pal/type2_message.cpp at master · olvemaudal/pal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#include "type2_message.hpp"

#include "tools.hpp"

#include <cstddef>
#include <algorithm>
#include <stdexcept>

/*
 * See http://davenport.sourceforge.net/ntlm.html
 *
 * Type 2 Message
 *
 *   0  NTLMSSP Signature                 {'N','T','L','M','S','S','P','\0'}
 *   8  NTLM Message Type                 {0x02,0x00,0x00,0x00}
 *  12  Target Name                       (security buffer)
 *  20  Flags                             uint32 as little endian
 *  24  Challenge                         8 bytes / uint64 as little endian
 * (32) Context (optional)                8 bytes (2xlong)
 * (40) Target Information                (security buffer)
 * (48) (start of datablock)
 *      targetname
 *      targetinfo
 *          server (type=0x0100, len, data)
 *          domain (type=0x0200, len, data)
 *          dnsserver (type=0x0300, len, data)
 *          dnsdomain (type=0x0400, len, data)
 *          type5 (type=0x0500, len, data)   // unknown role
 *          <terminator> (type=0,len=0)
 */

pal::type2_message::type2_message(const std::vector<uint8_t> & buffer)
    : buffer_(buffer)
{
    enum { min_type2_buffer_size = 32 };
    if (buffer.size() < min_type2_buffer_size)
        throw std::invalid_argument("not a type2 message, message too short");
    const uint8_t prefix[12] = {
        'N','T','L','M','S','S','P','\0',
        0x02,0x00,0x00,0x00
    };
    if (!std::equal(prefix, prefix + sizeof prefix, buffer.begin()))
        throw std::invalid_argument("not a type2 message, invalid prefix");
}

uint32_t pal::type2_message::ssp_flags() const
{
    enum { ssp_flags_offset = 20 };
    return pal::read_uint32_from_little_endian(&buffer_[ssp_flags_offset]);
}

uint64_t pal::type2_message::challenge() const
{
    enum { challenge_offset = 24 };
    return pal::read_uint64_from_little_endian(&buffer_[challenge_offset]);
}

std::vector<uint8_t> pal::type2_message::as_bytes() const
{
    return buffer_;
}