class Net::NTLM::Client::Session

Constants

CLIENT_TO_SERVER_SEALING
CLIENT_TO_SERVER_SIGNING
MAX64
SERVER_TO_CLIENT_SEALING
SERVER_TO_CLIENT_SIGNING
TIME_OFFSET
VERSION_MAGIC

Attributes

challenge_message[R]
channel_binding[R]
client[R]

Public Class Methods

new(client, challenge_message, channel_binding = nil) click to toggle source

@param client [Net::NTLM::Client] the client instance @param #challenge_message [Net::NTLM::Message::Type2] server message

# File lib/net/ntlm/client/session.rb, line 17
def initialize(client, challenge_message, channel_binding = nil)
  @client = client
  @challenge_message = challenge_message
  @channel_binding = channel_binding
end

Public Instance Methods

authenticate!() click to toggle source

Generate an NTLMv2 AUTHENTICATE_MESSAGE @see msdn.microsoft.com/en-us/library/cc236643.aspx @return [Net::NTLM::Message::Type3]

# File lib/net/ntlm/client/session.rb, line 26
def authenticate!
  calculate_user_session_key!
  type3_opts = {
    :lm_response   => lmv2_resp,
    :ntlm_response => ntlmv2_resp,
    :domain        => domain,
    :user          => username,
    :workstation   => workstation,
    :flag          => (challenge_message.flag & client.flags)
  }
  t3 = Message::Type3.create type3_opts
  if negotiate_key_exchange?
    t3.enable(:session_key)
    rc4 = OpenSSL::Cipher.new("rc4")
    rc4.encrypt
    rc4.key = user_session_key
    sk = rc4.update exported_session_key
    sk << rc4.final
    t3.session_key = sk
  end
  t3
end
exported_session_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 49
def exported_session_key
  @exported_session_key ||=
    begin
      if negotiate_key_exchange?
        OpenSSL::Cipher.new("rc4").random_key
      else
        user_session_key
      end
    end
end
seal_message(message) click to toggle source
# File lib/net/ntlm/client/session.rb, line 80
def seal_message(message)
  emessage = client_cipher.update(message)
  emessage + client_cipher.final
end
sign_message(message) click to toggle source
# File lib/net/ntlm/client/session.rb, line 60
def sign_message(message)
  seq = sequence
  sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, client_sign_key, "#{seq}#{message}")[0..7]
  if negotiate_key_exchange?
    sig = client_cipher.update sig
    sig << client_cipher.final
  end
  "#{VERSION_MAGIC}#{sig}#{seq}"
end
unseal_message(emessage) click to toggle source
# File lib/net/ntlm/client/session.rb, line 85
def unseal_message(emessage)
  message = server_cipher.update(emessage)
  message + server_cipher.final
end
verify_signature(signature, message) click to toggle source
# File lib/net/ntlm/client/session.rb, line 70
def verify_signature(signature, message)
  seq = signature[-4..-1]
  sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, server_sign_key, "#{seq}#{message}")[0..7]
  if negotiate_key_exchange?
    sig = server_cipher.update sig
    sig << server_cipher.final
  end
  "#{VERSION_MAGIC}#{sig}#{seq}" == signature
end

Private Instance Methods

blob() click to toggle source
# File lib/net/ntlm/client/session.rb, line 211
def blob
  @blob ||=
    begin
      b = Blob.new
      b.timestamp = timestamp
      b.challenge = client_challenge
      b.target_info = target_info
      b.serialize
    end
end
calculate_user_session_key!() click to toggle source
# File lib/net/ntlm/client/session.rb, line 195
def calculate_user_session_key!
  @user_session_key = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, nt_proof_str)
end
client_challenge() click to toggle source
# File lib/net/ntlm/client/session.rb, line 145
def client_challenge
  @client_challenge ||= NTLM.pack_int64le(rand(MAX64))
end
client_cipher() click to toggle source
# File lib/net/ntlm/client/session.rb, line 125
def client_cipher
  @client_cipher ||=
    begin
      rc4 = OpenSSL::Cipher.new("rc4")
      rc4.encrypt
      rc4.key = client_seal_key
      rc4
    end
end
client_seal_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 117
def client_seal_key
  @client_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SEALING}"
end
client_sign_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 109
def client_sign_key
  @client_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SIGNING}"
end
domain() click to toggle source
# File lib/net/ntlm/client/session.rb, line 179
def domain
  (client.domain ? oem_or_unicode_str(client.domain) : "")
end
lmv2_resp() click to toggle source
# File lib/net/ntlm/client/session.rb, line 199
def lmv2_resp
  OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + client_challenge) + client_challenge
end
negotiate_key_exchange?() click to toggle source
# File lib/net/ntlm/client/session.rb, line 163
def negotiate_key_exchange?
  challenge_message.has_flag? :KEY_EXCHANGE
end
nt_proof_str() click to toggle source
# File lib/net/ntlm/client/session.rb, line 207
def nt_proof_str
  @nt_proof_str ||= OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + blob)
end
ntlmv2_hash() click to toggle source
# File lib/net/ntlm/client/session.rb, line 191
def ntlmv2_hash
  @ntlmv2_hash ||= NTLM.ntlmv2_hash(username, password, domain, {:client_challenge => client_challenge, :unicode => !use_oem_strings?})
end
ntlmv2_resp() click to toggle source
# File lib/net/ntlm/client/session.rb, line 203
def ntlmv2_resp
  nt_proof_str + blob
end
oem_or_unicode_str(str) click to toggle source
# File lib/net/ntlm/client/session.rb, line 183
def oem_or_unicode_str(str)
  if use_oem_strings?
    NTLM::EncodeUtil.decode_utf16le str
  else
    NTLM::EncodeUtil.encode_utf16le str
  end
end
password() click to toggle source
# File lib/net/ntlm/client/session.rb, line 171
def password
  oem_or_unicode_str client.password
end
raw_sequence() click to toggle source
# File lib/net/ntlm/client/session.rb, line 101
def raw_sequence
  if defined? @raw_sequence
    @raw_sequence += 1
  else
    @raw_sequence = 0
  end
end
sequence() click to toggle source
# File lib/net/ntlm/client/session.rb, line 97
def sequence
  [raw_sequence].pack("V*")
end
server_challenge() click to toggle source
# File lib/net/ntlm/client/session.rb, line 149
def server_challenge
  @server_challenge ||= challenge_message[:challenge].serialize
end
server_cipher() click to toggle source
# File lib/net/ntlm/client/session.rb, line 135
def server_cipher
  @server_cipher ||=
    begin
      rc4 = OpenSSL::Cipher.new("rc4")
      rc4.decrypt
      rc4.key = server_seal_key
      rc4
    end
end
server_seal_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 121
def server_seal_key
  @server_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SEALING}"
end
server_sign_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 113
def server_sign_key
  @server_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SIGNING}"
end
target_info() click to toggle source
# File lib/net/ntlm/client/session.rb, line 222
def target_info
  @target_info ||= begin
    if channel_binding
      t = Net::NTLM::TargetInfo.new(challenge_message.target_info)
      av_id = Net::NTLM::TargetInfo::MSV_AV_CHANNEL_BINDINGS
      t.av_pairs[av_id] = channel_binding.channel_binding_token
      t.to_s
    else
      challenge_message.target_info
    end
  end
end
timestamp() click to toggle source

epoch -> milsec from Jan 1, 1601 @see support.microsoft.com/kb/188768

# File lib/net/ntlm/client/session.rb, line 155
def timestamp
  @timestamp ||= 10_000_000 * (Time.now.to_i + TIME_OFFSET)
end
use_oem_strings?() click to toggle source
# File lib/net/ntlm/client/session.rb, line 159
def use_oem_strings?
  challenge_message.has_flag? :OEM
end
user_session_key() click to toggle source
# File lib/net/ntlm/client/session.rb, line 93
def user_session_key
  @user_session_key ||=  nil
end
username() click to toggle source
# File lib/net/ntlm/client/session.rb, line 167
def username
  oem_or_unicode_str client.username
end
workstation() click to toggle source
# File lib/net/ntlm/client/session.rb, line 175
def workstation
  (client.workstation ? oem_or_unicode_str(client.workstation) : "")
end