
    h              	       x   d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl	m
Z
 ddlmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- ddl.m/Z/ ddl0m1Z1 ddl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z: ddl;m<Z<m=Z=m>Z>m?Z?m@Z@mAZA ddlBmCZCmDZD ddlEmFZF  G d de-e>e@eGe<f                                     ZH G d de/          ZI G d de          ZJdeJjK        fdeJjL        fdeJjM        fgZNeNfdZO G d de/          ZPg dZQd ZR G d d e/          ZS G d! d"eI          ZT G d# d$e/          ZU G d% d&e/          ZV G d' d(eI          ZW G d) d*e/          ZX G d+ d,e/          ZY G d- d.e/          ZZ G d/ d0e/          Z[ G d1 d2e[          Z\ G d3 d4eI          Z] G d5 d6e]          Z^d7 Z_ G d8 d9e          Z` G d: d;e          Zad< Zbd= Zcd> Zdd? Zed@ Zf G dA dBe/          ZgePe9dC<   ege:dC<   dNdDZhdE ZidF ZjdG ZkdH ZldI ZmdJ ZndK Zo G dL dMe8          ZpdS )Oz
NTLM

This is documented in [MS-NLMP]

.. note::
    You will find more complete documentation for this layer over at
    `GSSAPI <https://scapy.readthedocs.io/en/latest/layers/gssapi.html#ntlm>`_
    N)IntEnum)ASN1_Codecs)conf)	ASN1F_OIDASN1F_PRINTABLE_STRINGASN1F_SEQUENCEASN1F_SEQUENCE_OF)ASN1_Packet)bytes_base64)log_runtime)ByteEnumField	ByteFieldConditionalFieldFieldFieldLenField
FlagsFieldLEIntEnumField
LEIntFieldLEShortEnumFieldLEShortFieldLEThreeBytesFieldMultipleTypeFieldPacketFieldPacketListFieldStrFieldStrFieldUtf16StrFixedLenFieldStrLenFieldUtf16UTCTimeField	XStrFieldXStrFixedLenFieldXStrLenField	_StrField)Packet)StringBuffer)GSS_C_FLAGSGSS_S_COMPLETEGSS_S_CONTINUE_NEEDEDGSS_S_DEFECTIVE_CREDENTIALGSS_S_DEFECTIVE_TOKENSSP_GSSAPI_OIDS_GSSAPI_SIGNATURE_OIDS)AnyCallableListOptionalTupleUnion)Hash_MD4Hash_MD5)Hmac_MD5c                   `     e Zd ZdZg dZdZ	 	 	 d fd	Zd Zd Zd	 Z	d
 Z
d Zd Zd Z xZS )_NTLMPayloadFieldzeSpecial field used to dissect NTLM payloads.
    This isn't trivial because the offsets are variable.)fields
fields_mapoffsetlength_fromforce_orderoffset_nameTNBufferOffsetc                     || _         || _        d |D             | _        || _        || _        || _        t          t          |                               |d |D                        d S )Nc                     i | ]
}|j         |S  name.0fields     U/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/ntlm.py
<dictcomp>z._NTLMPayloadField.__init__.<locals>.<dictcomp>w   s    AAA5:uAAA    c                 8    g | ]}|j         	|j        |j         fS N)defaultrD   rE   s     rH   
<listcomp>z._NTLMPayloadField.__init__.<locals>.<listcomp>}   s3       =, U]+,,,rJ   )	r;   r9   r:   r<   r=   r>   superr8   __init__)selfrD   r;   r9   r<   r=   r>   	__class__s          rH   rP   z_NTLMPayloadField.__init__k   s     AA&AAA&&&&&// #  	
 	
 	
 	
 	
rJ   c                    |r|sg S g }|D ]\  }}|| j         vrt          | j         |         t                    s:t          |t                    s% t	          | j         |         |          ||          }|                    ||f           |S rL   )r:   
isinstancer   r$   getattrappend)rQ   pktxfuncresults
field_namevalues          rH   _on_payloadz_NTLMPayloadField._on_payload   s     	! 	I!" 	0 	0J00
+_  O //O C
 ;TBB3NNNNJ.////rJ   c                 0    |                      ||d          S )Ni2hr]   rQ   rW   rX   s      rH   r_   z_NTLMPayloadField.i2h       Q...rJ   c                 0    |                      ||d          S )Nh2ir`   ra   s      rH   rd   z_NTLMPayloadField.h2i   rb   rJ   c                 J    t          |                     ||d                    S )Ni2repr)reprr]   ra   s      rH   rf   z_NTLMPayloadField.i2repr   s"    D$$S!X66777rJ   c                 b    t          | j                  r|                     |          S | j        S rL   )callabler;   )rQ   rW   s     rH   _o_pktz_NTLMPayloadField._o_pkt   s.    DK   	$;;s###{rJ   c           	          t                      }|                    |d                                |          t          |          z
  } j        r|                     fd           |D ]\  }}| j        vr j        |         }|                    | j        z             }	|	t          |          }	nF|	|z  }	|	dz   t          |          z
  }
|
dk    r&|                    |
dz  t          |                     |                    |	                    |t          |          |          t          |          d          |	dz              t          |          S )N   c                 D    j                             | d                   S Nr   )r=   index)rX   rQ   s    rH   <lambda>z,_NTLMPayloadField.addfield.<locals>.<lambda>   s    4#3#9#9!A$#?#? rJ   keyr       )r%   rV   rj   lenr=   sortr:   getfieldvalr>   addfieldbytes)rQ   rW   svalbufr_offr[   r\   rG   r;   pads   `          rH   rw   z_NTLMPayloadField.addfield   sX    nn

1aC  3q66) 	AHH????H@@@!$ 	W 	WJ00OJ/E__Z$2B%BCCF~S %qj3s88+77JJsW}c#hh777JJu~~c5::u==c#hhjjI6TU:VVVVSzzrJ   c                 R     j         d|}}n)                                }||d          |d |         }}r|s|g fS g }d}                                fd j        D             }t           j                  D ]\  }	}
||	         	                     |
j        dz             }n]# t          $ rP t          |          z
  }	 t          |t          fd|D                                 }n# t          $ r Y nw xY wY nw xY wdk     rt          |z   |          }||z            rB|                    |
j        |
                    ||z                      d         f           |||d          z  }|                    d            |d	 |D             fS )
NrJ   r   c                 Z    g | ]'}                     |j        j        z             z
  (S rB   )rv   rD   r>   )rF   rX   o_pktrW   rQ   s     rH   rN   z._NTLMPayloadField.getfield.<locals>.<listcomp>   sA     
 
 
CDCOOAFT%5566>
 
 
rJ   Lenc              3   .   K   | ]}|k    |z
  V  d S rL   rB   )rF   rX   r;   s     rH   	<genexpr>z-_NTLMPayloadField.getfield.<locals>.<genexpr>   s,      ,W,WAAPVJJQZJJJJ,W,WrJ   rl   c                     | d         S rn   rB   rX   s    rH   rp   z,_NTLMPayloadField.getfield.<locals>.<lambda>   s
    1Q4 rJ   rq   c                 "    g | ]}|d d         S )rl   NrB   rF   rX   s     rH   rN   z._NTLMPayloadField.getfield.<locals>.<listcomp>   s     ,,,qQqrrU,,,rJ   )r<   rj   r9   	enumeraterv   rD   AttributeErrorrt   min
ValueErrormaxrV   getfieldru   )rQ   rW   ry   retremainlen_pktrZ   
max_offsetoffsetsirG   lengthr   r;   s   ``          @@rH   r   z_NTLMPayloadField.getfield   s8   #qCC&&s++GGHH+q'{C 	& 	b5L
C  
 
 
 
 
 
HL
 
 
 "$+.. 	 	HAuQZFe);<<!   Vv- ,W,W,W,W,W,W,W)W)WXXFF!   D zzVf_j99Jfv./ 
sF6FVO3K,LMMaP   	vjkk""(((,,G,,,,,s6   B00D
)C76D
7
DD
DD
	D
)NNr?   )__name__
__module____qualname____doc__	__slots__islistrP   r]   r_   rd   rf   rj   rw   r   __classcell__rR   s   @rH   r8   r8   ]   s        < <  I F "
 
 
 
 
 
2  / / // / /8 8 8    6'- '- '- '- '- '- '-rJ   r8   c                   L     e Zd ZdZ	 	 	 	 	 d	 fd	Z fdZ fdZ fdZ xZS )
_NTLMPayloadPacketPayloadrJ   Nr   c           	      r     fdt                    D             } t          t                     j        d|||||d t	           fd j        D                       fd|                                D             }|                                D ]\  }	}
                     |	|
           d S )Nc                 ~    i | ]8t          fd j        D                       "                              9S )c              3   .   K   | ]}|j         k    V  d S rL   rC   )rF   fks     rH   r   z9_NTLMPayloadPacket.__init__.<locals>.<dictcomp>.<genexpr>   s)      ==qqAF{======rJ   )anyfields_descpop)rF   r   r9   rQ   s    @rH   rI   z/_NTLMPayloadPacket.__init__.<locals>.<dictcomp>   s\     
 
 
====D,<=====
vzz!}}
 
 
rJ   )_pktpost_transform	_internal_underlayer_parentc              3   Z   K   | ]%}|j         j        k    d  |j        D             V  &dS )c                     g | ]	}|j         
S rB   rC   )rF   ys     rH   rN   z9_NTLMPayloadPacket.__init__.<locals>.<genexpr>.<listcomp>  s    &&&QV&&&rJ   N)rD   _NTLM_PAYLOAD_FIELD_NAMEr9   )rF   rX   rQ   s     rH   r   z._NTLMPayloadPacket.__init__.<locals>.<genexpr>  sO       
 
v666 '&QX&&&6666
 
rJ   c                 $    i | ]\  }}|v 	||S rB   rB   )rF   r   vlocal_fieldss      rH   rI   z/_NTLMPayloadPacket.__init__.<locals>.<dictcomp>
  s)    QQQDAqqL?P?P1a?P?P?PrJ   rB   )listrO   r   rP   nextr   itemssetfieldval)rQ   r   r   r   r   r   r9   unknownimplicit_fieldsr   r\   r   rR   s   `     `    @rH   rP   z_NTLMPayloadPacket.__init__   s    
 
 
 
 
&\\
 
 

 	1 $''0 	
)#	
 	
 	
 	
 	
  
 
 
 
%
 
 
 
 

 RQQQGMMOOQQQ'--// 	' 	'HAuQ&&&&	' 	'rJ   c                 @   	 t          t          |                                         S # t          $ rg 	 t	          fdt          t          |                               | j                  D                       cY S # t          $ r t                    w xY ww xY w)Nc              3   @   K   | ]}|d          k    |d         V  dS r   rl   NrB   rF   rX   attrs     rH   r   z1_NTLMPayloadPacket.getfieldval.<locals>.<genexpr>  sA         tt||	 aD $||| rJ   )rO   r   rv   r   r   r   StopIteration)rQ   r   rR   s    `rH   rv   z_NTLMPayloadPacket.getfieldval  s    	++T22>>tDDD 
	+ 
	+ 
	+	+    "#5t<<HH5         ! + + +$T***+
	+s!   ', 
BAA?<B?BBc                    	 t          t          |                                         S # t          $ r |                     | j                  j        }	 |         |                             | t          fdt          t          |           	                    | j                  D                                 fcY S # t          t          f$ r t                    w xY ww xY w)Nc              3   @   K   | ]}|d          k    |d         V  dS r   rB   r   s     rH   r   z6_NTLMPayloadPacket.getfield_and_val.<locals>.<genexpr>)  sA         !  !tt||	 aD  ,||| rJ   )rO   r   getfield_and_valr   	get_fieldr   r:   rd   r   __getattr__r   KeyError)rQ   r   	PayFieldsrR   s    ` rH   r   z#_NTLMPayloadPacket.getfield_and_val  s   	'+T22CCDIII 	' 	' 	't'DEEPI'dOdO''    %*+=t%D%D%P%P $ =& &    	 	    "8, ' ' ' &&&'!	's"   ', )C%A'C =C% !C!!C%c                    	 t          t          |                               |          S # t          $ r t          t          |                               | j                  }|                     | j                  j        vrt                    	 |                    t          fdt          t          t          |                               | j                            D                                  n# t          $ r Y nw xY w|                    |g           t          t          |                               | j        |           Y d S w xY w)Nc              3   :   K   | ]\  }}|d          k    |V  dS r   NrB   )rF   r   rX   r   s      rH   r   z1_NTLMPayloadPacket.setfieldval.<locals>.<genexpr>A  sA         Aq
 Q44<<  (<<< rJ   )rO   r   r   r   r   r   r   r:   r   r   r   r   rV   )rQ   r   rz   r   rR   s    `  rH   r   z_NTLMPayloadPacket.setfieldval5  s   	+T22>>tSIII 	 	 	.55AA- G 4>>$*GHHSSS$T***    $-!"4d;;GG $ = % %    
 
 
 
 !   NND#;'''$d++77-w     +	s6   (- A(EA&C=<E=
D
E	D

AEE)rJ   Nr   NN)	r   r   r   r   rP   rv   r   r   r   r   s   @rH   r   r      s        ( ' ' ' ' ' 'B+ + + + + ' ' ' ' '.        rJ   r   c                   "    e Zd ZdZdZdZdZdZdS )
_NTLM_ENUMrl            i   N)r   r   r   LENMAXLENOFFSETCOUNTPAD8rB   rJ   rH   r   r   S  s'        
CFFEDDDrJ   r   r   MaxLenr?   c           	         | j         | j                 D ]q\  }}|                     | j                  j        |         }|                    | |          }|                    | |          }	||         }
d}d }|D ]\  }}t          |t                    r||         }|t          j	        z  r|}n=|t          j
        z  r|}n+|t          j        z  r|}n|t          j        z  r|	}nt          |t          j        z  r	|| dz  z  }|                     ||z             j        }|                     ||z             @|d|
|z            t#          j        d ||          z  |          z   ||
|z   |z   d         z   }||z  }||z  }s|S )z:Util function to build the offset and populate the lengthsr   c                     dddd|          S )NHIQ)r   r   r   rB   )r   s    rH   rp   z"_NTLM_post_build.<locals>.<lambda>j  s    ###..q1 rJ   r   Nz<%s)r9   r   r   r:   i2leni2countrT   dictr   r   r   r   r   r   r   szrv   structpack)rQ   p
pay_offsetr9   configr[   r\   fldr   countr;   r   rfnameftypefvalr   s                    rH   _NTLM_post_buildr   b  s   ![)FG  
EnnT:;;FzR4''D%((
#11" 	 	LE5%&& *j)z~% 	!** !!** !)) !  z& $$!#
U 2336B
U 233;l
lOk%!!B%%-667
R))*+ 
 GAAf

HrJ   c            	       h    e Zd ZdZ eddd           edddd	d
d          gZedd            ZdS )NTLM_HeaderzNTLM Header	Signatures   NTLMSSP r   r   MessageType   NEGOTIATE_MESSAGECHALLENGE_MESSAGEAUTHENTICATE_MESSAGE)rl   r   r   Nc                     |r]t          |          dk    rJt          j        d|dd                   d         }|dk    rt          S |dk    rt          S |dk    rt
          S | S )N
   <Hr   r   rl   r   r   )rt   r   unpackNTLM_NEGOTIATENTLM_CHALLENGENTLM_AUTHENTICATE_V2)clsr   argskargsr   s        rH   dispatch_hookzNTLM_Header.dispatch_hook  sn     	,CIIOO -d1R4j99!<Ka%%!!%%!!++
rJ   rL   )	r   r   r   rD   r   r   r   classmethodr   rB   rJ   rH   r   r     sy        Dl1===#(;@VWW	
 	
K 	 	 	 [	 	 	rJ   r   ) NEGOTIATE_UNICODENEGOTIATE_OEMREQUEST_TARGETr10NEGOTIATE_SIGNNEGOTIATE_SEALNEGOTIATE_DATAGRAMNEGOTIATE_LM_KEYr9NEGOTIATE_NTLMr8JNEGOTIATE_OEM_DOMAIN_SUPPLIED"NEGOTIATE_OEM_WORKSTATION_SUPPLIEDr7NEGOTIATE_ALWAYS_SIGNTARGET_TYPE_DOMAINTARGET_TYPE_SERVERr6"NEGOTIATE_EXTENDED_SESSIONSECURITYNEGOTIATE_IDENTIFYr5REQUEST_NON_NT_SESSION_KEYNEGOTIATE_TARGET_INFOr4NEGOTIATE_VERSIONr3r2r1NEGOTIATE_128NEGOTIATE_KEY_EXCHNEGOTIATE_56c                 b    t          t          | |          d fgt          | |                    S )Nc                     | j         j        S rL   )NegotiateFlagsr   rW   s    rH   rp   z_NTLMStrField.<locals>.<lambda>  s    C.@ rJ   )r   r   r   )rD   rM   s     rH   _NTLMStrFieldr#    sB     dG,,@@	
 	w  rJ   c            
           e Zd Z edd           edd           edd           edd           eddddi          gZd	S )
_NTLM_VersionProductMajorVersionr   ProductMinorVersionProductBuildres_verNTLMRevisionCurrent   v15N)r   r   r   r   r   r   r   r   rB   rJ   rH   r%  r%    sj        	'++	'++^Q'')Q''+TD%=AAKKKrJ   r%  c                   4   e Zd ZdZdZd Ze eddde           e	dd           e	d	d           e
d
d           e	dd           e	dd           e
dd          gd ej        D             z    ede edd           edd          g          gz   Zd ZdS )r   zNTLM Negotiaterl   c                 $    | j         pddk    rdpdS )N(       DomainNameBufferOffsetr"  s    rH   rp   zNTLM_NEGOTIATE.<lambda>      C6<"BJPb rJ   r!  r   DomainNameLenNDomainNameMaxLenr2  WorkstationNameLenWorkstationNameMaxLenWorkstationNameBufferOffsetc                 6    g | ]t          fd           S )c                     | j         dn| j         pt          | j        pd          dk    p| j                            j        d          S )Nr/  rJ   r0  )r2  rt   originalr9   getrD   rW   rX   s    rH   rp   z"NTLM_NEGOTIATE.<listcomp>.<lambda>  sX     5=  7S3s|?Rs;S;S/ :>>!&#.. rJ   r   r   s    @rH   rN   zNTLM_NEGOTIATE.<listcomp>  sL     
 
 
  / / / / 
 
 
rJ   r   
DomainNamerJ   WorkstationNamec                 V    t          | ||                                 ddd          |z   S )N      )r@  rA  r   r   rQ   rW   pays      rH   
post_buildzNTLM_NEGOTIATE.post_build  sA     "$') 	  		
rJ   )r   r   r   rD   r   r   r   r   _negotiateFlagsr   r   r%  r   r8   r#  rH  rB   rJ   rH   r   r     s$       DKQQF J'CAAL$//L+T22J/66L-t44L0$77J4d;;	

 
 #.
 
 
	
> !M,44!M"3S99 

;'	
 V
 
 
 
 
rJ   r   c                   x    e Zd Z edd           edd           eddd           ed	dd
          gZd ZdS )Single_Host_DataSize0   Z4r   
CustomDatarJ   r   r   	MachineIDr0  c                     t           j        S rL   r   padding_layerrQ   payloads     rH   default_payload_classz&Single_Host_Data.default_payload_class1      !!rJ   Nr   r   r   r   r!   r   rV  rB   rJ   rH   rK  rK  )  sr        
62
4,A666+s2666	K" " " " "rJ   rK  c                   6   e Zd ZdZ edddddddd	d
ddddd           edddd           e edddddd          d f eddg ddd          d f e	d e
            e
          d  f edd!d" #          d$ fg edd!d% #                    gZd& ZdS )'AV_PAIRzNTLM AV PairAvIdr   MsvAvEOLMsvAvNbComputerNameMsvAvNbDomainNameMsvAvDnsComputerNameMsvAvDnsDomainNameMsvAvDnsTreeName
MsvAvFlagsMsvAvTimestampMsvAvSingleHostMsvAvTargetNameMsvAvChannelBindings)r   rl   r   r   r            r   	   r   AvLenNValuer   )	length_offmtrl   constrainedMIC integrityzSPN from untrusted source)rl   r   r   c                     | j         dk    S )Nrh  r[  r"  s    rH   rp   zAV_PAIR.<lambda>V      F 2 rJ   iA  rl   rl   r   r   r       cA<Q)epochcustom_scalingrn  c                     | j         dk    S )Nri  rr  r"  s    rH   rp   zAV_PAIR.<lambda>`  rs  rJ   c                     | j         dk    S )Nr   rr  r"  s    rH   rp   zAV_PAIR.<lambda>d  rs  rJ   rJ   c                     | j         S rL   rk  r"  s    rH   rp   zAV_PAIR.<lambda>g  s    sy rJ   )r<   c                     | j         dk    S )Nr   rr  r"  s    rH   rp   zAV_PAIR.<lambda>h  rs  rJ   c                     | j         S rL   r|  r"  s    rH   rp   zAV_PAIR.<lambda>k  s    39 rJ   c                     t           j        S rL   rR  rT  s     rH   rV  zAV_PAIR.default_payload_classo  rW  rJ   )r   r   r   rD   r   r   r   r   r   r   rK  r"   r   r   rV  rB   rJ   rH   rZ  rZ  5  sx       D"-+.,*$()). 	
 	
" 	gtwDAAA #N$1$3$?   32 !L333'*    32	  K)9)9););=MNN22
 !L#;P;PQQQ227@ Wc7L7LMMMC"	
 "	
'6Kp" " " " "rJ   rZ  c                      e Zd ZdZdZd Ze edd           edd           edd           e	dd	d
e
           eddd           eddd           edd           edd           edd          g
d ej        D             z    ede edd           ed e            ge          g          gz   Zd Zd ZdS )r   zNTLM Challenger   c                 $    | j         pddk    rdpdS )N8   rM  )TargetInfoBufferOffsetr"  s    rH   rp   zNTLM_CHALLENGE.<lambda>v  r3  rJ   TargetNameLenNTargetNameMaxLenTargetNameBufferOffsetr!  r   r4  ServerChallenger   r   ReservedTargetInfoLenTargetInfoMaxLenr  c                 6    g | ]t          fd           S )c                 ^    | j         pddk    p| j                            j        d          S )Nr  r/  rJ   )r  r9   r=  rD   r>  s    rH   rp   z"NTLM_CHALLENGE.<listcomp>.<lambda>  1    c8>B"D /:>>!&#.. rJ   r?  r   s    @rH   rN   zNTLM_CHALLENGE.<listcomp>  sL     	
 	
 	
  / / / / 	
 	
 	
rJ   r   
TargetNamerJ   
TargetInfoc                 ~    	 t          fd| j        D                       S # t          t          f$ r t          w xY w)Nc              3   2   K   | ]}|j         k    |V  d S rL   rr  rF   rX   r[  s     rH   r   z'NTLM_CHALLENGE.getAv.<locals>.<genexpr>  s)      EEaafnnnnnnEErJ   )r   r  r   r   
IndexErrorrQ   r[  s    `rH   getAvzNTLM_CHALLENGE.getAv  sS    	EEEE4?EEEEEE~. 	 	 		s   # <c                 V    t          | ||                                 ddd          |z   S )N   r/  )r  r  rE  rF  s      rH   rH  zNTLM_CHALLENGE.post_build  sA     "$"$ 	  		
rJ   )r   r   r   rD   r   r   r   r   r   r   rI  r!   r%  r   r8   r#  r   rZ  r  rH  rB   rJ   rH   r   r   s  sf       DKQQF L$//L+T22J/66J'CAA/a@@@j$q999L$//L+T22J/66	
	
 	
 #.	
 	
 	
	
6 !M,44#OL7799+wGG 

3#	
 N  
 
 
 
 
rJ   r   c                   ,    e Zd Z eddd          gZdS )LM_RESPONSEResponserJ   rD  r   Nr   r   r   r   r   rB   rJ   rH   r  r    *        S444KKKrJ   r  c                   F    e Zd Z eddd           eddd          gZdS )LMv2_RESPONSEr  rJ   rC  r   ChallengeFromClientr   Nr  rB   rJ   rH   r  r    s@        S444.A>>>KKKrJ   r  c                   ,    e Zd Z eddd          gZdS )NTLM_RESPONSEr  rJ   rD  r   Nr  rB   rJ   rH   r  r    r  rJ   r  c                       e Zd Z edd           edd           edd           edd           eddd	g d
d           eddd           edd           ed e	            ge	          gZ
d ZdS )NTLMv2_CLIENT_CHALLENGERespTyperl   
HiRespType	Reserved1r   	Reserved2	TimeStampNrv  rt  ru  )rn  rw  rx  r  s   12345678r   r   	Reserved3AvPairsc                 p    	 t          fd| j        D                       S # t          $ r t          w xY w)Nc              3   2   K   | ]}|j         k    |V  d S rL   rr  r  s     rH   r   z0NTLMv2_CLIENT_CHALLENGE.getAv.<locals>.<genexpr>  s)      BBa16T>>>>>>BBrJ   )r   r  r   r  r  s    `rH   r  zNTLMv2_CLIENT_CHALLENGE.getAv  sN    	BBBB4<BBBBBB 	 	 		s   # 5)r   r   r   r   r   r   r   r   r   rZ  r   r  rB   rJ   rH   r  r    s        	*a  	,""[!$$
;""4/D/D/DUX	
 	
 	
 	.AFFF
;""	GGII;88K    rJ   r  c                   4    e Zd Z eddd          egZd ZdS )NTLMv2_RESPONSE
NTProofStrrJ   rC  r   c           	          d}d}d                     d | j        D                       }d                     ||dt          j        d| j                  | j        d|g          }t          |||z             S )a2  
        Set temp to ConcatenationOf(Responserversion, HiResponserversion,
            Z(6), Time, ClientChallenge, Z(4), ServerName, Z(4))
        Set NTProofStr to HMAC_MD5(ResponseKeyNT,
            ConcatenationOf(CHALLENGE_MESSAGE.ServerChallenge,temp))

        Remember ServerName = AvPairs
           rJ   c              3   4   K   | ]}t          |          V  d S rL   )rx   r   s     rH   r   z4NTLMv2_RESPONSE.computeNTProofStr.<locals>.<genexpr>  s(      ==1eAhh======rJ   s         rv  s       )joinr  r   r   r  r  HMAC_MD5)rQ   ResponseKeyNTr  ResponserversionHiResponserversion
ServerNametemps          rH   computeNTProofStrz!NTLMv2_RESPONSE.computeNTProofStr  s     #$XX=======
xx "D$.11(	
 
 '=>>>rJ   N)r   r   r   r!   r  r   r  rB   rJ   rH   r  r    sB        ,B777K
? ? ? ? ?rJ   r  c                   v   e Zd ZdZdZdZd Ze edd           edd           e	dd           ed	d           ed
d           e	dd           edd           edd           e	dd           edd           edd           e	dd           edd           edd           e	dd           edd           edd           e	dd           e
ddde          gd ej        D             z    e eddd          d             ed!e e ed" e            e          d# fg ed" e            e                     e ed$ e            e          d% fg ed$ e            e                     ed&d           ed'd           ed(d           ed)d          g          gz   Zd* Zd+ ZdS ),NTLM_AUTHENTICATEzNTLM Authenticater   rl   c                 B    | j         pddk    rdp| j         pddk    rdpdS )NX   @   H   r1  r"  s    rH   rp   zNTLM_AUTHENTICATE.<lambda>  s?    

$
*r	1 		D(.B"4<"B rJ   LmChallengeResponseLenNLmChallengeResponseMaxLenLmChallengeResponseBufferOffsetNtChallengeResponseLenNtChallengeResponseMaxLenNtChallengeResponseBufferOffsetr5  r6  r2  UserNameLenUserNameMaxLenUserNameBufferOffsetWorkstationLenWorkstationMaxLenWorkstationBufferOffsetEncryptedRandomSessionKeyLenEncryptedRandomSessionKeyMaxLen%EncryptedRandomSessionKeyBufferOffsetr!  r   r4  c                 6    g | ]t          fd           S )c                 ^    | j         pddk    p| j                            j        d          S )Nr  r  rJ   )r2  r9   r=  rD   r>  s    rH   rp   z%NTLM_AUTHENTICATE.<listcomp>.<lambda>-  r  rJ   r?  r   s    @rH   rN   zNTLM_AUTHENTICATE.<listcomp>)  sL     
 
 
  / / / / 
 
 
rJ   MICrJ   rC  r   c                 R    | j         pddk    p| j                            dd          S )Nr  r  r  rJ   )r2  r9   r=  r"  s    rH   rp   zNTLM_AUTHENTICATE.<lambda>7  s.    c8>B"D .:>>%-- rJ   r   LmChallengeResponsec                     | j         dk    S Nr   NTLM_VERSIONr"  s    rH   rp   zNTLM_AUTHENTICATE.<lambda>G      C,<,A rJ   NtChallengeResponsec                     | j         dk    S r  r  r"  s    rH   rp   zNTLM_AUTHENTICATE.<lambda>T  r  rJ   r@  UserNameWorkstationEncryptedRandomSessionKeyc                 ^    t          | ||                                 ddddddd          |z   S )Nr        $   ,   4   )r  r  r@  r  r  r  rE  rF  s      rH   rH  zNTLM_AUTHENTICATE.post_buildd  sM     +-+-"$ "#%13 	  	
rJ   c                     d| _         t          |t          |          t          |          z   t          |           z             | _         d S )N                   )r  r  rx   )rQ   ExportedSessionKey	negotiate	challenges       rH   compute_miczNTLM_AUTHENTICATE.compute_micw  sC    i 0 053C3C CeDkk Q
 
rJ   )r   r   r   rD   r   r  r   r   r   r   r   rI  r%  r   r   r!   r8   r   r   r  r  r  r  r#  r    rH  r  rB   rJ   rH   r  r    s       DKL F L1488L4d;;J8$??L1488L4d;;J8$??L$//L+T22J/66L--L)400J-t44L)400L,d33J0$77L7>>L:DAAJ>EEJ'CAA7	
<
 
 #.
 
 
=&	
R !!%R888. .  %% !,$9$1MOO$1!" !"
 !B A	 $$9;;==+VV  &% !,$9$3O$5$5$3!" !"
 !B A	 $1==??M   "M,44!M*c22!M-55I93??A!% %/
OV	
 t
 
 
&
 
 
 
 
rJ   r  c                       e Zd ZdZdS )r   r   N)r   r   r   r  rB   rJ   rH   r   r   ~  s        LLLrJ   r   c           	          t          | t                    sJ ddlm}m}  |             |dt          t          |                     z             z  S )zCCreate an HTTP NTLM negotiate packet from an NTLM_NEGOTIATE messager   )HTTPHTTPRequests   NTLM )Authorization)rT   r   scapy.layers.httpr  r  r   rx   )ntlm_negotiater  r  s      rH   HTTP_ntlm_negotiater    sn    nn5555533333333466KKeN.C.C!D!DD    rJ   c                       e Zd Zej        Z e e e edd           edd          d          d                    Z	dS )NEGOEX_EXCHANGE_NTLM_ITEMoid token1   )explicit_tag   N)
r   r   r   r   BER
ASN1_codecr   r   r   	ASN1_rootrB   rJ   rH   r  r    su        JN	%$$&&w33!  
 	
 	
 	
	 	IIIrJ   r  c            	       b    e Zd ZdZej        Z e e edg e	          d                    Z
dS )NEGOEX_EXCHANGE_NTLMz[
    GSSAPI NegoEX Exchange metadata blob
    This was reversed and may be meaningless
    r      )implicit_tagN)r   r   r   r   r   r  r  r   r	   r  r  rB   rJ   rH   r  r    s\         
 Jgr+DEETX	
 	
 	
 IIIrJ   r  c                 H    t          |                               |          S )Nrq   )r6   digest)rr   datas     rH   r  r    s!    ##D)))rJ   c                 j    t                                          |                     d                    S )z/
    MD4 over a string encoded as utf-16le
    utf-16le)r4   r  encoder   s    rH   MD4ler    s(     ::QXXj11222rJ   c                     ddl m}m} 	 ddlm} n# t          $ r |}Y nw xY w|                    |           } ||d          }|                                }|S )zAlleged RC4r   Cipher
algorithmsr  Nmode)&cryptography.hazmat.primitives.ciphersr  r  $cryptography.hazmat.decrepit.ciphersImportErrorARC4	encryptor)rr   r  r  decrepit_algorithms	algorithmcipherr  s          rH   RC4Initr    s    IIIIIIII)	
 	
 	
 	
 	
 	
 	
  ) ) )() $((--IVID)))F  ""I      c                 ,    |                      |          S )zThe RC4 Encryption Algorithm)update)handler  s     rH   RC4r    s    ==rJ   c                    ddl m}m} 	 ddlm} n# t          $ r |}Y nw xY w|                    |           } ||d          }|                                }|                    |          |                                z   S )zXIndicates the encryption of data item D with the key K using the
    RC4 algorithm.
    r   r
  r  Nr  )	r  r  r  r  r  r  r  r  finalize)rr   r  r  r  r  r  r  r  s           rH   RC4Kr     s     JIIIIIII)	
 	
 	
 	
 	
 	
 	
  ) ) )() $((--IVID)))F  ""ID!!I$6$6$8$888r  c                   ^    e Zd Z edd           eddd           edd          gZd	 Zd
S )NTLMSSP_MESSAGE_SIGNATUREVersionrl   ChecksumrJ   r   r   SeqNumr   c                     t           j        S rL   rR  rT  s     rH   rV  z/NTLMSSP_MESSAGE_SIGNATURE.default_payload_class  rW  rJ   NrX  rB   rJ   rH   r"  r"    s_         	
9j))*c!444
8Z((K" " " " "rJ   r"  1.3.6.1.4.1.311.2.2.10c                     |t          |           }t          ||                                |z                       d                    S )a  
    Computes the ResponseKeyNT (per [MS-NLMP] sect 3.3.2)

    :param Passwd: the plain password
    :param User: the username
    :param UserDom: the domain name
    :param HashNt: (out of spec) if you have the HashNt, use this and set
                   Passwd to None
    Nr  )r  r  upperr  )PasswdUserUserDomHashNts       rH   NTOWFv2r.    s?     ~vFTZZ\\G3;;JGGHHHrJ   c                 "    t          | |          S rL   )r  )r  r  s     rH   NTLMv2_ComputeSessionBaseKeyr0    s    M:...rJ   c                     t          |t          j        d|          |z             d d         }| rt          | |          }t	          d||          S )Nz<ir   rl   )r#  r$  r%  )r  r   r   r  r"  )Handle
SigningKeyr%  Messagechksums        rH   MACr6    sb    j&+dF";";g"EFFrrJF %VV$$$   rJ   c                 ,    |t          | |||          z   S rL   )r6  )r2  r3  r%  r4  s       rH   SIGNr8  "  s    SVW====rJ   c                 N    t          | |          }t          | |||          }||fS )z'
    SEAL() according to [MS-NLMP]
    r  r6  )r2  r3  r%  r4  sealed_message	signatures         rH   SEALr=  *  s1    
 ))NFJ88I9$$rJ   c                 N    t          | |          }t          | |||          }||fS )z)
    UNSEAL() according to [MS-NLMP]
    r:  )r2  r3  r%  r4  unsealed_messager<  s         rH   UNSEALr@  4  s2    
 67++FJ88IY&&rJ   c                     | j         rc|dk    r$t                                          |dz             S |dk    r$t                                          |dz             S t          d          d S )NClients;   session key to client-to-server signing key magic constant Servers;   session key to server-to-client signing key magic constant Unknown Mode)r  r5   r  r   )NegFlgr  Modes      rH   SIGNKEYrG  A  s    0 8::$$"ST   X::$$"ST  
 ^,,,trJ   c                 v   | j         r| j        r|}n| j        r|d d         }n
|d d         }|dk    r$t                                          |dz             S |dk    r$t                                          |dz             S t          d          | j        r!| j        r|d d         d	z   S |d d
         dz   S |S )Nri  rg  rB  s;   session key to client-to-server sealing key magic constant rC  s;   session key to server-to-client sealing key magic constant rD  rh     r   s   8)r  r  r  r5   r  r   r  )rE  r  rF  SealKeys       rH   SEALKEYrK  V  s   0 " 	-(GG  	-(!,GG(!,G8::$$ST   X::$$ST  
 ^,,,		  " 	<%bqb)G33%bqb)O;;!!rJ   c                   4    e Zd ZdZdZdZ G d dej                  Z G d dej                  Zdddd	i d
ddddddf fd	Z	defdZ
d dZd Zd dZd Zd Z fdZ fdZ	 d!dedee         fdZd"defdZdefdZd"defdZd#defdZd Zd Z xZS )$NTLMSSPa(  
    The NTLM SSP

    Common arguments:

        :param auth_level: One of DCE_C_AUTHN_LEVEL
        :param USE_MIC: whether to use a MIC or not (default: True)
        :param NTLM_VALUES: a dictionary used to override the following values

        In case of a client::

            - NegotiateFlags
            - ProductMajorVersion
            - ProductMinorVersion
            - ProductBuild

        In case of a server::

            - NetbiosDomainName
            - NetbiosComputerName
            - DnsComputerName
            - DnsDomainName (defaults to DOMAIN)
            - DnsTreeName (defaults to DOMAIN)
            - Flags
            - Timestamp

    Client-only arguments:

        :param UPN: the UPN to use for NTLM auth. If no domain is specified, will
                    use the one provided by the server (domain in a domain, local
                    if without domain)
        :param HASHNT: the password to use for NTLM auth
        :param PASSWORD: the password to use for NTLM auth

    Server-only arguments:

        :param DOMAIN_NB_NAME: the domain Netbios name (default: DOMAIN)
        :param DOMAIN_FQDN: the domain FQDN (default: <domain_nb_name>.local)
        :param COMPUTER_NB_NAME: the server Netbios name (default: SRV)
        :param COMPUTER_FQDN: the server FQDN
                              (default: <computer_nb_name>.<domain_fqdn>)
        :param IDENTITIES: a dict {"username": <HashNT>}
                        Setting this value enables signature computation and
                        authenticates inbound users.
    r'  r   c                       e Zd ZdZdZdZdZdS )NTLMSSP.STATErl   r   r   r   N)r   r   r   INITCLI_SENT_NEGOCLI_SENT_AUTHSRV_SENT_CHALrB   rJ   rH   STATErO    s"        rJ   rT  c                   4     e Zd Zg dZd fd	Zd Zd Z xZS )NTLMSSP.CONTEXT)
SessionKeyr  
IsAcceptorSendSignKeySendSealKeyRecvSignKeyRecvSealKeySendSealHandleRecvSealHandle
SendSeqNum
RecvSeqNumneg_tok	chall_tokServerHostnameNc                 T   t           j        j        | _        d | _        d | _        d | _        d | _        d | _        d | _	        d | _
        d | _        d| _        d| _        d | _        d | _        d | _        || _        t%          t           j        |                               |           d S )Nr   	req_flags)rM  rT  rP  staterW  r  rY  rZ  r]  r[  r\  r^  r_  r`  ra  rb  rc  rX  rO   CONTEXTrP   )rQ   rX  rf  rR   s      rH   rP   zNTLMSSP.CONTEXT.__init__  s     +DJ"DO&*D##D#D"&D#D#D"&DDODODL!DN"&D(DO'/4((11I1FFFFFrJ   c                 H    |                      | j        | j                   d S )Nre  )rP   rX  flagsrQ   s    rH   
clifailurezNTLMSSP.CONTEXT.clifailure  s"    MM$/TZM@@@@@rJ   c                     dS )NrM  rB   rk  s    rH   __repr__zNTLMSSP.CONTEXT.__repr__  s    9rJ   rL   )r   r   r   r   rP   rl  rn  r   r   s   @rH   rh  rV    su        
 
 
	"	G 	G 	G 	G 	G 	G$	A 	A 	A	 	 	 	 	 	 	rJ   rh  NTDOMAINSRVFc                    || _         ||t          |          }|| _        || _        || _        || _        |p| j                                        dz   | _        || _        |	p#| j                                        dz   | j        z   | _	        |
| _
        || _        || _         t          t          |           j        di | d S )Nz.local.rB   )UPNr  HASHNTUSE_MICNTLM_VALUESDOMAIN_NB_NAMElowerDOMAIN_FQDNCOMPUTER_NB_NAMECOMPUTER_FQDN
IDENTITIESDO_NOT_CHECK_LOGINSERVER_CHALLENGErO   rM  rP   )rQ   rs  rt  PASSWORDru  rv  rw  ry  rz  r{  r|  r}  r~  kwargsrR   s                 rH   rP   zNTLMSSP.__init__  s      >h28__F&,&R4+>+D+D+F+F+Q 0* 
!''))C/$2BB 	 %"4 0%gt%///////rJ   Contextc                     dS )Nr   rB   rQ   r  s     rH   
LegsAmountzNTLMSSP.LegsAmount  s    qrJ   r   c                     d                     d |D                       }t          |j        |j        |j        |          }|xj        dz  c_        |S )z&
        [MS-NLMP] sect 3.4.8
        rJ   c              3   2   K   | ]}|j         	|j        V  d S rL   signr  r   s     rH   r   z'NTLMSSP.GSS_GetMICEx.<locals>.<genexpr>  +      99Q!&9!&999999rJ   rl   )r  r6  r]  rY  r_  )rQ   r  msgsqop_reqToSignsigs         rH   GSS_GetMICExzNTLMSSP.GSS_GetMICEx  sc    
 99$99999"	
 
 	a
rJ   c                     |j         |_        d                    d |D                       }t          |j        |j        |j        |          }|j        |j        k    rt          d          dS )z&
        [MS-NLMP] sect 3.4.9
        rJ   c              3   2   K   | ]}|j         	|j        V  d S rL   r  r   s     rH   r   z*NTLMSSP.GSS_VerifyMICEx.<locals>.<genexpr>  r  rJ   zERROR: Checksums don't matchN)r%  r`  r  r6  r^  r[  r$  r   )rQ   r  r  r<  r  r  s         rH   GSS_VerifyMICExzNTLMSSP.GSS_VerifyMICEx  s|     '-99$99999"	
 
 <9---;<<< .-rJ   c                     t          j        |          }|D ](}|j        rt          |j        |j                  |_        )|                     |||          }||fS )z&
        [MS-NLMP] sect 3.4.6
        )r  )copydeepcopyconf_req_flagr  r]  r  r  )rQ   r  r  r  msgs_cpymsgr  s          rH   
GSS_WrapExzNTLMSSP.GSS_WrapEx  sq     =&& 	A 	AC  Aw5sx@@7CC
 	
rJ   c                     |D ](}|j         rt          |j        |j                  |_        )|                     |||           |S )z&
        [MS-NLMP] sect 3.4.7
        )r  r  r^  r  r  )rQ   r  r  r<  r  s        rH   GSS_UnwrapExzNTLMSSP.GSS_UnwrapEx+  sU    
  	A 	AC  Aw5sx@@WdI666rJ   c                 .    | j         sdS |r|j        sdS dS )NFT)ru  rW  r  s     rH   canMechListMICzNTLMSSP.canMechListMIC7  s/    | 	 5 	g0 	5trJ   c                     |j         }t          |j                  |_         	 t          t          |                               ||          ||_         S # ||_         w xY wrL   )r]  r  rZ  rO   rM  getMechListMIC)rQ   r  inputOriginalHandlerR   s       rH   r  zNTLMSSP.getMechListMICB  sa    
 !/!()<!=!=	4$''66wFF%3G""^G"3333s   (A 	Ac                     |j         }t          |j                  |_         	 t          t          |                               |||          ||_         S # ||_         w xY wrL   )r^  r  r\  rO   rM  verifyMechListMIC)rQ   r  otherMICr  r  rR   s        rH   r  zNTLMSSP.verifyMechListMICN  sc    
 !/!()<!=!=	4$''99'8USS%3G""^G"3333s   )A 	Arf  c           	      <   ||                      d|          }|j        | j        j        k    rt	          d                    g d|j        t          j        t          j	        z  z  rdgng z   |j        t          j        z  rdgng z   |j        t          j	        z  rdgng z             dd	d
          }| j
        r*dD ]'}|| j
        v rt          ||| j
        |                    (||_        d |_        | j        j        |_        ||t          fS |j        | j        j        k    r-|}| j        | j        t%          d          |r	t&          |vrt)          j        d           |d t,          fS t/          |j        dd	d
          }t3                      |_        d	dlm} 	  || j                  \  |_        }n# t$          $ r | j        d c|_        }Y nw xY w|c	 |                    d          j        |_         nI# tB          $ r5 t)          j"        d           | j#        $                                |_         Y nw xY w||_         	 |                    d          j        x|_%        |_&        n# tB          $ r
 d|_%        Y nw xY wtO          tQ          j)        d                    x}	|_*        	 |                    d          j        |	_+        n;# tB          $ r. tY          t[          j-                    dz   dz            |	_+        Y nw xY w|j.        d d         | j/        rta          dd          gng z   ta          dtc          tQ          j)        d                              ta          dd           ta          d!d"|j%        z             ta          d#$          gz   |	_2        | j
        r*dD ]'}|| j
        v rt          ||| j
        |                    (tg          d |j        |j         | j        %          }
|	4                    |
|j5                  |	_6        to          |
|	j6                  }|}|j        j8        r*tQ          j)        d&          }ts          ||          |_:        n|}| j/        r|;                    ||j        |           ||_<        |j<        |_        t{          |j        |d'          |_>        t          |j        |d'          |_@        t          |j@                  |_B        t{          |j        |d(          |_C        t          |j        |d(          |_D        t          |jD                  |_E        | j        jF        |_        ||t          fS |j        | j        jF        k    r|rt          }nt          }|d |fS t%          d)t          |j                  z            )*NFre  +)
r   r  r  r  r  r  r  r  r  r  r  r  r  r   r   iaJ  )r!  r&  r'  r(  zNMust provide a 'UPN' and a 'HASHNT' or 'PASSWORD' when running in standalone !z2NTLMSSP: Unexpected token. Expected NTLM Challenge)
_parse_upnr   z1No realm specified in UPN, nor provided by serverrl   WINr   )r  ri      !l
 ru  rb  rp  r[  rl  rd  r0  )rP  rf  r  re  zhost/r\  rr  r-  rC  rB  rC  NTLMSSP: unexpected state %s)Jrh  rg  rT  rP  r   r  rj  r&   GSS_C_INTEG_FLAGGSS_C_CONF_FLAGrv  setattrra  rW  rQ  r(   rs  rt  r   r   r   debugr*   r   r!  r  r  scapy.layers.kerberosr  r  r  rl  r@  r  warningrw  r  r  rc  r  osurandomr  r  inttimer  ru  rZ  rK  r  r.  r  r  r  r0  r  r   r  r  r  rG  rY  rK  rZ  r  r]  r[  r\  r^  rR  r'   r)   rg   )rQ   r  rz   rf  tokrr   rb  r  realmcrr  SessionBaseKeyKeyExchangeKeyr  statuss                  rH   GSS_Init_sec_contextzNTLMSSP.GSS_Init_sec_contextZ  s    ?ll5Il>>G=DJO++ !"xx    #=&7+:UUW 0 
  %0 #=;+GG ,   3> #=;+FF ,   A!#  # H %'$%"O( ( (CR  	A A AC d...S$*:3*?@@@!GO!%G J4GMC!666]dj666Ix4;#6 .    <i ? ?!"VWWW&;;;&(7$&$%"	  C '4ooC#8888885&0j&:&:#ee 5 5 5&*h#eee5}B%.__V%<%<%BCNN! B B B'K   &*%8%?%?%A%ACNNN	B "'(;D??< <'"8"8  ( ( ("'(+:$&JqMM, , , B(F(v66< F F F"DIKK+$=#DEEF $SbS)
 |\III   ..BHHH   !7|LLL!2'CO:STTT,,, J&  	A A AC d...S$*:3*?@@@#{	  M 00) BM
 :-WWN+N': 4%'Z^^"04"&1 1--
 &4"| P 2GOYOOO);G&!(!;G")"$6# #G #*"$6# #G &-W-@%A%AG"")"$6# #G #*"$6# #G &-W-@%A%AG" J4GMC//]dj666 (3'D&((;d7=>Q>QQRRRsH   F5 5GGG7 7<H65H6&I( (I<;I<)K	 	5L Lc                     |                      dd          }|j         j        j        k    r|}|r	t          |vrt          j        d           |d t          fS t          j                    dz   dz  }t           j
        pt          j        d          d                    g d	|j        j        rd
gng z   |j        j        rdgng z             ddddt#          d j                  t#          d j                  t#          d j                  t#          d j                  t#          d j                  t#          d|          t#          d          gfg          } j        rOdD ]'}| j        v rt/          || j        |                    (d |j        D              fddD             |_        ||_         j        j        |_        ||t6          fS |j         j        j        k    r|}|r	t8          |vrt          j        d           |d t          fS  j        r
|d t<          fS                      ||          }|rE|}	|j        j         r"|j!        sd}
n|j"        }
tG          |	|
          }n|	}||_$        |j$        |_%        |j%        r
tM          |j        |d          |_'        tQ          |j        |d          |_)        tU          |j)                  |_+        tM          |j        |d          |_,        tQ          |j        |d          |_-        tU          |j-                  |_.         /                    ||          rV|j        j        r|xj0        tb          j2        z  c_0        |j        j        r|xj0        tb          j3        z  c_0        |d t<          fS d |_%         j        j        |_        |d th          fS tk          d tm          |j                  z            )!NTr   )rX  rf  z2NTLMSSP: Unexpected token. Expected NTLM Negotiater  ru  r   r  )r   r  r  r  r  r  r  r  r  r  r  r  r  r   )r  r  r  rl   r  r   r   r   rg  ri  rr  )r  r!  r&  r'  r   )r  r!  r&  r'  r  c                 (    i | ]}|j         |j        S rB   r  r   s     rH   rI   z2NTLMSSP.GSS_Accept_sec_context.<locals>.<dictcomp>j  s    CCCq1617CCCrJ   c           
          g | ]]\  }}|j         v s|v rKj                             |d           -t          |j                             ||                             ^S )TNr  )rv  r=  rZ  )rF   r   rX   avpairsrQ   s      rH   rN   z2NTLMSSP.GSS_Accept_sec_context.<locals>.<listcomp>k  s     " " "A d...ALL(,,Q55A $*:*>*>q'!**M*MNNN BAArJ   ))r   NetbiosDomainName)rl   NetbiosComputerName)r   DnsDomainName)r   DnsComputerName)rg  DnsTreeName)rh  Flags)ri  	Timestampr   z8NTLMSSP: Unexpected token. Expected NTLM Authenticate v2r  rC  rB  r  )7rh  rg  rT  rP  r   r   r  r*   r  r   r~  r  r  r  r!  r  r  rZ  rz  rw  r{  ry  rv  r  r  rb  rS  r(   r   r}  r'   _getSessionBaseKeyr  r  r  r   r  rW  rG  rY  rK  rZ  r  r]  r[  r\  r^  _checkLoginrj  r&   r  r  r)   r   rg   )rQ   r  rz   nego_tokcurrentTimer  rr   auth_tokr  r  r  r  r  s   `           @rH   GSS_Accept_sec_contextzNTLMSSP.GSS_Accept_sec_context  s   ?lldal@@G=DJO++H <~X==!"VWWW&;;;9;;4;K  $ 5 FA"xx   $2A )**!( $2A )**+   2 %'$%&$ $$2GHHH#$2EFFF#$2DEEE#$2BCCC#$2BCCC#+>>>#OOO;3 3 3Ch   A AC d...S$*:3*?@@@CCCNCCC" " " " "	#" " " !$G J4GMC!666]dj666H <38CC!N   &;;;& 5n44!44WhGGN @!/*= 8#@ W 5A114<4V1)-&(A* *&& *8&-?*%,%?"! 9&-+-?' '# '.+-?' '# *11D)E)E&&-+-?' '# '.+-?' '# *11D)E)E&##GX66 9.= F)EE.= E)DD"D.88!%G JOGMD"<<<;d7=>Q>QQRRRrJ   c                     dS )z
        Returns the Maximum Signature length.

        This will be used in auth_len in DceRpc5, and is necessary for
        PFC_SUPPORT_HEADER_SIGN to work properly.
        rC  rB   r  s     rH   MaximumSignatureLengthzNTLMSSP.MaximumSignatureLength  s	     rrJ   c                    ||                      d          }d|_        |j        | j        j        k    rI|r	t
          |vrt          j        d           d t          fS ||_	        | j        j
        |_        |t          fS |j        | j        j
        k    rI|r	t          |vrt          j        d           d t          fS ||_        | j        j        |_        |t          fS |j        | j        j        k    rv|r	t          |vrt          j        d           d t          fS |                     ||          \  }}}|t"          k    rt          j        d           | j        j        |_        ||fS t'          dt)          |j                  z            )NTz NTLMSSP: Expected NTLM Negotiatez NTLMSSP: Expected NTLM Challengez#NTLMSSP: Expected NTLM AuthenticatezNTLMSSP: auth failed.r  )rh  passiverg  rT  rP  r   r   r  r*   ra  rQ  r(   r   rb  rS  r   r  r'   infor   rg   )rQ   r  rz   _r  s        rH   GSS_PassivezNTLMSSP.GSS_Passive  s   ?ll4((G"GO
 =DJO++ 3.33#$FGGG222!GO J4GM111]dj666 3.33#$FGGG222 #G J4GM111]dj666 3.c99#$IJJJ222!%!<!<Wc!J!JGQ'' !8999 JOGMF?";d7=>Q>QQRRRrJ   c                     |j         |urd S |j        |j        c|_        |_        |j        |j        c|_        |_        |j        |j        c|_        |_        |j        |j        c|_        |_        |j          |_         d S rL   )	rX  r[  rY  r\  rZ  r^  r]  r`  r_  )rQ   r  rX  s      rH   GSS_Passive_set_Directionz!NTLMSSP.GSS_Passive_set_Direction  s    Z//F  	1W0
  	1W0
 "" 	7 6 291CWEW.G.!(!33rJ   c                     |j         r|j        }nd}|j        r|j        }nd}| j        rA|| j        v r8t          d||| j        |                   }t          ||j        j                  S dS )zV
        Function that returns the SessionBaseKey from the ntlm Authenticate.
        Nr  r  )	r  r  r5  r@  r|  r.  r0  r  r  )rQ   r  r  usernamedomainr  s         rH   r  zNTLMSSP._getSessionBaseKey  s      	(HHH! 	(FFF? 	x4?::#htx/H  M 0x;F   trJ   c                    |j         r|j        }nd}|j        r|j        }nd}|| j        v rUt          d||| j        |                   }|j                            ||j        j	                  }||j        j
        k    rdS dS )zw
        Function that checks the validity of an authentication.

        Overwrite and return True to bypass.
        Nr  r  TF)r  r  r5  r@  r|  r.  r  r  rb  r  r  )rQ   r  r  r  r  r  r  s          rH   r  zNTLMSSP._checkLogin  s      	(HHH! 	(FFFt&&#htx/H  M "5GG!1 J X9DDDturJ   )r   )NNrL   )F)r   r   r   r   r  	auth_typer+   rT  rh  rP   r  r  r  r  r  r  r  r  r1   r&   r  r  r  r  r  r  r  r   r   s   @rH   rM  rM  v  sg       , ,\ #CI    	   ( ( ( ( (#+ ( ( (X  0 0 0 0 0 0B'       = = = 
 
 
 
 
 
 
	 	 	
4 
4 
4 
4 
4
4 
4 
4 
4 
4 NRCS CSCS5=k5JCS CS CS CSJYS YSg YS YS YS YSvg     S  S7  S  S  S  SD4 4 4 4 4 4&  *      rJ   rM  rL   )qr   r  r  r  r   enumr   scapy.asn1.asn1r   scapy.asn1.mibr   scapy.asn1fieldsr   r   r   r	   scapy.asn1packetr
   scapy.compatr   scapy.errorr   scapy.fieldsr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   scapy.packetr$   scapy.sessionsr%   scapy.layers.gssapir&   r'   r(   r)   r*   r+   r,   r-   typingr.   r/   r0   r1   r2   r3   scapy.layers.tls.crypto.hashr4   r5   scapy.layers.tls.crypto.h_macr6   strr8   r   r   r   r   r   _NTLM_CONFIGr   r   rI  r#  r%  r   rK  rZ  r   r  r  r  r  r  r  r   r  r  r  r  r  r  r  r   r"  r.  r0  r6  r8  r=  r@  rG  rK  rM  rB   rJ   rH   <module>r     s      				        ' ' ' ' ' '                  ) ( ( ( ( ( % % % % % % # # # # # #                                                 2        ' ' ' ' ' '	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	                < ; ; ; ; ; ; ; 2 2 2 2 2 2J- J- J- J- J-	$uS#X"78 J- J- J-Zf f f f f f f fR        JNz !Z&' :F ! ! ! !X    &   2! ! !H	 	 	    F   <
 <
 <
 <
 <
' <
 <
 <
D	" 	" 	" 	" 	"v 	" 	" 	";" ;" ;" ;" ;"f ;" ;" ;"|>
 >
 >
 >
 >
' >
 >
 >
H    &       F       F       f   *? ? ? ? ?- ? ? ?Dz
 z
 z
 z
 z
* z
 z
 z
z    ,     "           ;   "* * *3 3 3  $  
9 9 9.	" 	" 	" 	" 	" 	" 	" 	" *5% &3L / 0I I I I/ / /  > > >% % %' ' '  *" " "@p
 p
 p
 p
 p
c p
 p
 p
 p
 p
rJ   