/// <summary> /// Client X.224 Connection Request PDU /// </summary> private static void sendConnectNegotiation(NegotiationProtocol NegotiationFlags, byte[] loadBalanceToken) { string domainAndUsername = Options.DomainAndUsername; if (domainAndUsername.Length > 9) { domainAndUsername = domainAndUsername.Substring(0, 9); } RdpPacket packet = new RdpPacket(); packet.WriteByte(3); packet.WriteByte(0); long position = packet.Position; packet.WriteBigEndian16((short)0); packet.WriteByte(0); packet.WriteByte(0xe0); packet.WriteBigEndian16((short)0); packet.WriteBigEndian16((short)0); packet.WriteByte(0); if (loadBalanceToken != null) { packet.Write(loadBalanceToken, 0, loadBalanceToken.Length); packet.WriteString("\r\n", false); } else { packet.WriteString("Cookie: mstshash=" + domainAndUsername + "\r\n", true); } // RDP Negotiation Request packet.WriteByte(0x01); packet.WriteByte(0); packet.WriteLittleEndian16((short)8); packet.WriteLittleEndian32((int)NegotiationFlags); // Standard RDP Security, TLS 1.0, CredSSP long num2 = packet.Position; packet.Position = position; packet.WriteBigEndian16((short)num2); packet.WriteByte((byte)(num2 - 5L)); IsoLayer.Write(packet); }
public byte[] Negotiate() { RdpPacket packet = new RdpPacket(); uint num = (((((((0xe2000000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_OEM) | NTLMSSP_NEGOTIATE_UNICODE; int position = (int)packet.Position; packet.WriteString("NTLMSSP", false); packet.WriteByte(0); packet.WriteLittleEndian32(1); packet.WriteLittleEndian32(num); int num3 = ((int)packet.Position) - position; num3 += 8; num3 += 8; if ((num & 0x2000000) != 0) { num3 += 8; } packet.WriteLittleEndian16((short)0); packet.WriteLittleEndian16((short)0); packet.WriteLittleEndian32(0); packet.WriteLittleEndian16((short)0); packet.WriteLittleEndian16((short)0); packet.WriteLittleEndian32(0); if ((num & 0x2000000) != 0) { this.WriteVersion(packet); } packet.Position = 0L; this.m_NegotiateMsg = new byte[packet.Length]; packet.Read(this.m_NegotiateMsg, 0, this.m_NegotiateMsg.Length); return(this.m_NegotiateMsg); }
/// <summary> /// Client MCS Connect Initial PDU /// Part 2 /// /// Create packet /// </summary> internal static RdpPacket sendMcsData(bool useRdp5, int num_channels, int serverSelectedProtocol) { RdpPacket packet = new RdpPacket(); // Проверка длины Client Name string clientName = Options.ClientName; if (clientName.Length > 15) { clientName = clientName.Substring(0, 15); } int num = 2 * clientName.Length; int num2 = 0x9e; if (useRdp5) { num2 += 0x60; } if (useRdp5 && (num_channels > 0)) { num2 += (num_channels * 12) + 8; } if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED)) { num2 += 8; } packet.WriteBigEndian16((short)5); packet.WriteBigEndian16((short)20); packet.WriteByte(0x7c); packet.WriteBigEndian16((short)1); packet.WriteBigEndian16((short)(num2 | 0x8000)); packet.WriteBigEndian16((short)8); packet.WriteBigEndian16((short)0x10); packet.WriteByte(0); packet.WriteLittleEndian16((ushort)0xc001); packet.WriteByte(0); packet.WriteLittleEndian32(0x61637544); packet.WriteBigEndian16((short)((num2 - 14) | 0x8000)); // Client Core Data (TS_UD_CS_CORE) packet.WriteLittleEndian16((ushort)CLIENT.CS_CORE); packet.WriteLittleEndian16(useRdp5 ? ((short)0xd8) : ((short)0x88)); packet.WriteLittleEndian16(useRdp5 ? ((short)4) : ((short)1)); packet.WriteLittleEndian16((short)8); packet.WriteLittleEndian16((short)Options.width); // Width packet.WriteLittleEndian16((short)Options.height); // Height packet.WriteLittleEndian16((ushort)0xca01); packet.WriteLittleEndian16((ushort)0xaa03); packet.WriteLittleEndian32(Options.Keyboard); // Клавиатура packet.WriteLittleEndian32(useRdp5 ? 0xa28 : 0x1a3); // Client Build packet.WriteUnicodeString(clientName); // Client Name packet.Position += 30 - num; packet.WriteLittleEndian32(0x00000004); // IBM enhanced (101- or 102-key) keyboard packet.WriteLittleEndian32(0); packet.WriteLittleEndian32(12); // Функциональные клавиши (F1-F12) packet.Position += 0x40L; packet.WriteLittleEndian16((ushort)0xCA01); // NS_UD_COLOR_8BPP packet.WriteLittleEndian16(useRdp5 ? ((short)1) : ((short)0)); if (useRdp5) { packet.WriteLittleEndian32(0); packet.WriteLittleEndian16((short)((byte)Options.server_bpp)); packet.WriteLittleEndian16((short)7); packet.WriteLittleEndian16((short)1); packet.Position += 0x40L; packet.WriteByte(0); packet.WriteByte(0); packet.WriteLittleEndian32(serverSelectedProtocol); // Client Cluster Data (TS_UD_CS_CLUSTER) packet.WriteLittleEndian16((ushort)CLIENT.CS_CLUSTER); packet.WriteLittleEndian16((short)12); int num3 = 13; if (Options.flags.HasFlag(HostFlags.ConsoleSession) || (Options.sessionID != 0)) { num3 |= 2; } packet.WriteLittleEndian32(num3); packet.WriteLittleEndian32(Options.sessionID); } // Client Security Data (TS_UD_CS_SEC) packet.WriteLittleEndian16((ushort)CLIENT.CS_SECURITY); packet.WriteLittleEndian16(useRdp5 ? ((short)12) : ((short)8)); int num4 = 0; if (serverSelectedProtocol == 0) { num4 |= 3; } packet.WriteLittleEndian32(num4); if (useRdp5) { packet.WriteLittleEndian32(0); } // Client Network Data (TS_UD_CS_NET) if (useRdp5 && (num_channels > 0)) { packet.WriteLittleEndian16((ushort)CLIENT.CS_NET); packet.WriteLittleEndian16((short)((num_channels * 12) + 8)); packet.WriteLittleEndian32(num_channels); foreach (IVirtualChannel channel in Channels.RegisteredChannels) { Debug.WriteLine("Client Network Data. Channel name length: " + channel.ChannelName.Length); packet.WriteString(channel.ChannelName, false); packet.WriteBigEndian32((uint)(CHANNEL_DEF.CHANNEL_OPTION_INITIALIZED)); } } // Client Message Channel Data (TS_UD_CS_MCS_MSGCHANNEL) if (Options.serverNegotiateFlags.HasFlag(NegotiationFlags.EXTENDED_CLIENT_DATA_SUPPORTED)) { packet.WriteLittleEndian16((ushort)CLIENT.CS_MCS_MSGCHANNEL); packet.WriteLittleEndian16((short)8); packet.WriteLittleEndian32(0); } return(packet); }
private byte[] Authenticate(byte[] lmChallengeResponse, byte[] ntChallengeResponse, string sDomainName, string sUser, string sWorkstation, byte[] EncryptedRandomSessionKey, byte[] ExportedSessionKey, bool bGenerateMIC) { RdpPacket packet = new RdpPacket(); uint flags = ( (((((0xe2800000 | NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY) | NTLMSSP_NEGOTIATE_ALWAYS_SIGN) | NTLMSSP_NEGOTIATE_NTLM) | NTLMSSP_NEGOTIATE_SEAL) | NTLMSSP_NEGOTIATE_SIGN) | NTLMSSP_REQUEST_TARGET) | NTLMSSP_NEGOTIATE_UNICODE; DumpFlags(flags); int position = (int)packet.Position; packet.WriteString("NTLMSSP", false); packet.WriteByte(0); packet.WriteLittleEndian32(3); int num3 = ((int)packet.Position) - position; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 8; num3 += 4; if ((flags & 0x2000000) != 0) { num3 += 8; } if (bGenerateMIC) { num3 += 0x10; } byte[] bytes = Encoding.Unicode.GetBytes(sDomainName); byte[] buffer = Encoding.Unicode.GetBytes(sUser); byte[] buffer3 = Encoding.Unicode.GetBytes(sWorkstation); int num4 = num3; int num5 = num4 + bytes.Length; int num6 = num5 + buffer.Length; int num7 = num6 + buffer3.Length; int num8 = num7 + lmChallengeResponse.Length; int num9 = num8 + ntChallengeResponse.Length; packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length); packet.WriteLittleEndian16((ushort)lmChallengeResponse.Length); packet.WriteLittleEndian32(num7); num3 += lmChallengeResponse.Length; packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length); packet.WriteLittleEndian16((ushort)ntChallengeResponse.Length); packet.WriteLittleEndian32(num8); num3 += ntChallengeResponse.Length; packet.WriteLittleEndian16((ushort)bytes.Length); packet.WriteLittleEndian16((ushort)bytes.Length); packet.WriteLittleEndian32(num4); num3 += bytes.Length; packet.WriteLittleEndian16((ushort)buffer.Length); packet.WriteLittleEndian16((ushort)buffer.Length); packet.WriteLittleEndian32(num5); num3 += buffer.Length; packet.WriteLittleEndian16((ushort)buffer3.Length); packet.WriteLittleEndian16((ushort)buffer3.Length); packet.WriteLittleEndian32(num6); num3 += buffer3.Length; packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length); packet.WriteLittleEndian16((ushort)EncryptedRandomSessionKey.Length); packet.WriteLittleEndian32(num9); num3 += EncryptedRandomSessionKey.Length; packet.WriteLittleEndian32(flags); if ((flags & 0x2000000) != 0) { this.WriteVersion(packet); } long num10 = packet.Position; if (bGenerateMIC) { packet.WritePadding(0x10); } packet.Write(bytes, 0, bytes.Length); packet.Write(buffer, 0, buffer.Length); packet.Write(buffer3, 0, buffer3.Length); packet.Write(lmChallengeResponse, 0, lmChallengeResponse.Length); packet.Write(ntChallengeResponse, 0, ntChallengeResponse.Length); packet.Write(EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length); if (bGenerateMIC) { packet.Position = 0L; byte[] buffer4 = new byte[packet.Length]; packet.Read(buffer4, 0, buffer4.Length); HMACT64 hmact = new HMACT64(ExportedSessionKey); hmact.update(this.m_NegotiateMsg); hmact.update(this.m_ChallengeMsg); hmact.update(buffer4); byte[] buffer5 = hmact.digest(); packet.Position = num10; packet.Write(buffer5, 0, buffer5.Length); } packet.Position = 0L; byte[] buffer6 = new byte[packet.Length]; packet.Read(buffer6, 0, buffer6.Length); return(buffer6); }