OpenVAS Scanner  7.0.1~git
smb_crypt.h File Reference

Unix SMB/Netbios implementation. Version 1.9. More...

#include "byteorder.h"
#include "charset.h"
#include "hmacmd5.h"
#include "md4.h"
#include "md5.h"
Include dependency graph for smb_crypt.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros

#define uint8   uint8_t
 
#define False   0
 
#define True   1
 

Typedefs

typedef unsigned int bool
 

Functions

void E_P24 (const uchar *p21, const uchar *c8, uchar *p24)
 
void E_P16 (uchar *p14, uchar *p16)
 
int strupper_w (smb_ucs2_t *s)
 
void SMBsesskeygen_lm_sess_key_ntlmssp (const uchar lm_hash[16], const uchar lm_resp[24], uint8 sess_key[16])
 
void SMBsesskeygen_ntv1_ntlmssp (const uchar kr[16], const uchar *nt_resp, uint8 sess_key[16])
 
void SMBOWFencrypt_ntlmssp (const uchar passwd[16], const uchar *c8, uchar p24[24])
 
void SMBencrypt_hash_ntlmssp (const uchar lm_hash[16], const uchar *c8, uchar p24[24])
 
void SMBNTencrypt_hash_ntlmssp (const uchar nt_hash[16], uchar *c8, uchar *p24)
 
bool E_deshash_ntlmssp (const char *passwd, uint8_t pass_len, uchar p16[16])
 
void SamOEMhash (uchar *data, const uchar *key, int val)
 
void SMBOWFencrypt_ntv2_ntlmssp (const uchar kr[16], const uint8_t *srv_chal, int srv_chal_len, const uint8_t *cli_chal, int cli_chal_len, uchar resp_buf[16])
 
void SMBsesskeygen_ntv2_ntlmssp (const uchar kr[16], const uchar *nt_resp, uint8 sess_key[16])
 
uint8_t * NTLMv2_generate_client_data_ntlmssp (const char *addr_list, int address_list_len)
 
void NTLMv2_generate_response_ntlmssp (const uchar ntlm_v2_hash[16], const char *server_chal, const char *address_list, int address_list_len, uint8_t *nt_response)
 
void LMv2_generate_response_ntlmssp (const uchar ntlm_v2_hash[16], const char *server_chal, uint8_t *lm_response)
 
void SMBNTLMv2encrypt_hash_ntlmssp (const char *user, const char *domain, uchar ntlm_v2_hash[16], const char *server_chal, const char *address_list, int address_list_len, unsigned char *lm_response, unsigned char *nt_response, unsigned char *user_session_key)
 

Detailed Description

Unix SMB/Netbios implementation. Version 1.9.

a partial implementation of DES designed for use in the SMB authentication protocol

Definition in file smb_crypt.h.

Macro Definition Documentation

◆ False

#define False   0

Definition at line 45 of file smb_crypt.h.

◆ True

#define True   1

Definition at line 46 of file smb_crypt.h.

◆ uint8

#define uint8   uint8_t

Definition at line 41 of file smb_crypt.h.

Typedef Documentation

◆ bool

typedef unsigned int bool

Definition at line 44 of file smb_crypt.h.

Function Documentation

◆ E_deshash_ntlmssp()

bool E_deshash_ntlmssp ( const char *  passwd,
uint8_t  pass_len,
uchar  p16[16] 
)

Creates the DES forward-only Hash of the users password in DOS ASCII charset

Parameters
passwdpassword in 'unix' charset.
p16return password hashed with DES, caller allocated 16 byte buffer
Returns
False if password was > 14 characters, and therefore may be incorrect, otherwise True
Note
p16 is filled in regardless

Definition at line 450 of file smb_crypt.c.

451 {
452  bool ret = True;
453  fstring dospwd;
454  ZERO_STRUCT (dospwd);
455  char *dpass;
456 
457  /* Password must be converted to DOS charset - null terminated, uppercase. */
458  dpass = g_utf8_strup (passwd, pass_len);
459  memcpy (dospwd, dpass, pass_len);
460  g_free (dpass);
461 
462  /* Only the first 14 chars are considered, password need not be null
463  * terminated. */
464  E_P16 ((unsigned char *) dospwd, p16);
465 
466  if (strlen (dospwd) > 14)
467  {
468  ret = False;
469  }
470 
471  ZERO_STRUCT (dospwd);
472 
473  return ret;
474 }

References E_P16(), False, True, and ZERO_STRUCT.

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ E_P16()

void E_P16 ( uchar p14,
uchar p16 
)

Definition at line 315 of file smb_crypt.c.

316 {
317  uchar sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25};
318  smbhash (p16, sp8, p14, 1);
319  smbhash (p16 + 8, sp8, p14 + 7, 1);
320 }

References smbhash(), and uchar.

Referenced by E_deshash_ntlmssp(), and nasl_lm_owf_gen().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ E_P24()

void E_P24 ( const uchar p21,
const uchar c8,
uchar p24 
)

Definition at line 323 of file smb_crypt.c.

324 {
325  smbhash (p24, c8, p21, 1);
326  smbhash (p24 + 8, c8, p21 + 7, 1);
327  smbhash (p24 + 16, c8, p21 + 14, 1);
328 }

References smbhash().

Referenced by nasl_ntlmv1_hash(), and SMBOWFencrypt_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ LMv2_generate_response_ntlmssp()

void LMv2_generate_response_ntlmssp ( const uchar  ntlm_v2_hash[16],
const char *  server_chal,
uint8_t *  lm_response 
)

Definition at line 545 of file smb_crypt.c.

547 {
548  uchar lmv2_response[16];
549  uint8_t lmv2_client_data[8];
550 
551  /* LMv2 */
552  /* client-supplied random data */
553  generate_random_buffer_ntlmssp (lmv2_client_data, sizeof (lmv2_client_data));
554 
555  /* Given that data, and the challenge from the server, generate a response */
556  SMBOWFencrypt_ntv2_ntlmssp (ntlm_v2_hash, (const uchar *) server_chal, 8,
557  lmv2_client_data, sizeof (lmv2_client_data),
558  lmv2_response);
559  memcpy (lm_response, lmv2_response, sizeof (lmv2_response));
560 
561  /* after the first 16 bytes is the random data we generated above,
562  so the server can verify us with it */
563  memcpy (lm_response + sizeof (lmv2_response), lmv2_client_data,
564  sizeof (lmv2_client_data));
565 }

References generate_random_buffer_ntlmssp(), SMBOWFencrypt_ntv2_ntlmssp(), and uchar.

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ NTLMv2_generate_client_data_ntlmssp()

uint8_t* NTLMv2_generate_client_data_ntlmssp ( const char *  addr_list,
int  address_list_len 
)

Definition at line 489 of file smb_crypt.c.

491 {
492  int i = 0;
493  /*length of response
494  *header-4, reserved-4, date-8, client chal-8, unknown-4, addr_list-size sent
495  *in arguments
496  */
497  uchar client_chal[8];
498  uint8_t *response = g_malloc0 (28 + address_list_len);
499  char long_date[8];
500  int header = 0x00000101;
501  int zeros = 0x00000000;
502 
503  generate_random_buffer_ntlmssp (client_chal, sizeof (client_chal));
504 
505  put_long_date_ntlmssp (long_date, time (NULL));
506  SIVAL (response, 0, header);
507  SIVAL (response, 4, zeros);
508  memcpy (response + 4 + 4, long_date, 8);
509  memcpy (response + 4 + 4 + sizeof (long_date), client_chal, 8);
510  SIVAL (response, 24, zeros);
511  for (i = 0; i < address_list_len; i++)
512  {
513  *(response + 28 + i) = *(addr_list + i);
514  }
515 
516  return response;
517 }

References generate_random_buffer_ntlmssp(), put_long_date_ntlmssp(), SIVAL, and uchar.

Referenced by NTLMv2_generate_response_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ NTLMv2_generate_response_ntlmssp()

void NTLMv2_generate_response_ntlmssp ( const uchar  ntlm_v2_hash[16],
const char *  server_chal,
const char *  address_list,
int  address_list_len,
uint8_t *  nt_response 
)

Definition at line 520 of file smb_crypt.c.

524 {
525  uchar ntlmv2_response[16];
526  uint8_t *ntlmv2_client_data;
527 
528  /* NTLMv2 */
529  /* generate some data to pass into the response function - including
530  the hostname and domain name of the server */
531  ntlmv2_client_data =
532  NTLMv2_generate_client_data_ntlmssp (address_list, address_list_len);
533 
534  /* Given that data, and the challenge from the server, generate a response */
535  int client_data_len = 28 + address_list_len;
536  SMBOWFencrypt_ntv2_ntlmssp (ntlm_v2_hash, (const uchar *) server_chal, 8,
537  ntlmv2_client_data, client_data_len,
538  ntlmv2_response);
539  memcpy (nt_response, ntlmv2_response, sizeof (ntlmv2_response));
540  memcpy (nt_response + sizeof (ntlmv2_response), ntlmv2_client_data,
541  client_data_len);
542 }

References NTLMv2_generate_client_data_ntlmssp(), SMBOWFencrypt_ntv2_ntlmssp(), and uchar.

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SamOEMhash()

void SamOEMhash ( uchar data,
const uchar key,
int  val 
)

Definition at line 331 of file smb_crypt.c.

332 {
333  uchar hash[256];
334  uchar index_i = 0;
335  uchar index_j = 0;
336  uchar j = 0;
337  int ind;
338  int len = 0;
339  if (val == 1)
340  len = 516;
341  if (val == 0)
342  len = 16;
343  if (val == 3)
344  len = 8;
345  if (val == 2)
346  len = 68;
347  if (val == 4)
348  len = 32;
349 
350  if (val >= 8)
351  len = val;
352 
353  for (ind = 0; ind < 256; ind++)
354  {
355  hash[ind] = (uchar) ind;
356  }
357 
358  for (ind = 0; ind < 256; ind++)
359  {
360  uchar tc;
361 
362  j += (hash[ind] + key[ind % 16]);
363 
364  tc = hash[ind];
365  hash[ind] = hash[j];
366  hash[j] = tc;
367  }
368  for (ind = 0; ind < len; ind++)
369  {
370  uchar tc;
371  uchar t;
372 
373  index_i++;
374  index_j += hash[index_i];
375 
376  tc = hash[index_i];
377  hash[index_i] = hash[index_j];
378  hash[index_j] = tc;
379 
380  t = hash[index_i] + hash[index_j];
381  data[ind] = data[ind] ^ hash[t];
382  }
383 }

References uchar, and val.

Referenced by ntlmssp_genauth_keyexchg().

Here is the caller graph for this function:

◆ SMBencrypt_hash_ntlmssp()

void SMBencrypt_hash_ntlmssp ( const uchar  lm_hash[16],
const uchar c8,
uchar  p24[24] 
)

Definition at line 407 of file smb_crypt.c.

409 {
410  uchar p21[21];
411 
412  memset (p21, '\0', 21);
413  memcpy (p21, lm_hash, 16);
414  SMBOWFencrypt_ntlmssp (p21, c8, p24);
415 }

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMBNTencrypt_hash_ntlmssp()

void SMBNTencrypt_hash_ntlmssp ( const uchar  nt_hash[16],
uchar c8,
uchar p24 
)

Definition at line 419 of file smb_crypt.c.

420 {
421  uchar p21[21];
422 
423  memset (p21, '\0', 21);
424  memcpy (p21, nt_hash, 16);
425  SMBOWFencrypt_ntlmssp (p21, c8, p24);
426 }

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMBNTLMv2encrypt_hash_ntlmssp()

void SMBNTLMv2encrypt_hash_ntlmssp ( const char *  user,
const char *  domain,
uchar  ntlm_v2_hash[16],
const char *  server_chal,
const char *  address_list,
int  address_list_len,
unsigned char *  lm_response,
unsigned char *  nt_response,
unsigned char *  user_session_key 
)

◆ SMBOWFencrypt_ntlmssp()

void SMBOWFencrypt_ntlmssp ( const uchar  passwd[16],
const uchar c8,
uchar  p24[24] 
)

Definition at line 397 of file smb_crypt.c.

398 {
399  uchar p21[21];
400 
401  ZERO_STRUCT (p21);
402  memcpy (p21, passwd, 16);
403  E_P24 (p21, c8, p24);
404 }

References E_P24(), uchar, and ZERO_STRUCT.

Referenced by SMBencrypt_hash_ntlmssp(), SMBNTencrypt_hash_ntlmssp(), and SMBsesskeygen_lm_sess_key_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMBOWFencrypt_ntv2_ntlmssp()

void SMBOWFencrypt_ntv2_ntlmssp ( const uchar  kr[16],
const uint8_t *  srv_chal,
int  srv_chal_len,
const uint8_t *  cli_chal,
int  cli_chal_len,
uchar  resp_buf[16] 
)

Referenced by LMv2_generate_response_ntlmssp(), nasl_ntlmv2_hash(), and NTLMv2_generate_response_ntlmssp().

Here is the caller graph for this function:

◆ SMBsesskeygen_lm_sess_key_ntlmssp()

void SMBsesskeygen_lm_sess_key_ntlmssp ( const uchar  lm_hash[16],
const uchar  lm_resp[24],
uint8  sess_key[16] 
)

Definition at line 429 of file smb_crypt.c.

431 {
432  uchar p24[24];
433  uchar partial_lm_hash[16];
434 
435  memcpy (partial_lm_hash, lm_hash, 8);
436  memset (partial_lm_hash + 8, 0xbd, 8);
437  SMBOWFencrypt_ntlmssp (partial_lm_hash, lm_resp, p24);
438  memcpy (sess_key, p24, 16);
439 }

References SMBOWFencrypt_ntlmssp(), and uchar.

Referenced by ntlmssp_genauth_ntlm().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMBsesskeygen_ntv1_ntlmssp()

void SMBsesskeygen_ntv1_ntlmssp ( const uchar  kr[16],
const uchar nt_resp,
uint8  sess_key[16] 
)

Definition at line 386 of file smb_crypt.c.

388 {
389  /* yes, this session key does not change - yes, this
390  is a problem - but it is 128 bits */
391  (void) nt_resp;
392  mdfour_ntlmssp ((unsigned char *) sess_key, kr, 16);
393 }

References mdfour_ntlmssp().

Referenced by ntlmssp_genauth_ntlm(), and ntlmssp_genauth_ntlm2().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMBsesskeygen_ntv2_ntlmssp()

void SMBsesskeygen_ntv2_ntlmssp ( const uchar  kr[16],
const uchar nt_resp,
uint8  sess_key[16] 
)

Definition at line 476 of file smb_crypt.c.

478 {
479  /* a very nice, 128 bit, variable session key */
480 
481  HMACMD5Context ctx;
482 
483  hmac_md5_init_limK_to_64 (kr, 16, &ctx);
484  hmac_md5_update (nt_resp, 16, &ctx);
485  hmac_md5_final ((unsigned char *) sess_key, &ctx);
486 }

References hmac_md5_final(), hmac_md5_init_limK_to_64(), and hmac_md5_update().

Referenced by SMBNTLMv2encrypt_hash_ntlmssp().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ strupper_w()

int strupper_w ( smb_ucs2_t s)

Definition at line 48 of file smb_crypt2.c.

49 {
50  int ret = 0;
51  while (*s)
52  {
53  smb_ucs2_t v = toupper_w (*s);
54  if (v != *s)
55  {
56  *s = v;
57  ret = 1;
58  }
59  s++;
60  }
61  return ret;
62 }

References toupper_w().

Referenced by nasl_ntv2_owf_gen().

Here is the call graph for this function:
Here is the caller graph for this function:
HMACMD5Context
Definition: hmacmd5.h:41
E_P24
void E_P24(const uchar *p21, const uchar *c8, uchar *p24)
Definition: smb_crypt.c:323
ZERO_STRUCT
#define ZERO_STRUCT(x)
Definition: genrand.c:70
uchar
#define uchar
Definition: hmacmd5.h:35
mdfour_ntlmssp
void mdfour_ntlmssp(unsigned char *out, const unsigned char *in, int n)
Definition: md4.c:174
fstring
char fstring[FSTRING_LEN]
Definition: smb_crypt.c:68
E_P16
void E_P16(uchar *p14, uchar *p16)
Definition: smb_crypt.c:315
SIVAL
#define SIVAL(buf, pos, val)
Definition: byteorder.h:130
generate_random_buffer_ntlmssp
void generate_random_buffer_ntlmssp(unsigned char *out, int len)
Definition: genrand.c:184
hmac_md5_init_limK_to_64
void hmac_md5_init_limK_to_64(const uchar *key, int key_len, HMACMD5Context *ctx)
The microsoft version of hmac_md5 initialisation.
Definition: hmacmd5.c:37
SMBOWFencrypt_ntlmssp
void SMBOWFencrypt_ntlmssp(const uchar passwd[16], const uchar *c8, uchar p24[24])
Definition: smb_crypt.c:397
SMBOWFencrypt_ntv2_ntlmssp
void SMBOWFencrypt_ntv2_ntlmssp(const uchar kr[16], const uint8_t *srv_chal, int srv_chal_len, const uint8_t *cli_chal, int cli_chal_len, uchar resp_buf[16])
smbhash
void smbhash(uchar *out, const uchar *in, const uchar *key, int forw)
Definition: smb_crypt.c:283
hmac_md5_update
void hmac_md5_update(const uchar *text, int text_len, HMACMD5Context *ctx)
Update hmac_md5 "inner" buffer.
Definition: hmacmd5.c:68
put_long_date_ntlmssp
void put_long_date_ntlmssp(char *p, time_t t)
Definition: time.c:122
smb_ucs2_t
uint16 smb_ucs2_t
Definition: hmacmd5.h:65
NTLMv2_generate_client_data_ntlmssp
uint8_t * NTLMv2_generate_client_data_ntlmssp(const char *addr_list, int address_list_len)
Definition: smb_crypt.c:489
hmac_md5_final
void hmac_md5_final(uchar *digest, HMACMD5Context *ctx)
Finish off hmac_md5 "inner" buffer and generate outer one.
Definition: hmacmd5.c:77
False
#define False
Definition: charcnv.c:76
True
#define True
Definition: charcnv.c:77
val
const char * val
Definition: nasl_init.c:378
toupper_w
smb_ucs2_t toupper_w(smb_ucs2_t val)
Definition: smb_crypt2.c:38