ntlmv2

import "github.com/TheManticoreProject/Manticore/crypto/ntlmv2"

Index

• func LMOWFv2(Passwd, User, UserDomain string) []byte
• func NTOWFv2(Passwd, User, UserDomain string) []byte
• type NTLMv2Ctx
  • func NewNTLMv2CtxWithNTHash(domain, username string, nthash [16]byte, serverChallenge, clientChallenge [8]byte) (*NTLMv2Ctx, error)
  • func NewNTLMv2CtxWithPassword(domain, username, password string, serverChallenge, clientChallenge [8]byte) (*NTLMv2Ctx, error)
  • func (ntlm *NTLMv2Ctx) ComputeLMChallengeResponse(hasTimestamp bool) []byte
  • func (ntlm *NTLMv2Ctx) ComputeNTChallengeResponse(timestamp []byte, targetInfo []byte) ([]byte, []byte, error)
  • func (ntlm *NTLMv2Ctx) ComputeResponse(ResponseKeyNT, ResponseKeyLM, ServerChallenge, ClientChallenge, timestamp []byte, ServerName []byte) ([]byte, error)
  • func (ntlm *NTLMv2Ctx) ComputeSessionBaseKey(ntProofStr []byte) []byte
• type NTLMv2Response
  • func NewNTLMv2Response(username, domain string, serverChallenge [8]byte, lmChallengeResponse [24]byte, ntChallengeResponse [24]byte) *NTLMv2Response
  • func (r *NTLMv2Response) HashcatString() (string, error)
  • func (r *NTLMv2Response) String() string

func LMOWFv2

func LMOWFv2(Passwd, User, UserDomain string) []byte

LMOWFv2 computes the LMOWFv2 hash for a given password, username, and domain Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3

Returns:

• The LMOWFv2 hash as a byte slice
• An error if the computation fails

func NTOWFv2

func NTOWFv2(Passwd, User, UserDomain string) []byte

NTOWFv2 computes the NTOWFv2 hash (ResponseKeyNT) for a given password, username, and domain. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3

type NTLMv2Ctx

NTLMv2 represents the components needed for NTLMv2 authentication https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3

type NTLMv2Ctx struct {
    Domain   string
    Username string
    Password string

    ServerChallenge [8]byte
    ClientChallenge [8]byte

    NTHash [16]byte
    LMHash [16]byte

    ResponseKeyNT [16]byte
    ResponseKeyLM [16]byte
}

func NewNTLMv2CtxWithNTHash

func NewNTLMv2CtxWithNTHash(domain, username string, nthash [16]byte, serverChallenge, clientChallenge [8]byte) (*NTLMv2Ctx, error)

NewNTLMv2CtxWithNTHash creates a new NTLMv2 instance with the provided credentials and challenges

Parameters:

• domain: The domain name
• username: The username
• nthash: The 16-byte NT hash
• serverChallenge: The 8-byte server challenge
• clientChallenge: The 8-byte client challenge

func NewNTLMv2CtxWithPassword

func NewNTLMv2CtxWithPassword(domain, username, password string, serverChallenge, clientChallenge [8]byte) (*NTLMv2Ctx, error)

NewNTLMv2CtxWithPassword creates a new NTLMv2 instance with the provided credentials and challenges

Parameters:

• domain: The domain name
• username: The username
• password: The plaintext password
• serverChallenge: The 8-byte server challenge
• clientChallenge: The 8-byte client challenge

func (*NTLMv2Ctx) ComputeLMChallengeResponse

func (ntlm *NTLMv2Ctx) ComputeLMChallengeResponse(hasTimestamp bool) []byte

ComputeLMChallengeResponse computes the LmChallengeResponse per MS-NLMP 3.1.5.1.2.

When hasTimestamp is true (MsvAvTimestamp was present in the server TargetInfo), the spec requires LmChallengeResponse to be Z(24). Otherwise it is:

HMAC-MD5(ResponseKeyLM, ServerChallenge || ClientChallenge) || ClientChallenge  (24 bytes)

Parameters:

• hasTimestamp: true when MsvAvTimestamp was present in the server’s TargetInfo

func (*NTLMv2Ctx) ComputeNTChallengeResponse

func (ntlm *NTLMv2Ctx) ComputeNTChallengeResponse(timestamp []byte, targetInfo []byte) ([]byte, []byte, error)

ComputeNTChallengeResponse builds the full NTChallengeResponse (NTProofStr || blob) as specified in MS-NLMP section 3.3.2.

The blob structure (called “temp” in the spec):

RespType(1) | HiRespType(1) | Z(2) | Z(4) | Timestamp(8) | ClientChallenge(8) | Z(4) | TargetInfo(var) | Z(4)

targetInfo should already have MsvAvFlags set (use targetinfo.BuildBlobTargetInfo to prepare it).

Parameters:

• timestamp: 8-byte Windows FILETIME from MsvAvTimestamp or derived from current time
• targetInfo: raw TargetInfo bytes prepared for the blob

Returns:

• ntChallengeResponse: NTProofStr(16) || blob(variable)
• ntProofStr: the 16-byte NTProofStr (needed for ComputeSessionBaseKey)
• error

func (*NTLMv2Ctx) ComputeResponse

func (ntlm *NTLMv2Ctx) ComputeResponse(ResponseKeyNT, ResponseKeyLM, ServerChallenge, ClientChallenge, timestamp []byte, ServerName []byte) ([]byte, error)

ComputeResponse computes the combined NTLMv2 challenge response (low-level, explicit params). Prefer ComputeNTChallengeResponse and ComputeLMChallengeResponse for new code.

Parameters:

• ResponseKeyNT: the 16-byte ResponseKeyNT (NTOWFv2 result)
• ResponseKeyLM: the 16-byte ResponseKeyLM (same as ResponseKeyNT for NTLMv2)
• ServerChallenge: the 8-byte server challenge
• ClientChallenge: the 8-byte client challenge
• timestamp: the 8-byte Windows FILETIME timestamp
• ServerName: the raw TargetInfo bytes for the blob

Returns:

• NTChallengeResponse || LmChallengeResponse concatenated

func (*NTLMv2Ctx) ComputeSessionBaseKey

func (ntlm *NTLMv2Ctx) ComputeSessionBaseKey(ntProofStr []byte) []byte

ComputeSessionBaseKey derives the SessionBaseKey from the NTProofStr.

SessionBaseKey = HMAC-MD5(ResponseKeyNT, NTProofStr)

This key is RC4-encrypted with a random session key when KEY_EXCH is negotiated.

Parameters:

• ntProofStr: the 16-byte NTProofStr returned by ComputeNTChallengeResponse

type NTLMv2Response

type NTLMv2Response struct {
    Username string // Username for authentication
    Domain   string // Domain name

    ServerChallenge     [8]byte  // 8-byte challenge from server
    LmChallengeResponse [24]byte // 24-byte LM challenge response
    NtChallengeResponse [24]byte // 24-byte NT challenge response
}

func NewNTLMv2Response

func NewNTLMv2Response(username, domain string, serverChallenge [8]byte, lmChallengeResponse [24]byte, ntChallengeResponse [24]byte) *NTLMv2Response

NewNTLMv2Response creates a new NTLMv2 response

Parameters:

• username: The username
• domain: The domain name
• serverChallenge: The 8-byte server challenge
• lmChallengeResponse: The 24-byte LM challenge response

func (*NTLMv2Response) HashcatString

func (r *NTLMv2Response) HashcatString() (string, error)

HashcatString converts the NTLMv2 response to a Hashcat string

Returns:

• The Hashcat string
• An error if the conversion fails

func (*NTLMv2Response) String

func (r *NTLMv2Response) String() string

String returns the NTLMv2 response as a string

Returns:

• The NTLMv2 response as a string
• An error if the conversion fails