/// <summary> /// compute response /// </summary> /// <param name="flags">the flags for challenge</param> /// <param name="serverChallenge">the server challenge</param> /// <param name="targetInfo">the target info contains avpairs</param> /// <param name="responseKeyNT">the response nt key</param> /// <param name="responseKeyLM">the response lm key</param> /// <param name="lmChallengeResponse">the challenge response lm</param> /// <param name="ntChallengeResponse">the challenge response nt</param> private void ComputeResponse( NegotiateTypes flags, ulong serverChallenge, ICollection <AV_PAIR> targetInfo, byte[] responseKeyNT, byte[] responseKeyLM, out byte[] lmChallengeResponse, out byte[] ntChallengeResponse ) { // clientChallenge, a random 8 bytes. ulong clientChallenge = NlmpUtility.BytesToSecurityUInt64(NlmpUtility.Nonce(8)); // time ulong time = 0; if (!NlmpUtility.IsNtlmV1(this.client.Config.Version)) { time = NlmpUtility.GetTime(targetInfo); } byte[] sessionBaseKey = null; // compute response NlmpUtility.ComputeResponse( this.client.Config.Version, flags, responseKeyNT, responseKeyLM, serverChallenge, clientChallenge, time, NlmpUtility.AvPairCollectionGetBytes(targetInfo), out ntChallengeResponse, out lmChallengeResponse, out sessionBaseKey); // save key to context this.client.Context.SessionBaseKey = sessionBaseKey; }
/// <summary> /// retrieve the domain name from client. client encode the domain name in the authenticate packet. /// </summary> /// <param name="authenticatePacket">the authenticate packet contains the domain name</param> /// <returns>the authentication information of client</returns> private ClientAuthenticateInfomation RetrieveClientAuthenticateInformation( NlmpAuthenticatePacket authenticatePacket) { ClientAuthenticateInfomation authenticateInformation = new ClientAuthenticateInfomation(); // retrieve the version of client if (authenticatePacket.Payload.NtChallengeResponseFields.Len == NTLM_V1_NT_CHALLENGE_RESPONSE_LENGTH) { authenticateInformation.Version = NlmpVersion.v1; } else { authenticateInformation.Version = NlmpVersion.v2; } // retrieve the client challenge if (authenticateInformation.Version == NlmpVersion.v1) { authenticateInformation.ClientChallenge = BitConverter.ToUInt64(ArrayUtility.SubArray <byte>( authenticatePacket.Payload.LmChallengeResponse, 0, TIME_CLIENT_CHALLENGE_LENGTH), 0); } else { authenticateInformation.ClientChallenge = BitConverter.ToUInt64( ArrayUtility.SubArray <byte>(authenticatePacket.Payload.NtChallengeResponse, NTLM_V2_CLIENT_CHALLENGE_OFFSET_IN_NT_CHALLENGE_RESPONSE, TIME_CLIENT_CHALLENGE_LENGTH), 0); } // retrieve the domain name of client if (NlmpUtility.IsUnicode(authenticatePacket.Payload.NegotiateFlags)) { authenticateInformation.DomainName = Encoding.Unicode.GetString(authenticatePacket.Payload.DomainName); } else { authenticateInformation.DomainName = Encoding.ASCII.GetString(authenticatePacket.Payload.DomainName); } // retrieve the user name of client if (NlmpUtility.IsUnicode(authenticatePacket.Payload.NegotiateFlags)) { authenticateInformation.UserName = Encoding.Unicode.GetString(authenticatePacket.Payload.UserName); } else { authenticateInformation.UserName = Encoding.ASCII.GetString(authenticatePacket.Payload.UserName); } // retrieve the server name of client if (authenticateInformation.Version == NlmpVersion.v2) { authenticateInformation.ServerName = ArrayUtility.SubArray <byte>(authenticatePacket.Payload.NtChallengeResponse, NTLM_V2_SERVER_NAME_OFFSET_IN_NT_CHALLENGE_RESPONSE, authenticatePacket.Payload.NtChallengeResponseFields.Len - NTLM_V2_SERVER_NAME_OFFSET_IN_NT_CHALLENGE_RESPONSE - NTLM_V2_SERVER_NAME_RESERVED_LENGTH_IN_NT_CHALLENGE_RESPONSE); } // retrieve the time of client ICollection <AV_PAIR> targetInfo = NlmpUtility.BytesGetAvPairCollection(this.challenge.Payload.TargetInfo); // retrieve the time authenticateInformation.ClientTime = NlmpUtility.GetTime(targetInfo); // if server did not response the timestamp, use the client time stamp if (!NlmpUtility.AvPairContains(targetInfo, AV_PAIR_IDs.MsvAvTimestamp) && authenticateInformation.Version == NlmpVersion.v2) { authenticateInformation.ClientTime = BitConverter.ToUInt64( ArrayUtility.SubArray <byte>(authenticatePacket.Payload.NtChallengeResponse, NTLM_V2_TIME_STAMP_OFFSET_IN_NT_CHALLENGE_RESPONSE, TIME_STAMP_LENGTH), 0); } return(authenticateInformation); }