring(0, 15);
}
int num = 2 * clientName.Length;
int num2 = 0x9e;
if (useRdp5)
{
num2 += 0x60;
}
if (useRdp5 && (num_channels > 0))
{
num2 += (num_channels * 12) + 8;
}
if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
{
num2 += 8;
}
packet.WriteBigEndian16((short)5);
packet.WriteBigEndian16((short)20);
packet.WriteByte(0x7c);
packet.WriteBigEndian16((short)1);
packet.WriteBigEndian16((short)(num2 | 0x8000));
packet.WriteBigEndian16((short)8);
packet.WriteBigEndian16((short)0x10);
packet.WriteByte(0);
packet.WriteLittleEndian16((ushort)0xc001);
packet.WriteByte(0);
packet.WriteLittleEndian32(0x61637544);
packet.WriteBigEndian16((short)((num2 - 14) | 0x8000));
// Client Core Data (TS_UD_CS_CORE)
packet.WriteLittleEndian16((ushort)CLIENT.CS_CORE);
packet.WriteLittleEndian16(useRdp5 ? ((short)0xd8) : ((short)0x88));
packet.WriteLittleEndian16(useRdp5 ? ((short)4) : ((short)1));
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian16((short)Options.width); // Width
packet.WriteLittleEndian16((short)Options.height); // Height
packet.WriteLittleEndian16((ushort)0xca01);
packet.WriteLittleEndian16((ushort)0xaa03);
packet.WriteLittleEndian32(Options.Keyboard); // Клавиатура
packet.WriteLittleEndian32(useRdp5 ? 0xa28 : 0x1a3); // Client Build
packet.WriteUnicodeString(clientName); // Client Name
packet.Position += 30 - num;
packet.WriteLittleEndian32(0x00000004); // IBM enhanced (101- or 102-key) keyboard
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian32(12); // Функциональные клавиши (F1-F12)
packet.Position += 0x40L;
packet.WriteLittleEndian16((ushort)0xCA01); // NS_UD_COLOR_8BPP
packet.WriteLittleEndian16(useRdp5 ? ((short)1) : ((short)0));
if (useRdp5)
{
packet.WriteLittleEndian32(0);
packet.WriteLittleEndian16((short)((byte)Options.server_bpp));
packet.WriteLittleEndian16((short)7);
packet.WriteLittleEndian16((short)1);
packet.Position += 0x40L;
packet.WriteByte(0);
packet.WriteByte(0);
packet.WriteLittleEndian32(serverSelectedProtocol);
// Client Cluster Data (TS_UD_CS_CLUSTER)
packet.WriteLittleEndian16((ushort)CLIENT.CS_CLUSTER);
packet.WriteLittleEndian16((short)12);
int num3 = 13;
if (Options.flags.HasFlag(HostFlags.ConsoleSession) || (Options.sessionID != 0))
{
num3 |= 2;
}
packet.WriteLittleEndian32(num3);
packet.WriteLittleEndian32(Options.sessionID);
}
// Client Security Data (TS_UD_CS_SEC)
packet.WriteLittleEndian16((ushort)CLIENT.CS_SECURITY);
packet.WriteLittleEndian16(useRdp5 ? ((short)12) : ((short)8));
int num4 = 0;
if (serverSelectedProtocol == 0)
{
num4 |= 3;
}
packet.WriteLittleEndian32(num4);
if (useRdp5)
{
packet.WriteLittleEndian32(0);
}
// Client Network Data (TS_UD_CS_NET)
if (useRdp5 && (num_channels > 0))
{
packet.WriteLittleEndian16((ushort)CLIENT.CS_NET);
packet.WriteLittleEndian16((short)((num_channels * 12) + 8));
packet.WriteLittleEndian32(num_channels);
foreach (IVirtualChannel channel in Channels.RegisteredChannels)
{
Debug.WriteLine("Client Network Data. Channel name length: " + channel.ChannelName.Length);
packet.WriteString(channel.ChannelName, false);
packet.WriteBigEndian32((uint)(CHANNEL_DEF.CHANNEL_OPTION_INITIALIZED));
}
}
// Client Message Channel Data (TS_UD_CS_MCS_MSGCHANNEL)
if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED))
{
packet.WriteLittleEndian16((ushort)CLIENT.CS_MCS_MSGCHANNEL);
packet.WriteLittleEndian16((short)8);
packet.WriteLittleEndian32(0);
}
return(packet);
}
private byte[] Authenticate(byte[] lmChallengeResponse, byte[] ntChallengeResponse, string sDomainName, string sUser, string sWorkstation, byte[] EncryptedRandomSessionKey, byte[] ExportedSessionKey, bool bGenerateMIC)
{
RdpPacket packet = new RdpPacket();
uint flags = (
(((((0xe2800000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) |
NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) |
NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) |
NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_UNICODE;
DumpFlags(flags);
int position = (int)packet.Position;
packet.WriteString("NTLMSSP", false);
packet.WriteByte(0);
packet.WriteLittleEndian32(3);
int num3 = ((int)packet.Position) - position;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 8;
num3 += 4;
if ((flags & 0x2000000) != 0)
{
num3 += 8;
}
if (bGenerateMIC)
{
num3 += 0x10;
}
byte[] bytes = Encoding.Unicode.GetBytes(sDomainName);
byte[] buffer = Encoding.Unicode.GetBytes(sUser);
byte[] buffer3 = Encoding.Unicode.GetBytes(sWorkstation);
int num4 = num3;
int num5 = num4 + bytes.Length;
int num6 = num5 + buffer.Length;
int num7 = num6 + buffer3.Length;
int num8 = num7 + lmChallengeResponse.Length;
int num9 = num8 + ntChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length);
packet.WriteLittleEndian32(num7);
num3 += lmChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length);
packet.WriteLittleEndian32(num8);
num3 += ntChallengeResponse.Length;
packet.WriteLittleEndian16((ushort)bytes.Length);
packet.WriteLittleEndian16((ushort)bytes.Length);
packet.WriteLittleEndian32(num4);
num3 += bytes.Length;
packet.WriteLittleEndian16((ushort)buffer.Length);
packet.WriteLittleEndian16((ushort)buffer.Length);
packet.WriteLittleEndian32(num5);
num3 += buffer.Length;
packet.WriteLittleEndian16((ushort)buffer3.Length);
packet.WriteLittleEndian16((ushort)buffer3.Length);
packet.WriteLittleEndian32(num6);
num3 += buffer3.Length;
packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length);
packet.WriteLittleEndian32(num9);
num3 += EncryptedRandomSessionKey.Length;
packet.WriteLittleEndian32(flags);
if ((flags & 0x2000000) != 0)
{
this.WriteVersion(packet);
}
long num10 = packet.Position;
if (bGenerateMIC)
{
packet.WritePadding(0x10);
}
packet.Write(bytes, 0, bytes.Length);
packet.Write(buffer, 0, buffer.Length);
packet.Write(buffer3, 0, buffer3.Length);
packet.Write(lmChallengeResponse, 0, lmChallengeResponse.Length);
packet.Write(ntChallengeResponse, 0, ntChallengeResponse.Length);
packet.Write(EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length);
if (bGenerateMIC)
{
packet.Position = 0L;
byte[] buffer4 = new byte[packet.Length];
packet.Read(buffer4, 0, buffer4.Length);
HMACT64 hmact = new HMACT64(ExportedSessionKey);
hmact.update(this.m_NegotiateMsg);
hmact.update(this.m_ChallengeMsg);
hmact.update(buffer4);
byte[] buffer5 = hmact.digest();
packet.Position = num10;
packet.Write(buffer5, 0, buffer5.Length);
}
packet.Position = 0L;
byte[] buffer6 = new byte[packet.Length];
packet.Read(buffer6, 0, buffer6.Length);
return(buffer6);
}
