challenge

import "github.com/TheManticoreProject/Manticore/crypto/spnego/ntlm/message/challenge"

Index

func NewServerChallenge() ([8]byte, error)
type ChallengeMessage
type TargetType

func NewServerChallenge

func NewServerChallenge() ([8]byte, error)

NewServerChallenge returns a fresh 8-byte challenge from the system’s cryptographic random source.

The challenge is the only thing standing between a captured response and an offline replay, so it must be unpredictable and must not be reused across exchanges.

Returns:

The challenge
An error if the random source fails

type ChallengeMessage

ChallengeMessage is the second message in NTLM authentication Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/801a4681-8809-4be9-ab0d-61dcfe762786

type ChallengeMessage struct {
    header.Header

    // TargetNameFields (8 bytes): A field containing TargetName information.
    TargetNameFields datafields.DataFields

    // NegotiateFlags (4 bytes): A NEGOTIATE structure that contains a set of flags, as defined by section 2.2.2.5. The server sets flags to indicate options it supports or, if there has been a NEGOTIATE_MESSAGE (section 2.2.1.1), the choices it has made from the options offered by the client. If the client has set the NTLMSSP_NEGOTIATE_SIGN in the NEGOTIATE_MESSAGE the Server MUST return it.
    NegotiateFlags flags.NegotiateFlags

    // ServerChallenge (8 bytes): A 64-bit value that contains the NTLM challenge. The challenge is a 64-bit nonce. The processing of the ServerChallenge is specified in sections 3.1.5 and 3.2.5.
    ServerChallenge [8]byte

    // Reserved (8 bytes): An 8-byte array whose elements MUST be zero when sent and MUST be ignored on receipt.
    Reserved [8]byte

    // TargetInfoFields (8 bytes): A field containing TargetInfo information.
    TargetInfoFields datafields.DataFields

    // Version (8 bytes): A VERSION structure that contains version information.
    Version *version.Version

    // TargetName (variable): A field containing TargetName data.
    TargetName []byte

    // TargetInfo (variable): A field containing TargetInfo data.
    TargetInfo []byte
}

func CreateChallengeMessage

func CreateChallengeMessage(neg *negotiate.NegotiateMessage, serverChallenge [8]byte, targetName string, targetType TargetType, targetInfo []byte, v *version.Version) (*ChallengeMessage, error)

CreateChallengeMessage builds the CHALLENGE_MESSAGE answering a client’s NEGOTIATE_MESSAGE, the acceptor-side counterpart of CreateNegotiateMessage.

The negotiated flags are the intersection of what the client offered with what this implementation supports, with three adjustments the specification requires of an acceptor:

Unicode wins over OEM when the client offered both, because every string in the exchange is then UTF-16LE and mixing the two is what produces an identity that fails to verify.
REQUEST_TARGET and NEGOTIATE_TARGET_INFO are asserted whenever a TargetName or TargetInfo is supplied. A Windows client abandons the exchange when it receives TargetInfo that the flags do not announce.
NEGOTIATE_VERSION is asserted only when a Version is supplied, since the field is otherwise required to be zero.

Parameters:

neg: the client’s NEGOTIATE_MESSAGE
serverChallenge: the 8-byte challenge to issue
targetName: the name to advertise, or "" to omit it
targetType: which target-type bit to assert
targetInfo: the AV_PAIR list to advertise, or nil to omit it
v: the version to advertise, or nil to omit it

Returns:

The CHALLENGE_MESSAGE
An error if the client’s offer cannot be answered

func (*ChallengeMessage) GetMessageType

func (msg *ChallengeMessage) GetMessageType() uint32

GetMessageType returns the message type of the ChallengeMessage

func (*ChallengeMessage) Marshal

func (msg *ChallengeMessage) Marshal() ([]byte, error)

Marshal serializes the ChallengeMessage into a byte slice

func (*ChallengeMessage) Unmarshal

func (msg *ChallengeMessage) Unmarshal(data []byte) (int, error)

Unmarshal deserializes the ChallengeMessage from a byte slice

type TargetType

TargetType selects which target-type bit the CHALLENGE asserts, describing what the TargetName names.

type TargetType int

const (
    // TargetTypeDomain declares the TargetName to be a domain name.
    TargetTypeDomain TargetType = iota
    // TargetTypeServer declares the TargetName to be a server name.
    TargetTypeServer
    // TargetTypeNone asserts neither bit.
    TargetTypeNone
)