authenticate

import "github.com/TheManticoreProject/Manticore/crypto/spnego/ntlm/message/authenticate"

const MICLength = 16

type AuthenticateMessage struct {
    header.Header

    // LmChallengeResponseFields (8 bytes): A field containing LmChallengeResponse information.
    LmChallengeResponseFields datafields.DataFields

    // NtChallengeResponseFields (8 bytes): A field containing NtChallengeResponse information.
    NtChallengeResponseFields datafields.DataFields

    // DomainNameFields (8 bytes): A field containing DomainName information.
    DomainNameFields datafields.DataFields

    // UserNameFields (8 bytes): A field containing UserName information.
    UserNameFields datafields.DataFields

    // WorkstationFields (8 bytes): A field containing Workstation information.
    WorkstationFields datafields.DataFields

    // EncryptedRandomSessionKeyFields (8 bytes): A field containing EncryptedRandomSessionKey information.
    EncryptedRandomSessionKeyFields datafields.DataFields

    // NegotiateFlags (4 bytes): In connectionless mode, a NEGOTIATE structure that contains a set of flags (section 2.2.2.5) and represents the conclusion of negotiation—the choices the client has made from the options the server offered in the CHALLENGE_MESSAGE. In connection-oriented mode, a NEGOTIATE structure (section 2.2.2.5) that contains the set of bit flags negotiated in the previous messages.
    NegotiateFlags flags.NegotiateFlags

    // Version (8 bytes): A VERSION structure (section 2.2.2.10) that SHOULD be populated only when the NTLMSSP_NEGOTIATE_VERSION flag is set in the NegotiateFlags field; otherwise, it MUST be set to all zero. This structure is used for debugging purposes only. In normal protocol messages, it is ignored and does not affect the NTLM message processing.
    Version *version.Version

    // MIC (16 bytes): The message integrity for the NTLM NEGOTIATE_MESSAGE, CHALLENGE_MESSAGE, and AUTHENTICATE_MESSAGE.
    MIC [16]byte

    // NeedsMIC indicates that the server's CHALLENGE carried an MsvAvTimestamp, so
    // the client MUST provide a MIC (MS-NLMP 3.1.5.1.2). When set, the AV_PAIRs in
    // the NtChallengeResponse also carry MsvAvFlags with the MIC-present bit.
    NeedsMIC bool

    // MICOffset is the byte offset the MIC was read from, set by Unmarshal when a
    // MIC was present. A verifier needs it to zero the field in the bytes as
    // received: re-marshalling to recompute the digest would only reproduce the
    // original if this implementation encodes the message identically to whoever
    // sent it, which is not something a verifier can assume.
    MICOffset int

    // LmChallengeResponse (16 bytes): A payload containing LmChallengeResponse data.
    LmChallengeResponse []byte

    // NtChallengeResponse (16 bytes): A field containing NtChallengeResponse data.
    NtChallengeResponse []byte

    // DomainName (variable): A field containing DomainName data.
    DomainName []byte

    // UserName (variable): A field containing UserName data.
    UserName []byte

    // Workstation (variable): A field containing Workstation data.
    Workstation []byte

    // EncryptedRandomSessionKey (variable): A field containing EncryptedRandomSessionKey data.
    EncryptedRandomSessionKey []byte

    // SessionKey (16 bytes): The exported session key derived during authentication.
    // This is not transmitted on the wire; it is retained so callers (e.g. SMB message
    // signing) can use it as the MAC key. When no key exchange is negotiated it equals
    // the NTLMv2 SessionBaseKey. It is nil for the NTLMv1 path.
    SessionKey []byte
}

func CreateAuthenticateMessage(challenge *challenge.ChallengeMessage, username, password, domain, workstation string) (*AuthenticateMessage, error)

func CreateAuthenticateMessageWithNTHash(challenge *challenge.ChallengeMessage, username string, ntHash [16]byte, domain, workstation string) (*AuthenticateMessage, error)

func (msg *AuthenticateMessage) ComputeMIC(negotiateMessage, challengeMessage []byte) error

func (msg *AuthenticateMessage) GetMessageType() uint32

func (msg *AuthenticateMessage) Marshal() ([]byte, error)

func (msg *AuthenticateMessage) Unmarshal(data []byte) (int, error)

func (msg *AuthenticateMessage) VerifyMIC(exportedSessionKey, negotiateMessage, challengeMessage, rawAuthenticate []byte) bool