@param client [Net::NTLM::Client] the client instance @param #challenge_message [Net::NTLM::Message::Type2] server message
# File lib/net/ntlm/client/session.rb, line 17 def initialize(client, challenge_message, channel_binding = nil) @client = client @challenge_message = challenge_message @channel_binding = channel_binding end
Generate an NTLMv2 AUTHENTICATE_MESSAGE @see msdn.microsoft.com/en-us/library/cc236643.aspx @return [Net::NTLM::Message::Type3]
# File lib/net/ntlm/client/session.rb, line 26 def authenticate! calculate_user_session_key! type3_opts = { :lm_response => lmv2_resp, :ntlm_response => ntlmv2_resp, :domain => domain, :user => username, :workstation => workstation, :flag => (challenge_message.flag & client.flags) } t3 = Message::Type3.create type3_opts if negotiate_key_exchange? t3.enable(:session_key) rc4 = OpenSSL::Cipher.new("rc4") rc4.encrypt rc4.key = user_session_key sk = rc4.update exported_session_key sk << rc4.final t3.session_key = sk end t3 end
# File lib/net/ntlm/client/session.rb, line 49 def exported_session_key @exported_session_key ||= begin if negotiate_key_exchange? OpenSSL::Cipher.new("rc4").random_key else user_session_key end end end
# File lib/net/ntlm/client/session.rb, line 80 def seal_message(message) emessage = client_cipher.update(message) emessage + client_cipher.final end
# File lib/net/ntlm/client/session.rb, line 60 def sign_message(message) seq = sequence sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, client_sign_key, "#{seq}#{message}")[0..7] if negotiate_key_exchange? sig = client_cipher.update sig sig << client_cipher.final end "#{VERSION_MAGIC}#{sig}#{seq}" end
# File lib/net/ntlm/client/session.rb, line 85 def unseal_message(emessage) message = server_cipher.update(emessage) message + server_cipher.final end
# File lib/net/ntlm/client/session.rb, line 70 def verify_signature(signature, message) seq = signature[-4..-1] sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, server_sign_key, "#{seq}#{message}")[0..7] if negotiate_key_exchange? sig = server_cipher.update sig sig << server_cipher.final end "#{VERSION_MAGIC}#{sig}#{seq}" == signature end
# File lib/net/ntlm/client/session.rb, line 211 def blob @blob ||= begin b = Blob.new b.timestamp = timestamp b.challenge = client_challenge b.target_info = target_info b.serialize end end
# File lib/net/ntlm/client/session.rb, line 195 def calculate_user_session_key! @user_session_key = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, nt_proof_str) end
# File lib/net/ntlm/client/session.rb, line 145 def client_challenge @client_challenge ||= NTLM.pack_int64le(rand(MAX64)) end
# File lib/net/ntlm/client/session.rb, line 125 def client_cipher @client_cipher ||= begin rc4 = OpenSSL::Cipher.new("rc4") rc4.encrypt rc4.key = client_seal_key rc4 end end
# File lib/net/ntlm/client/session.rb, line 117 def client_seal_key @client_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SEALING}" end
# File lib/net/ntlm/client/session.rb, line 109 def client_sign_key @client_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SIGNING}" end
# File lib/net/ntlm/client/session.rb, line 179 def domain (client.domain ? oem_or_unicode_str(client.domain) : "") end
# File lib/net/ntlm/client/session.rb, line 199 def lmv2_resp OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + client_challenge) + client_challenge end
# File lib/net/ntlm/client/session.rb, line 163 def negotiate_key_exchange? challenge_message.has_flag? :KEY_EXCHANGE end
# File lib/net/ntlm/client/session.rb, line 207 def nt_proof_str @nt_proof_str ||= OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + blob) end
# File lib/net/ntlm/client/session.rb, line 191 def ntlmv2_hash @ntlmv2_hash ||= NTLM.ntlmv2_hash(username, password, domain, {:client_challenge => client_challenge, :unicode => !use_oem_strings?}) end
# File lib/net/ntlm/client/session.rb, line 203 def ntlmv2_resp nt_proof_str + blob end
# File lib/net/ntlm/client/session.rb, line 183 def oem_or_unicode_str(str) if use_oem_strings? NTLM::EncodeUtil.decode_utf16le str else NTLM::EncodeUtil.encode_utf16le str end end
# File lib/net/ntlm/client/session.rb, line 171 def password oem_or_unicode_str client.password end
# File lib/net/ntlm/client/session.rb, line 101 def raw_sequence if defined? @raw_sequence @raw_sequence += 1 else @raw_sequence = 0 end end
# File lib/net/ntlm/client/session.rb, line 97 def sequence [raw_sequence].pack("V*") end
# File lib/net/ntlm/client/session.rb, line 149 def server_challenge @server_challenge ||= challenge_message[:challenge].serialize end
# File lib/net/ntlm/client/session.rb, line 135 def server_cipher @server_cipher ||= begin rc4 = OpenSSL::Cipher.new("rc4") rc4.decrypt rc4.key = server_seal_key rc4 end end
# File lib/net/ntlm/client/session.rb, line 121 def server_seal_key @server_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SEALING}" end
# File lib/net/ntlm/client/session.rb, line 113 def server_sign_key @server_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SIGNING}" end
# File lib/net/ntlm/client/session.rb, line 222 def target_info @target_info ||= begin if channel_binding t = Net::NTLM::TargetInfo.new(challenge_message.target_info) av_id = Net::NTLM::TargetInfo::MSV_AV_CHANNEL_BINDINGS t.av_pairs[av_id] = channel_binding.channel_binding_token t.to_s else challenge_message.target_info end end end
epoch -> milsec from Jan 1, 1601 @see support.microsoft.com/kb/188768
# File lib/net/ntlm/client/session.rb, line 155 def timestamp @timestamp ||= 10_000_000 * (Time.now.to_i + TIME_OFFSET) end
# File lib/net/ntlm/client/session.rb, line 159 def use_oem_strings? challenge_message.has_flag? :OEM end
# File lib/net/ntlm/client/session.rb, line 93 def user_session_key @user_session_key ||= nil end
# File lib/net/ntlm/client/session.rb, line 167 def username oem_or_unicode_str client.username end
# File lib/net/ntlm/client/session.rb, line 175 def workstation (client.workstation ? oem_or_unicode_str(client.workstation) : "") end