smb_crypt.h File Reference

Unix SMB/Netbios implementation. Version 1.9. More...

#include "byteorder.h"
#include "charset.h"
#include "hmacmd5.h"
#include "md4.h"
#include "md5.h"

Include dependency graph for smb_crypt.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	uint8   uint8_t
#define	False   0
#define	True   1

Typedefs
typedef unsigned int	bool

Functions
void	E_P24 (const uchar *p21, const uchar *c8, uchar *p24)
void	E_P16 (uchar *p14, uchar *p16)
int	strupper_w (smb_ucs2_t *s)
void	SMBsesskeygen_lm_sess_key_ntlmssp (const uchar lm_hash[16], const uchar lm_resp[24], uint8 sess_key[16])
void	SMBsesskeygen_ntv1_ntlmssp (const uchar kr[16], const uchar *nt_resp, uint8 sess_key[16])
void	SMBOWFencrypt_ntlmssp (const uchar passwd[16], const uchar *c8, uchar p24[24])
void	SMBencrypt_hash_ntlmssp (const uchar lm_hash[16], const uchar *c8, uchar p24[24])
void	SMBNTencrypt_hash_ntlmssp (const uchar nt_hash[16], uchar *c8, uchar *p24)
bool	E_deshash_ntlmssp (const char *passwd, uint8_t pass_len, uchar p16[16])
void	SamOEMhash (uchar *data, const uchar *key, int val)
void	SMBOWFencrypt_ntv2_ntlmssp (const uchar *kr, const uint8_t *srv_chal, int srv_chal_len, const uint8_t *cli_chal, int cli_chal_len, uchar resp_buf[16])
void	SMBsesskeygen_ntv2_ntlmssp (const uchar kr[16], const uchar *nt_resp, uint8 sess_key[16])
uint8_t *	NTLMv2_generate_client_data_ntlmssp (const char *addr_list, int address_list_len)
void	NTLMv2_generate_response_ntlmssp (const uchar ntlm_v2_hash[16], const char *server_chal, const char *address_list, int address_list_len, uint8_t *nt_response)
void	LMv2_generate_response_ntlmssp (const uchar ntlm_v2_hash[16], const char *server_chal, uint8_t *lm_response)
void	SMBNTLMv2encrypt_hash_ntlmssp (const char *user, const char *domain, uchar ntlm_v2_hash[16], const char *server_chal, const char *address_list, int address_list_len, unsigned char *lm_response, unsigned char *nt_response, unsigned char *user_session_key)

Detailed Description

Unix SMB/Netbios implementation. Version 1.9.

a partial implementation of DES designed for use in the SMB authentication protocol

Definition in file smb_crypt.h.

Macro Definition Documentation

False

#define False   0

Definition at line 32 of file smb_crypt.h.

True

#define True   1

Definition at line 33 of file smb_crypt.h.

uint8

#define uint8   uint8_t

Definition at line 28 of file smb_crypt.h.

Typedef Documentation

bool

typedef unsigned int bool

Definition at line 31 of file smb_crypt.h.

Function Documentation

E_deshash_ntlmssp()

bool E_deshash_ntlmssp	(	const char *	passwd,
		uint8_t	pass_len,
		uchar	p16[16]
	)

Creates the DES forward-only Hash of the users password in DOS ASCII charset

Parameters

passwd	password in 'unix' charset.
p16	return password hashed with DES, caller allocated 16 byte buffer

Returns

False if password was > 14 characters, and therefore may be incorrect, otherwise True

Note

p16 is filled in regardless

Definition at line 437 of file smb_crypt.c.

{
  bool ret = True;
  fstring dospwd;
  ZERO_STRUCT (dospwd);
  char *dpass;
 
  /* Password must be converted to DOS charset - null terminated, uppercase. */
  dpass = g_utf8_strup (passwd, pass_len);
  memcpy (dospwd, dpass, pass_len);
  g_free (dpass);
 
  /* Only the first 14 chars are considered, password need not be null
   * terminated. */
  E_P16 ((unsigned char *) dospwd, p16);
 
  if (strlen (dospwd) > 14)
    {
      ret = False;
    }
 
  ZERO_STRUCT (dospwd);
 
  return ret;
}

References E_P16(), False, True, and ZERO_STRUCT.

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:

Here is the caller graph for this function:

E_P16()

void E_P16	(	uchar *	p14,
		uchar *	p16
	)

Definition at line 302 of file smb_crypt.c.

{
  uchar sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25};
  smbhash (p16, sp8, p14, 1);
  smbhash (p16 + 8, sp8, p14 + 7, 1);
}

References smbhash(), and uchar.

Referenced by E_deshash_ntlmssp(), and nasl_lm_owf_gen().

Here is the call graph for this function:

Here is the caller graph for this function:

E_P24()

void E_P24	(	const uchar *	p21,
		const uchar *	c8,
		uchar *	p24
	)

Definition at line 310 of file smb_crypt.c.

{
  smbhash (p24, c8, p21, 1);
  smbhash (p24 + 8, c8, p21 + 7, 1);
  smbhash (p24 + 16, c8, p21 + 14, 1);
}

References smbhash().

Referenced by nasl_ntlmv1_hash(), and SMBOWFencrypt_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

LMv2_generate_response_ntlmssp()

void LMv2_generate_response_ntlmssp	(	const uchar	ntlm_v2_hash[16],
		const char *	server_chal,
		uint8_t *	lm_response
	)

Definition at line 534 of file smb_crypt.c.

{
  uchar lmv2_response[16];
  uint8_t lmv2_client_data[8];
 
  /* LMv2 */
  /* client-supplied random data */
  generate_random_buffer_ntlmssp (lmv2_client_data, sizeof (lmv2_client_data));
 
  /* Given that data, and the challenge from the server, generate a response */
  SMBOWFencrypt_ntv2_ntlmssp (ntlm_v2_hash, (const uchar *) server_chal, 8,
                              lmv2_client_data, sizeof (lmv2_client_data),
                              lmv2_response);
  memcpy (lm_response, lmv2_response, sizeof (lmv2_response));
 
  /* after the first 16 bytes is the random data we generated above,
  so the server can verify us with it */
  memcpy (lm_response + sizeof (lmv2_response), lmv2_client_data,
          sizeof (lmv2_client_data));
}

References generate_random_buffer_ntlmssp(), SMBOWFencrypt_ntv2_ntlmssp(), and uchar.

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

NTLMv2_generate_client_data_ntlmssp()

uint8_t* NTLMv2_generate_client_data_ntlmssp	(	const char *	addr_list,
		int	address_list_len
	)

Definition at line 476 of file smb_crypt.c.

{
  int i = 0;
  /*length of response
   *header-4, reserved-4, date-8, client chal-8, unknown-4, addr_list-size sent
   *in arguments
   */
  uchar client_chal[8];
  uint8_t *response = g_malloc0 (28 + address_list_len);
  char long_date[8];
  int header = 0x00000101;
  int zeros = 0x00000000;
 
  generate_random_buffer_ntlmssp (client_chal, sizeof (client_chal));
 
  put_long_date_ntlmssp (long_date, time (NULL));
  SIVAL (response, 0, header);
  SIVAL (response, 4, zeros);
  memcpy (response + 4 + 4, long_date, 8);
  memcpy (response + 4 + 4 + sizeof (long_date), client_chal, 8);
  SIVAL (response, 24, zeros);
  for (i = 0; i < address_list_len; i++)
    {
      *(response + 28 + i) = *(addr_list + i);
    }
 
  return response;
}

References generate_random_buffer_ntlmssp(), put_long_date_ntlmssp(), SIVAL, and uchar.

Referenced by NTLMv2_generate_response_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

NTLMv2_generate_response_ntlmssp()

void NTLMv2_generate_response_ntlmssp	(	const uchar	ntlm_v2_hash[16],
		const char *	server_chal,
		const char *	address_list,
		int	address_list_len,
		uint8_t *	nt_response
	)

Definition at line 507 of file smb_crypt.c.

{
  uchar ntlmv2_response[16];
  uint8_t *ntlmv2_client_data;
 
  /* NTLMv2 */
  /* generate some data to pass into the response function - including
     the hostname and domain name of the server */
  ntlmv2_client_data =
    NTLMv2_generate_client_data_ntlmssp (address_list, address_list_len);
 
  /* Given that data, and the challenge from the server, generate a response */
  int client_data_len = 28 + address_list_len;
  SMBOWFencrypt_ntv2_ntlmssp (ntlm_v2_hash, (const uchar *) server_chal, 8,
                              ntlmv2_client_data, client_data_len,
                              ntlmv2_response);
  memcpy (nt_response, ntlmv2_response, sizeof (ntlmv2_response));
  memcpy (nt_response + sizeof (ntlmv2_response), ntlmv2_client_data,
          client_data_len);
 
  g_free (ntlmv2_client_data);
}

References NTLMv2_generate_client_data_ntlmssp(), SMBOWFencrypt_ntv2_ntlmssp(), and uchar.

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

SamOEMhash()

void SamOEMhash	(	uchar *	data,
		const uchar *	key,
		int	val
	)

Definition at line 318 of file smb_crypt.c.

{
  uchar hash[256];
  uchar index_i = 0;
  uchar index_j = 0;
  uchar j = 0;
  int ind;
  int len = 0;
  if (val == 1)
    len = 516;
  if (val == 0)
    len = 16;
  if (val == 3)
    len = 8;
  if (val == 2)
    len = 68;
  if (val == 4)
    len = 32;
 
  if (val >= 8)
    len = val;
 
  for (ind = 0; ind < 256; ind++)
    {
      hash[ind] = (uchar) ind;
    }
 
  for (ind = 0; ind < 256; ind++)
    {
      uchar tc;
 
      j += (hash[ind] + key[ind % 16]);
 
      tc = hash[ind];
      hash[ind] = hash[j];
      hash[j] = tc;
    }
  for (ind = 0; ind < len; ind++)
    {
      uchar tc;
      uchar t;
 
      index_i++;
      index_j += hash[index_i];
 
      tc = hash[index_i];
      hash[index_i] = hash[index_j];
      hash[index_j] = tc;
 
      t = hash[index_i] + hash[index_j];
      data[ind] = data[ind] ^ hash[t];
    }
}

References len, uchar, and val.

Referenced by ntlmssp_genauth_keyexchg().

Here is the caller graph for this function:

SMBencrypt_hash_ntlmssp()

void SMBencrypt_hash_ntlmssp	(	const uchar	lm_hash[16],
		const uchar *	c8,
		uchar	p24[24]
	)

Definition at line 394 of file smb_crypt.c.

{
  uchar p21[21];
 
  memset (p21, '\0', 21);
  memcpy (p21, lm_hash, 16);
  SMBOWFencrypt_ntlmssp (p21, c8, p24);
}

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm().

Here is the call graph for this function:

Here is the caller graph for this function:

SMBNTencrypt_hash_ntlmssp()

void SMBNTencrypt_hash_ntlmssp	(	const uchar	nt_hash[16],
		uchar *	c8,
		uchar *	p24
	)

Definition at line 406 of file smb_crypt.c.

{
  uchar p21[21];
 
  memset (p21, '\0', 21);
  memcpy (p21, nt_hash, 16);
  SMBOWFencrypt_ntlmssp (p21, c8, p24);
}

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:

Here is the caller graph for this function:

SMBNTLMv2encrypt_hash_ntlmssp()

void SMBNTLMv2encrypt_hash_ntlmssp	(	const char *	user,
		const char *	domain,
		uchar	ntlm_v2_hash[16],
		const char *	server_chal,
		const char *	address_list,
		int	address_list_len,
		unsigned char *	lm_response,
		unsigned char *	nt_response,
		unsigned char *	user_session_key
	)

SMBOWFencrypt_ntlmssp()

void SMBOWFencrypt_ntlmssp	(	const uchar	passwd[16],
		const uchar *	c8,
		uchar	p24[24]
	)

Definition at line 384 of file smb_crypt.c.

{
  uchar p21[21];
 
  ZERO_STRUCT (p21);
  memcpy (p21, passwd, 16);
  E_P24 (p21, c8, p24);
}

References E_P24(), uchar, and ZERO_STRUCT.

Referenced by SMBencrypt_hash_ntlmssp(), SMBNTencrypt_hash_ntlmssp(), and SMBsesskeygen_lm_sess_key_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

SMBOWFencrypt_ntv2_ntlmssp()

void SMBOWFencrypt_ntv2_ntlmssp	(	const uchar *	kr,
		const uint8_t *	srv_chal,
		int	srv_chal_len,
		const uint8_t *	cli_chal,
		int	cli_chal_len,
		uchar	resp_buf[16]
	)

Referenced by LMv2_generate_response_ntlmssp(), nasl_ntlmv2_hash(), and NTLMv2_generate_response_ntlmssp().

Here is the caller graph for this function:

SMBsesskeygen_lm_sess_key_ntlmssp()

void SMBsesskeygen_lm_sess_key_ntlmssp	(	const uchar	lm_hash[16],
		const uchar	lm_resp[24],
		uint8	sess_key[16]
	)

Definition at line 416 of file smb_crypt.c.

{
  uchar p24[24];
  uchar partial_lm_hash[16];
 
  memcpy (partial_lm_hash, lm_hash, 8);
  memset (partial_lm_hash + 8, 0xbd, 8);
  SMBOWFencrypt_ntlmssp (partial_lm_hash, lm_resp, p24);
  memcpy (sess_key, p24, 16);
}

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm().

Here is the call graph for this function:

Here is the caller graph for this function:

SMBsesskeygen_ntv1_ntlmssp()

void SMBsesskeygen_ntv1_ntlmssp	(	const uchar	kr[16],
		const uchar *	nt_resp,
		uint8	sess_key[16]
	)

Definition at line 373 of file smb_crypt.c.

{
  /* yes, this session key does not change - yes, this
     is a problem - but it is 128 bits */
  (void) nt_resp;
  mdfour_ntlmssp ((unsigned char *) sess_key, kr, 16);
}

References mdfour_ntlmssp().

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:

Here is the caller graph for this function:

SMBsesskeygen_ntv2_ntlmssp()

void SMBsesskeygen_ntv2_ntlmssp	(	const uchar	kr[16],
		const uchar *	nt_resp,
		uint8	sess_key[16]
	)

Definition at line 463 of file smb_crypt.c.

{
  /* a very nice, 128 bit, variable session key */
 
  HMACMD5Context ctx;
 
  hmac_md5_init_limK_to_64 (kr, 16, &ctx);
  hmac_md5_update (nt_resp, 16, &ctx);
  hmac_md5_final ((unsigned char *) sess_key, &ctx);
}

References hmac_md5_final(), hmac_md5_init_limK_to_64(), and hmac_md5_update().

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:

Here is the caller graph for this function:

strupper_w()

int strupper_w

(

smb_ucs2_t *

s

)

Definition at line 35 of file smb_crypt2.c.

{
  int ret = 0;
  while (*s)
    {
      smb_ucs2_t v = toupper_w (*s);
      if (v != *s)
        {
          *s = v;
          ret = 1;
        }
      s++;
    }
  return ret;
}

References toupper_w().

Referenced by nasl_ntv2_owf_gen().

Here is the call graph for this function:

Here is the caller graph for this function: