targetinfo

import "github.com/TheManticoreProject/Manticore/crypto/spnego/ntlm/targetinfo"

Index

• Constants
• func Build(pairs []avpair.AvPair) ([]byte, error)
• func BuildBlobTargetInfo(targetInfo []byte) []byte
• func BuildServerTargetInfo(netBIOSComputerName, netBIOSDomainName, dnsComputerName, dnsDomainName string, timestamp []byte) ([]byte, error)
• func GetTimestamp(targetInfo []byte) []byte
• func HasTimestamp(targetInfo []byte) bool
• func ParseTargetInfo(targetInfo []byte) (map[avpair.AvId][]byte, error)

Constants

MaxTargetInfoLength is the largest TargetInfo that can be advertised. The CHALLENGE_MESSAGE carries its length in a 16-bit field, so a longer list cannot be described on the wire.

const MaxTargetInfoLength = 0xFFFF

func Build

func Build(pairs []avpair.AvPair) ([]byte, error)

Build marshals an AV_PAIR list into the TargetInfo form a CHALLENGE_MESSAGE carries, appending the MsvAvEOL terminator that ends the list.

This package could previously only parse TargetInfo. An acceptor has to compose one: the pairs it advertises are what the client folds into its NTLMv2 blob, so they end up covered by the NTProofStr and cannot be added after the fact.

Each pair’s AvLen is taken from its value rather than from the AvLen field, so a caller cannot produce a list whose declared lengths disagree with its contents. A caller-supplied MsvAvEOL is ignored, since the terminator is appended here.

Parameters:

• pairs: the AV_PAIRs to advertise, in order

Returns:

• The marshalled TargetInfo, EOL-terminated
• An error if the list cannot be described on the wire

func BuildBlobTargetInfo

func BuildBlobTargetInfo(targetInfo []byte) []byte

BuildBlobTargetInfo constructs the modified TargetInfo to embed in the NTLMv2 blob.

It copies all AVPairs from the challenge TargetInfo and, when a DNS computer name (MsvAvDnsComputerName) is present, inserts an MsvAvTargetName AVPair set to the SMB service principal name “cifs/<DnsComputerName>” before the EOL marker. This mirrors what the Windows client sends; modern Windows servers require the SPN in the AUTHENTICATE’s NTLMv2 AVPairs and reject the authentication (STATUS_INVALID_PARAMETER) when it is absent.

func BuildServerTargetInfo

func BuildServerTargetInfo(netBIOSComputerName, netBIOSDomainName, dnsComputerName, dnsDomainName string, timestamp []byte) ([]byte, error)

BuildServerTargetInfo composes the TargetInfo an acceptor advertises: the NetBIOS and DNS computer and domain names, and a timestamp.

The names are encoded UTF-16LE, which is how they appear on the wire. A name left empty is omitted rather than advertised as a zero-length pair. The timestamp is included only when non-empty; when it is present a client is required to carry a MIC in its AUTHENTICATE ([MS-NLMP] 3.1.5.1.2), so an acceptor that supplies one must be prepared to verify it.

Parameters:

• netBIOSComputerName: the server’s NetBIOS computer name
• netBIOSDomainName: the server’s NetBIOS domain name
• dnsComputerName: the server’s fully qualified computer name
• dnsDomainName: the server’s fully qualified domain name
• timestamp: an 8-byte Windows FILETIME, or nil to omit it

Returns:

• The marshalled TargetInfo, EOL-terminated
• An error if the list cannot be described on the wire

func GetTimestamp

func GetTimestamp(targetInfo []byte) []byte

GetTimestamp returns the raw 8-byte Windows FILETIME from TargetInfo, or nil if absent.

func HasTimestamp

func HasTimestamp(targetInfo []byte) bool

HasTimestamp reports whether MsvAvTimestamp is present in the TargetInfo.

func ParseTargetInfo

func ParseTargetInfo(targetInfo []byte) (map[avpair.AvId][]byte, error)

ParseTargetInfo parses the target info from a challenge message