/* [<][>][^][v][top][bottom][index][help] */
DEFINITIONS
This source file includes following definitions.
- SMBencrypt
- E_md4hash
- E_deshash
- ntv2_owf_gen
- SMBOWFencrypt
- SMBNTencrypt
- SMBOWFencrypt_ntv2
- SMBsesskeygen_ntv2
- SMBsesskeygen_ntv1
- SMBsesskeygen_lm_sess_key
- NTLMv2_generate_names_blob
- NTLMv2_generate_client_data
- NTLMv2_generate_response
- LMv2_generate_response
- SMBNTLMv2encrypt_hash
- SMBNTLMv2encrypt
- encode_pw_buffer
- decode_pw_buffer
- set_pw_in_buffer
- extract_pw_from_buffer
1 /*
2 Unix SMB/CIFS implementation.
3 SMB parameters and setup
4 Copyright (C) Andrew Tridgell 1992-1998
5 Modified by Jeremy Allison 1995.
6 Copyright (C) Jeremy Allison 1995-2000.
7 Copyright (C) Luke Kennethc Casson Leighton 1996-2000.
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2002-2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "system/time.h"
26 #include "auth/ntlmssp/ntlmssp.h"
27 #include "auth/ntlmssp/msrpc_parse.h"
28 #include "../lib/crypto/crypto.h"
29 #include "libcli/auth/libcli_auth.h"
30
31 /*
32 This implements the X/Open SMB password encryption
33 It takes a password ('unix' string), a 8 byte "crypt key"
34 and puts 24 bytes of encrypted password into p24
35
36 Returns false if password must have been truncated to create LM hash
37 */
38 bool SMBencrypt(const char *passwd, const uint8_t *c8, uint8_t p24[24])
/* [<][>][^][v][top][bottom][index][help] */
39 {
40 bool ret;
41 uint8_t p21[21];
42
43 memset(p21,'\0',21);
44 ret = E_deshash(passwd, p21);
45
46 SMBOWFencrypt(p21, c8, p24);
47
48 #ifdef DEBUG_PASSWORD
49 DEBUG(100,("SMBencrypt: lm#, challenge, response\n"));
50 dump_data(100, p21, 16);
51 dump_data(100, c8, 8);
52 dump_data(100, p24, 24);
53 #endif
54
55 return ret;
56 }
57
58 /**
59 * Creates the MD4 Hash of the users password in NT UNICODE.
60 * @param passwd password in 'unix' charset.
61 * @param p16 return password hashed with md4, caller allocated 16 byte buffer
62 */
63
64 bool E_md4hash(const char *passwd, uint8_t p16[16])
/* [<][>][^][v][top][bottom][index][help] */
65 {
66 size_t len;
67 smb_ucs2_t *wpwd;
68 bool ret;
69
70 ret = push_ucs2_talloc(NULL, &wpwd, passwd, &len);
71 if (!ret || len < 2) {
72 /* We don't want to return fixed data, as most callers
73 * don't check */
74 mdfour(p16, (const uint8_t *)passwd, strlen(passwd));
75 return false;
76 }
77
78 len -= 2;
79 mdfour(p16, (const uint8_t *)wpwd, len);
80
81 talloc_free(wpwd);
82 return true;
83 }
84
85 /**
86 * Creates the DES forward-only Hash of the users password in DOS ASCII charset
87 * @param passwd password in 'unix' charset.
88 * @param p16 return password hashed with DES, caller allocated 16 byte buffer
89 * @return false if password was > 14 characters, and therefore may be incorrect, otherwise true
90 * @note p16 is filled in regardless
91 */
92
93 bool E_deshash(const char *passwd, uint8_t p16[16])
/* [<][>][^][v][top][bottom][index][help] */
94 {
95 bool ret = true;
96 char dospwd[256];
97 ZERO_STRUCT(dospwd);
98
99 /* Password must be converted to DOS charset - null terminated, uppercase. */
100 push_string(dospwd, passwd, sizeof(dospwd), STR_ASCII|STR_UPPER|STR_TERMINATE);
101
102 /* Only the first 14 chars are considered, password need not be null terminated. */
103 E_P16((const uint8_t *)dospwd, p16);
104
105 if (strlen(dospwd) > 14) {
106 ret = false;
107 }
108
109 ZERO_STRUCT(dospwd);
110
111 return ret;
112 }
113
114 /* Does both the NTLMv2 owfs of a user's password */
115 bool ntv2_owf_gen(const uint8_t owf[16],
/* [<][>][^][v][top][bottom][index][help] */
116 const char *user_in, const char *domain_in,
117 bool upper_case_domain, /* Transform the domain into UPPER case */
118 uint8_t kr_buf[16])
119 {
120 smb_ucs2_t *user;
121 smb_ucs2_t *domain;
122 size_t user_byte_len;
123 size_t domain_byte_len;
124 bool ret;
125
126 HMACMD5Context ctx;
127 TALLOC_CTX *mem_ctx = talloc_init("ntv2_owf_gen for %s\\%s", domain_in, user_in);
128
129 if (!mem_ctx) {
130 return false;
131 }
132
133 if (!user_in) {
134 user_in = "";
135 }
136
137 if (!domain_in) {
138 domain_in = "";
139 }
140
141 user_in = strupper_talloc(mem_ctx, user_in);
142 if (user_in == NULL) {
143 talloc_free(mem_ctx);
144 return false;
145 }
146
147 if (upper_case_domain) {
148 domain_in = strupper_talloc(mem_ctx, domain_in);
149 if (domain_in == NULL) {
150 talloc_free(mem_ctx);
151 return false;
152 }
153 }
154
155 ret = push_ucs2_talloc(mem_ctx, &user, user_in, &user_byte_len );
156 if (!ret) {
157 DEBUG(0, ("push_uss2_talloc() for user returned -1 (probably talloc() failure)\n"));
158 talloc_free(mem_ctx);
159 return false;
160 }
161
162 ret = push_ucs2_talloc(mem_ctx, &domain, domain_in, &domain_byte_len);
163 if (!ret) {
164 DEBUG(0, ("push_ucs2_talloc() for domain returned -1 (probably talloc() failure)\n"));
165 talloc_free(mem_ctx);
166 return false;
167 }
168
169 SMB_ASSERT(user_byte_len >= 2);
170 SMB_ASSERT(domain_byte_len >= 2);
171
172 /* We don't want null termination */
173 user_byte_len = user_byte_len - 2;
174 domain_byte_len = domain_byte_len - 2;
175
176 hmac_md5_init_limK_to_64(owf, 16, &ctx);
177 hmac_md5_update((const void *)user, user_byte_len, &ctx);
178 hmac_md5_update((const void *)domain, domain_byte_len, &ctx);
179 hmac_md5_final(kr_buf, &ctx);
180
181 #ifdef DEBUG_PASSWORD
182 DEBUG(100, ("ntv2_owf_gen: user, domain, owfkey, kr\n"));
183 dump_data(100, (const void *)user, user_byte_len);
184 dump_data(100, (const void *)domain, domain_byte_len);
185 dump_data(100, owf, 16);
186 dump_data(100, kr_buf, 16);
187 #endif
188
189 talloc_free(mem_ctx);
190 return true;
191 }
192
193 /* Does the des encryption from the NT or LM MD4 hash. */
194 void SMBOWFencrypt(const uint8_t passwd[16], const uint8_t *c8, uint8_t p24[24])
/* [<][>][^][v][top][bottom][index][help] */
195 {
196 uint8_t p21[21];
197
198 ZERO_STRUCT(p21);
199
200 memcpy(p21, passwd, 16);
201 E_P24(p21, c8, p24);
202 }
203
204 /* Does the NT MD4 hash then des encryption. */
205
206 void SMBNTencrypt(const char *passwd, uint8_t *c8, uint8_t *p24)
/* [<][>][^][v][top][bottom][index][help] */
207 {
208 uint8_t p21[21];
209
210 memset(p21,'\0',21);
211
212 E_md4hash(passwd, p21);
213 SMBOWFencrypt(p21, c8, p24);
214
215 #ifdef DEBUG_PASSWORD
216 DEBUG(100,("SMBNTencrypt: nt#, challenge, response\n"));
217 dump_data(100, p21, 16);
218 dump_data(100, c8, 8);
219 dump_data(100, p24, 24);
220 #endif
221 }
222
223 /* Does the md5 encryption from the Key Response for NTLMv2. */
224 void SMBOWFencrypt_ntv2(const uint8_t kr[16],
/* [<][>][^][v][top][bottom][index][help] */
225 const DATA_BLOB *srv_chal,
226 const DATA_BLOB *smbcli_chal,
227 uint8_t resp_buf[16])
228 {
229 HMACMD5Context ctx;
230
231 hmac_md5_init_limK_to_64(kr, 16, &ctx);
232 hmac_md5_update(srv_chal->data, srv_chal->length, &ctx);
233 hmac_md5_update(smbcli_chal->data, smbcli_chal->length, &ctx);
234 hmac_md5_final(resp_buf, &ctx);
235
236 #ifdef DEBUG_PASSWORD
237 DEBUG(100, ("SMBOWFencrypt_ntv2: srv_chal, smbcli_chal, resp_buf\n"));
238 dump_data(100, srv_chal->data, srv_chal->length);
239 dump_data(100, smbcli_chal->data, smbcli_chal->length);
240 dump_data(100, resp_buf, 16);
241 #endif
242 }
243
244 void SMBsesskeygen_ntv2(const uint8_t kr[16],
/* [<][>][^][v][top][bottom][index][help] */
245 const uint8_t * nt_resp, uint8_t sess_key[16])
246 {
247 /* a very nice, 128 bit, variable session key */
248
249 HMACMD5Context ctx;
250
251 hmac_md5_init_limK_to_64(kr, 16, &ctx);
252 hmac_md5_update(nt_resp, 16, &ctx);
253 hmac_md5_final((uint8_t *)sess_key, &ctx);
254
255 #ifdef DEBUG_PASSWORD
256 DEBUG(100, ("SMBsesskeygen_ntv2:\n"));
257 dump_data(100, sess_key, 16);
258 #endif
259 }
260
261 void SMBsesskeygen_ntv1(const uint8_t kr[16], uint8_t sess_key[16])
/* [<][>][^][v][top][bottom][index][help] */
262 {
263 /* yes, this session key does not change - yes, this
264 is a problem - but it is 128 bits */
265
266 mdfour((uint8_t *)sess_key, kr, 16);
267
268 #ifdef DEBUG_PASSWORD
269 DEBUG(100, ("SMBsesskeygen_ntv1:\n"));
270 dump_data(100, sess_key, 16);
271 #endif
272 }
273
274 void SMBsesskeygen_lm_sess_key(const uint8_t lm_hash[16],
/* [<][>][^][v][top][bottom][index][help] */
275 const uint8_t lm_resp[24], /* only uses 8 */
276 uint8_t sess_key[16])
277 {
278 /* Calculate the LM session key (effective length 40 bits,
279 but changes with each session) */
280 uint8_t p24[24];
281 uint8_t partial_lm_hash[14];
282
283 memcpy(partial_lm_hash, lm_hash, 8);
284 memset(partial_lm_hash + 8, 0xbd, 6);
285
286 des_crypt56(p24, lm_resp, partial_lm_hash, 1);
287 des_crypt56(p24+8, lm_resp, partial_lm_hash + 7, 1);
288
289 memcpy(sess_key, p24, 16);
290
291 #ifdef DEBUG_PASSWORD
292 DEBUG(100, ("SMBsesskeygen_lm_sess_key: \n"));
293 dump_data(100, sess_key, 16);
294 #endif
295 }
296
297 DATA_BLOB NTLMv2_generate_names_blob(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
298 const char *hostname,
299 const char *domain)
300 {
301 DATA_BLOB names_blob = data_blob_talloc(mem_ctx, NULL, 0);
302
303 msrpc_gen(mem_ctx, &names_blob,
304 "aaa",
305 NTLMSSP_NAME_TYPE_DOMAIN, domain,
306 NTLMSSP_NAME_TYPE_SERVER, hostname,
307 0, "");
308 return names_blob;
309 }
310
311 static DATA_BLOB NTLMv2_generate_client_data(TALLOC_CTX *mem_ctx, const DATA_BLOB *names_blob)
/* [<][>][^][v][top][bottom][index][help] */
312 {
313 uint8_t client_chal[8];
314 DATA_BLOB response = data_blob(NULL, 0);
315 uint8_t long_date[8];
316 NTTIME nttime;
317
318 unix_to_nt_time(&nttime, time(NULL));
319
320 generate_random_buffer(client_chal, sizeof(client_chal));
321
322 push_nttime(long_date, 0, nttime);
323
324 /* See http://www.ubiqx.org/cifs/SMB.html#SMB.8.5 */
325
326 msrpc_gen(mem_ctx, &response, "ddbbdb",
327 0x00000101, /* Header */
328 0, /* 'Reserved' */
329 long_date, 8, /* Timestamp */
330 client_chal, 8, /* client challenge */
331 0, /* Unknown */
332 names_blob->data, names_blob->length); /* End of name list */
333
334 return response;
335 }
336
337 static DATA_BLOB NTLMv2_generate_response(TALLOC_CTX *out_mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
338 const uint8_t ntlm_v2_hash[16],
339 const DATA_BLOB *server_chal,
340 const DATA_BLOB *names_blob)
341 {
342 uint8_t ntlmv2_response[16];
343 DATA_BLOB ntlmv2_client_data;
344 DATA_BLOB final_response;
345
346 TALLOC_CTX *mem_ctx = talloc_named(out_mem_ctx, 0,
347 "NTLMv2_generate_response internal context");
348
349 if (!mem_ctx) {
350 return data_blob(NULL, 0);
351 }
352
353 /* NTLMv2 */
354 /* generate some data to pass into the response function - including
355 the hostname and domain name of the server */
356 ntlmv2_client_data = NTLMv2_generate_client_data(mem_ctx, names_blob);
357
358 /* Given that data, and the challenge from the server, generate a response */
359 SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &ntlmv2_client_data, ntlmv2_response);
360
361 final_response = data_blob_talloc(out_mem_ctx, NULL, sizeof(ntlmv2_response) + ntlmv2_client_data.length);
362
363 memcpy(final_response.data, ntlmv2_response, sizeof(ntlmv2_response));
364
365 memcpy(final_response.data+sizeof(ntlmv2_response),
366 ntlmv2_client_data.data, ntlmv2_client_data.length);
367
368 talloc_free(mem_ctx);
369
370 return final_response;
371 }
372
373 static DATA_BLOB LMv2_generate_response(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
374 const uint8_t ntlm_v2_hash[16],
375 const DATA_BLOB *server_chal)
376 {
377 uint8_t lmv2_response[16];
378 DATA_BLOB lmv2_client_data = data_blob_talloc(mem_ctx, NULL, 8);
379 DATA_BLOB final_response = data_blob_talloc(mem_ctx, NULL,24);
380
381 /* LMv2 */
382 /* client-supplied random data */
383 generate_random_buffer(lmv2_client_data.data, lmv2_client_data.length);
384
385 /* Given that data, and the challenge from the server, generate a response */
386 SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &lmv2_client_data, lmv2_response);
387 memcpy(final_response.data, lmv2_response, sizeof(lmv2_response));
388
389 /* after the first 16 bytes is the random data we generated above,
390 so the server can verify us with it */
391 memcpy(final_response.data+sizeof(lmv2_response),
392 lmv2_client_data.data, lmv2_client_data.length);
393
394 data_blob_free(&lmv2_client_data);
395
396 return final_response;
397 }
398
399 bool SMBNTLMv2encrypt_hash(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
400 const char *user, const char *domain, const uint8_t nt_hash[16],
401 const DATA_BLOB *server_chal,
402 const DATA_BLOB *names_blob,
403 DATA_BLOB *lm_response, DATA_BLOB *nt_response,
404 DATA_BLOB *lm_session_key, DATA_BLOB *user_session_key)
405 {
406 uint8_t ntlm_v2_hash[16];
407
408 /* We don't use the NT# directly. Instead we use it mashed up with
409 the username and domain.
410 This prevents username swapping during the auth exchange
411 */
412 if (!ntv2_owf_gen(nt_hash, user, domain, true, ntlm_v2_hash)) {
413 return false;
414 }
415
416 if (nt_response) {
417 *nt_response = NTLMv2_generate_response(mem_ctx,
418 ntlm_v2_hash, server_chal,
419 names_blob);
420 if (user_session_key) {
421 *user_session_key = data_blob_talloc(mem_ctx, NULL, 16);
422
423 /* The NTLMv2 calculations also provide a session key, for signing etc later */
424 /* use only the first 16 bytes of nt_response for session key */
425 SMBsesskeygen_ntv2(ntlm_v2_hash, nt_response->data, user_session_key->data);
426 }
427 }
428
429 /* LMv2 */
430
431 if (lm_response) {
432 *lm_response = LMv2_generate_response(mem_ctx,
433 ntlm_v2_hash, server_chal);
434 if (lm_session_key) {
435 *lm_session_key = data_blob_talloc(mem_ctx, NULL, 16);
436
437 /* The NTLMv2 calculations also provide a session key, for signing etc later */
438 /* use only the first 16 bytes of lm_response for session key */
439 SMBsesskeygen_ntv2(ntlm_v2_hash, lm_response->data, lm_session_key->data);
440 }
441 }
442
443 return true;
444 }
445
446 bool SMBNTLMv2encrypt(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
447 const char *user, const char *domain,
448 const char *password,
449 const DATA_BLOB *server_chal,
450 const DATA_BLOB *names_blob,
451 DATA_BLOB *lm_response, DATA_BLOB *nt_response,
452 DATA_BLOB *lm_session_key, DATA_BLOB *user_session_key)
453 {
454 uint8_t nt_hash[16];
455 E_md4hash(password, nt_hash);
456
457 return SMBNTLMv2encrypt_hash(mem_ctx,
458 user, domain, nt_hash, server_chal, names_blob,
459 lm_response, nt_response, lm_session_key, user_session_key);
460 }
461
462 /***********************************************************
463 encode a password buffer with a unicode password. The buffer
464 is filled with random data to make it harder to attack.
465 ************************************************************/
466 bool encode_pw_buffer(uint8_t buffer[516], const char *password, int string_flags)
/* [<][>][^][v][top][bottom][index][help] */
467 {
468 uint8_t new_pw[512];
469 size_t new_pw_len;
470
471 /* the incoming buffer can be any alignment. */
472 string_flags |= STR_NOALIGN;
473
474 new_pw_len = push_string(new_pw,
475 password,
476 sizeof(new_pw), string_flags);
477
478 memcpy(&buffer[512 - new_pw_len], new_pw, new_pw_len);
479
480 generate_random_buffer(buffer, 512 - new_pw_len);
481
482 /*
483 * The length of the new password is in the last 4 bytes of
484 * the data buffer.
485 */
486 SIVAL(buffer, 512, new_pw_len);
487 ZERO_STRUCT(new_pw);
488 return true;
489 }
490
491
492 /***********************************************************
493 decode a password buffer
494 *new_pw_len is the length in bytes of the possibly mulitbyte
495 returned password including termination.
496 ************************************************************/
497 bool decode_pw_buffer(uint8_t in_buffer[516], char *new_pwrd,
/* [<][>][^][v][top][bottom][index][help] */
498 int new_pwrd_size, int string_flags)
499 {
500 int byte_len=0;
501 ssize_t converted_pw_len;
502
503 /* the incoming buffer can be any alignment. */
504 string_flags |= STR_NOALIGN;
505
506 /*
507 Warning !!! : This function is called from some rpc call.
508 The password IN the buffer may be a UNICODE string.
509 The password IN new_pwrd is an ASCII string
510 If you reuse that code somewhere else check first.
511 */
512
513 /* The length of the new password is in the last 4 bytes of the data buffer. */
514
515 byte_len = IVAL(in_buffer, 512);
516
517 #ifdef DEBUG_PASSWORD
518 dump_data(100, in_buffer, 516);
519 #endif
520
521 /* Password cannot be longer than the size of the password buffer */
522 if ( (byte_len < 0) || (byte_len > 512)) {
523 return false;
524 }
525
526 /* decode into the return buffer. Buffer length supplied */
527 converted_pw_len = pull_string(new_pwrd, &in_buffer[512 - byte_len], new_pwrd_size,
528 byte_len, string_flags);
529
530 if (converted_pw_len == -1) {
531 return false;
532 }
533
534 #ifdef DEBUG_PASSWORD
535 DEBUG(100,("decode_pw_buffer: new_pwrd: "));
536 dump_data(100, (const uint8_t *)new_pwrd, converted_pw_len);
537 DEBUG(100,("multibyte len:%d\n", (int)converted_pw_len));
538 DEBUG(100,("original char len:%d\n", byte_len/2));
539 #endif
540
541 return true;
542 }
543
544 /***********************************************************
545 encode a password buffer with an already unicode password. The
546 rest of the buffer is filled with random data to make it harder to attack.
547 ************************************************************/
548 bool set_pw_in_buffer(uint8_t buffer[516], DATA_BLOB *password)
/* [<][>][^][v][top][bottom][index][help] */
549 {
550 if (password->length > 512) {
551 return false;
552 }
553
554 memcpy(&buffer[512 - password->length], password->data, password->length);
555
556 generate_random_buffer(buffer, 512 - password->length);
557
558 /*
559 * The length of the new password is in the last 4 bytes of
560 * the data buffer.
561 */
562 SIVAL(buffer, 512, password->length);
563 return true;
564 }
565
566 /***********************************************************
567 decode a password buffer
568 *new_pw_size is the length in bytes of the extracted unicode password
569 ************************************************************/
570 bool extract_pw_from_buffer(TALLOC_CTX *mem_ctx,
/* [<][>][^][v][top][bottom][index][help] */
571 uint8_t in_buffer[516], DATA_BLOB *new_pass)
572 {
573 int byte_len=0;
574
575 /* The length of the new password is in the last 4 bytes of the data buffer. */
576
577 byte_len = IVAL(in_buffer, 512);
578
579 #ifdef DEBUG_PASSWORD
580 dump_data(100, in_buffer, 516);
581 #endif
582
583 /* Password cannot be longer than the size of the password buffer */
584 if ( (byte_len < 0) || (byte_len > 512)) {
585 return false;
586 }
587
588 *new_pass = data_blob_talloc(mem_ctx, &in_buffer[512 - byte_len], byte_len);
589
590 if (!new_pass->data) {
591 return false;
592 }
593
594 return true;
595 }