private byte[] Authenticate(byte[] lmChallengeResponse, byte[] ntChallengeResponse, string sDomainName, string sUser, string sWorkstation, byte[] EncryptedRandomSessionKey, byte[] ExportedSessionKey, bool bGenerateMIC) { RdpPacket packet = new RdpPacket(); uint flags = ( (((((0xe2800000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_UNICODE; DumpFlags(flags); int position = (int)packet.Position; packet.WriteString("NTLMSSP", false); packet.WriteByte(0); packet.WriteLittleEndian32(3); int num3 = ((int)packet.Position) - position; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 4; if ((flags & 0x2000000) != 0) { num3 += 8; } if (bGenerateMIC) { num3 += 0x10; } byte[] bytes = Encoding.Unicode.GetBytes(sDomainName); byte[] buffer = Encoding.Unicode.GetBytes(sUser); byte[] buffer3 = Encoding.Unicode.GetBytes(sWorkstation); int num4 = num3; int num5 = num4 + bytes.Length; int num6 = num5 + buffer.Length; int num7 = num6 + buffer3.Length; int num8 = num7 + lmChallengeResponse.Length; int num9 = num8 + ntChallengeResponse.Length; packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length); packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length); packet.WriteLittleEndian32(num7); num3 += lmChallengeResponse.Length; packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length); packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length); packet.WriteLittleEndian32(num8); num3 += ntChallengeResponse.Length; packet.WriteLittleEndian16((ushort)bytes.Length); packet.WriteLittleEndian16((ushort)bytes.Length); packet.WriteLittleEndian32(num4); num3 += bytes.Length; packet.WriteLittleEndian16((ushort)buffer.Length); packet.WriteLittleEndian16((ushort)buffer.Length); packet.WriteLittleEndian32(num5); num3 += buffer.Length; packet.WriteLittleEndian16((ushort)buffer3.Length); packet.WriteLittleEndian16((ushort)buffer3.Length); packet.WriteLittleEndian32(num6); num3 += buffer3.Length; packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length); packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length); packet.WriteLittleEndian32(num9); num3 += EncryptedRandomSessionKey.Length; packet.WriteLittleEndian32(flags); if ((flags & 0x2000000) != 0) { this.WriteVersion(packet); } long num10 = packet.Position; if (bGenerateMIC) { packet.WritePadding(0x10); } packet.Write(bytes, 0, bytes.Length); packet.Write(buffer, 0, buffer.Length); packet.Write(buffer3, 0, buffer3.Length); packet.Write(lmChallengeResponse, 0, lmChallengeResponse.Length); packet.Write(ntChallengeResponse, 0, ntChallengeResponse.Length); packet.Write(EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length); if (bGenerateMIC) { packet.Position = 0L; byte[] buffer4 = new byte[packet.Length]; packet.Read(buffer4, 0, buffer4.Length); HMACT64 hmact = new HMACT64(ExportedSessionKey); hmact.update(this.m_NegotiateMsg); hmact.update(this.m_ChallengeMsg); hmact.update(buffer4); byte[] buffer5 = hmact.digest(); packet.Position = num10; packet.Write(buffer5, 0, buffer5.Length); } packet.Position = 0L; byte[] buffer6 = new byte[packet.Length]; packet.Read(buffer6, 0, buffer6.Length); return(buffer6); }
public byte[] Serialise() { RdpPacket packet = new RdpPacket(); if (this.NbDomainName.length > 0) { packet.WriteLittleEndian16((short)2); packet.WriteLittleEndian16((short)this.NbDomainName.length); packet.Write(this.NbDomainName.value, 0, this.NbDomainName.length); } if (this.NbComputerName.length > 0) { packet.WriteLittleEndian16((short)1); packet.WriteLittleEndian16((short)this.NbComputerName.length); packet.Write(this.NbComputerName.value, 0, this.NbComputerName.length); } if (this.DnsDomainName.length > 0) { packet.WriteLittleEndian16((short)4); packet.WriteLittleEndian16((short)this.DnsDomainName.length); packet.Write(this.DnsDomainName.value, 0, this.DnsDomainName.length); } if (this.DnsComputerName.length > 0) { packet.WriteLittleEndian16((short)3); packet.WriteLittleEndian16((short)this.DnsComputerName.length); packet.Write(this.DnsComputerName.value, 0, this.DnsComputerName.length); } if (this.DnsTreeName.length > 0) { packet.WriteLittleEndian16((short)5); packet.WriteLittleEndian16((short)this.DnsTreeName.length); packet.Write(this.DnsTreeName.value, 0, this.DnsTreeName.length); } if (this.Timestamp.length > 0) { packet.WriteLittleEndian16((short)7); packet.WriteLittleEndian16((short)this.Timestamp.length); packet.Write(this.Timestamp.value, 0, this.Timestamp.length); } if (this.Flags != 0) { packet.WriteLittleEndian16((short)6); packet.WriteLittleEndian16((short)4); packet.WriteLittleEndian32(this.Flags); } if (this.Restrictions.length > 0) { packet.WriteLittleEndian16((short)8); packet.WriteLittleEndian16((short)this.Restrictions.length); packet.Write(this.Restrictions.value, 0, this.Restrictions.length); } if (this.ChannelBindings.length > 0) { packet.WriteLittleEndian16((short)10); packet.WriteLittleEndian16((short)this.ChannelBindings.length); packet.Write(this.ChannelBindings.value, 0, this.ChannelBindings.length); } if (this.TargetName.value != null) { packet.WriteLittleEndian16((short)9); packet.WriteLittleEndian16((short)this.TargetName.length); packet.Write(this.TargetName.value, 0, this.TargetName.length); } packet.WriteLittleEndian16((short)0); packet.WriteLittleEndian16((short)0); packet.WritePadding(8); byte[] buffer = new byte[packet.Length]; packet.Position = 0L; packet.Read(buffer, 0, buffer.Length); return(buffer); }
public byte[] ProcessChallenge(byte[] Challenge) { byte[] bytes; RdpPacket packet = new RdpPacket(); this.m_ChallengeMsg = Challenge; packet.Write(Challenge, 0, Challenge.Length); packet.Position = 0L; long position = packet.Position; if (packet.ReadString(8) != "NTLMSSP\0") { throw new Exception("Invalid negotiation token!"); } if (packet.ReadLittleEndian32() != 2) { throw new Exception("Expected challenge!"); } int count = packet.ReadLittleEndian16(); packet.ReadLittleEndian16(); int num4 = packet.ReadLittleEndian32(); uint flags = (uint)packet.ReadLittleEndian32(); DumpFlags(flags); byte[] buffer = new byte[8]; packet.Read(buffer, 0, 8); DumpHex(buffer, buffer.Length, "Server Challenge"); byte[] buffer2 = new byte[8]; packet.Read(buffer2, 0, 8); int num5 = packet.ReadLittleEndian16(); packet.ReadLittleEndian16(); int num6 = packet.ReadLittleEndian32(); if ((flags & 0x2000000) != 0) { byte[] buffer3 = new byte[8]; packet.Read(buffer3, 0, 8); } if ((flags & 0x20000000) == 0) { throw new Exception("Strong Encryption not supported by server"); } byte[] buffer4 = null; if (count > 0) { buffer4 = new byte[count]; packet.Position = position + num4; packet.Read(buffer4, 0, count); Encoding.Unicode.GetString(buffer4, 0, buffer4.Length); } AV_PAIRS av_pairs = new AV_PAIRS(); byte[] buffer5 = null; if (num5 <= 0) { throw new Exception("No TargetInfo!"); } packet.Position = position + num6; buffer5 = new byte[num5]; packet.Read(buffer5, 0, num5); packet = new RdpPacket(); packet.Write(buffer5, 0, buffer5.Length); packet.Position = 0L; av_pairs.Parse(packet); buffer5 = av_pairs.Serialise(); byte[] data = nTOWFv2(this.m_sDomain, this.m_sUsername, this.m_sPassword); if (Network.Logger != null) { if (Network.Logger.Reading) { data = this.m_Socket.GetBlob(PacketLogger.PacketType.NTLM_ResponseKeyNT); } else { this.m_Socket.AddBlob(PacketLogger.PacketType.NTLM_ResponseKeyNT, data); } } byte[] blob = new byte[8]; RNGCryptoServiceProvider provider = new RNGCryptoServiceProvider(); provider.GetBytes(blob); if (Network.Logger != null) { if (Network.Logger.Reading) { blob = this.m_Socket.GetBlob(PacketLogger.PacketType.NTLM_ClientChallenge); } else { this.m_Socket.AddBlob(PacketLogger.PacketType.NTLM_ClientChallenge, blob); } } DumpHex(blob, blob.Length, "Client Challenge"); byte[] buffer8 = getLMv2Response(data, buffer, blob); DumpHex(buffer8, buffer8.Length, "LM Response"); if (this.m_bNTLMv2) { Array.Clear(buffer8, 0, buffer8.Length); } bool bGenerateMIC = false; if ((av_pairs.Timestamp.length <= 0) || !this.m_bNTLMv2) { bytes = BitConverter.GetBytes(DateTime.UtcNow.ToFileTimeUtc()); } else { bytes = av_pairs.Timestamp.value; bGenerateMIC = true; av_pairs.ProcessForNTLMv2(); buffer5 = av_pairs.Serialise(); } DumpHex(buffer5, buffer5.Length, "targetinfo"); byte[] keyExchangeKey = null; byte[] buffer11 = getNTLMv2Response(data, buffer, blob, bytes, buffer5, out keyExchangeKey); DumpHex(buffer11, buffer11.Length, "NTLMv2 Response"); if (Network.Logger != null) { if (Network.Logger.Reading) { keyExchangeKey = this.m_Socket.GetBlob(PacketLogger.PacketType.NTLM_KeyExchangeKey); } else { this.m_Socket.AddBlob(PacketLogger.PacketType.NTLM_KeyExchangeKey, keyExchangeKey); } } byte[] encryptedRandomSessionKey = null; byte[] buffer13 = null; buffer13 = new byte[0x10]; provider.GetBytes(buffer13); if (Network.Logger != null) { if (Network.Logger.Reading) { buffer13 = this.m_Socket.GetBlob(PacketLogger.PacketType.NTLM_ExportedSessionKey); } else { this.m_Socket.AddBlob(PacketLogger.PacketType.NTLM_ExportedSessionKey, buffer13); } } encryptedRandomSessionKey = new byte[0x10]; RC4 rc = new RC4(); rc.engineInitEncrypt(keyExchangeKey); encryptedRandomSessionKey = rc.crypt(buffer13); if ((flags & 0x40000000) == 0) { encryptedRandomSessionKey = new byte[0]; buffer13 = keyExchangeKey; } this.InitSignKeys(buffer13); return(this.Authenticate(buffer8, buffer11, this.m_sDomain, this.m_sUsername, this.m_sWorkstation, encryptedRandomSessionKey, buffer13, bGenerateMIC)); }