The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.5 • 201 packages. View on pkg.go.dev

keycredentiallink

import "github.com/TheManticoreProject/Manticore/windows/keycredentiallink"

Index

func ComposeKeyCredentialLinkForComputer

func ComposeKeyCredentialLinkForComputer(obj string, keyValue []byte) (*ldap.DNWithBinary, error)

ComposeKeyCredentialLinkForComputer builds a DN-Binary for msDS-KeyCredentialLink following the algorithm described in: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f81a5aa6-6cc1-4320-9eb4-1443ad8f4b7c

Parameters: - obj: Distinguished Name of the directory object (computer) - keyValue: the key material bytes (CNG key blob) to embed

Returns: - ldap.DNWithBinary containing DN and composed KEYCREDENTIALLINK_BLOB - error if composition fails

KEYCREDENTIALLINK_BLOB represents a key credential link blob structure used for authentication and authorization.

The KEYCREDENTIALLINK_BLOB structure is a representation of a single credential stored as a series of values. This structure is stored as the binary portion of the msDS-KeyCredentialLink DN-Binary attribute (section 3.1.1.5.3.1.1.6). The structure contains a Version field followed by an array of KEYCREDENTIALLINK_ENTRY structures (section 2.2.20.3). The KEYCREDENTIALLINK_ENTRY structure MUST be sorted by their Identifier fields in increasing order.

All keys MUST contain KeyID, KeyMaterial, and KeyUsage entries. Keys SHOULD contain KeyHash,KeyApproximateLastLogonTimeStamp, and KeyCreationTime entries.

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f3f01e95-6d0c-4fe6-8b43-d585167658fa

type KEYCREDENTIALLINK_BLOB struct {
    // A KeyCredentialLinkVersion object representing the version of the key credential.
    Version version.KeyCredentialLinkVersion
    // A byte slice containing the entries of the key credential link blob.
    Entries []KEYCREDENTIALLINK_ENTRY
}

func NewKEYCREDENTIALLINK_BLOB(version version.KeyCredentialLinkVersion, entries []KEYCREDENTIALLINK_ENTRY) *KEYCREDENTIALLINK_BLOB

NewKEYCREDENTIALLINK_BLOB creates a new KEYCREDENTIALLINK_BLOB structure.

Parameters: - version: A KeyCredentialLinkVersion object representing the version of the key credential. - entries: A slice of KEYCREDENTIALLINK_ENTRY objects representing the entries of the key credential link blob.

Returns: - A pointer to a KEYCREDENTIALLINK_BLOB object.

func (k *KEYCREDENTIALLINK_BLOB) Describe(indent int)

Describe prints the KEYCREDENTIALLINK_BLOB structure to the console.

Parameters: - indent: The number of spaces to indent the output.

func (k *KEYCREDENTIALLINK_BLOB) Marshal() ([]byte, error)

Marshal marshals the KEYCREDENTIALLINK_BLOB structure to a byte slice.

Parameters: - None

Returns: - A byte slice containing the marshalled KEYCREDENTIALLINK_BLOB structure.

func (b *KEYCREDENTIALLINK_BLOB) RemoveEntryByType(entryType KEYCREDENTIALLINK_ENTRY_IDENTIFIER)

func (k *KEYCREDENTIALLINK_BLOB) SortEntriesByType()

SortEntriesByType sorts the KEYCREDENTIALLINK_BLOB entries in ascending order by their Identifier.Value.

Parameters: - None

Returns: - None

Note: The function sorts the entries by their Identifier.Value in ascending order.

func (k *KEYCREDENTIALLINK_BLOB) String() string

String returns a string representation of the KEYCREDENTIALLINK_BLOB structure.

Parameters: - None

Returns: - A string representation of the KEYCREDENTIALLINK_BLOB structure.

func (k *KEYCREDENTIALLINK_BLOB) Unmarshal(data []byte) (int, error)

Unmarshal unmarshals the KEYCREDENTIALLINK_BLOB structure from a byte slice.

Parameters: - data: A byte slice containing the data of the key credential link blob.

Returns: - An error if the unmarshalling fails, otherwise nil.

type KEYCREDENTIALLINK\_ENTRY

2.2.20.3 KEYCREDENTIALLINK_ENTRY

The KEYCREDENTIALLINK_ENTRY structure describes various aspects of a single credential.

Fields: - EntryType: A KeyCredentialEntryType object representing the type of the entry. - Data: A byte slice containing the data of the entry.

Methods: - Unmarshal: Unmarshals the entry from a byte slice. - Marshal: Marshals the entry to a byte slice. - String: Returns a string representation of the entry.

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7dd677bd-9315-403c-8104-b6270350139e

type KEYCREDENTIALLINK_ENTRY struct {
    // A 16-bit unsigned integer that specifies the length of the Value field.
    Length uint16
    // An 8-bit unsigned integer that specifies the type of data that is stored in the Value field.
    Identifier KEYCREDENTIALLINK_ENTRY_IDENTIFIER
    // A series of bytes whose size and meaning are defined by the Identifier field.
    Value []byte
}

func (e *KEYCREDENTIALLINK_ENTRY) Describe(indent int)

Describe prints the KEYCREDENTIALLINK_ENTRY structure to the console.

Parameters: - indent: The number of spaces to indent the output.

func (e *KEYCREDENTIALLINK_ENTRY) Marshal() ([]byte, error)

Marshal marshals the entry to a byte slice.

Parameters: - None

Returns: - A byte slice containing the marshalled entry.

func (e *KEYCREDENTIALLINK_ENTRY) String() string

String returns a string representation of the entry.

Parameters: - None

Returns: - A string representation of the entry.

func (e *KEYCREDENTIALLINK_ENTRY) Unmarshal(data []byte) (int, error)

Unmarshal unmarshals the entry from a byte slice.

Parameters: - data: A byte slice containing the data of the entry.

Returns: - An error if the unmarshalling fails, otherwise nil.

type KEYCREDENTIALLINK\_ENTRY\_IDENTIFIER

Key Credential Link Entry Identifier

Describes the data stored in the Value field. https://msdn.microsoft.com/en-us/library/mt220499.aspx

type KEYCREDENTIALLINK_ENTRY_IDENTIFIER uint8

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/a99409ea-4982-4f72-b7ef-8596013a36c7

const (
    // A SHA256 hash of the Value field of the KeyMaterial entry.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyID KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x01

    // A SHA256 hash of all entries following this entry.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyHash KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x02

    // Key material of the credential.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyMaterial KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x03

    // Key Usage
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyUsage KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x04

    // Key Source
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeySource KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x05

    // Device Identifier
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_DeviceId KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x06

    // Custom key information.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_CustomKeyInformation KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x07

    // The approximate time this key was last used, in FILETIME format.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyApproximateLastLogonTimeStamp KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x08

    // The approximate time this key was created, in FILETIME format.
    KEYCREDENTIALLINK_ENTRY_IDENTIFIER_KeyCreationTime KEYCREDENTIALLINK_ENTRY_IDENTIFIER = 0x09
)

func (*KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Equal

func (k *KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Equal(other *KEYCREDENTIALLINK_ENTRY_IDENTIFIER) bool

Equal checks if two KEYCREDENTIALLINK_ENTRY_IDENTIFIER structures are equal.

Parameters: - other: A KEYCREDENTIALLINK_ENTRY_IDENTIFIER structure to compare to.

Returns: - True if the two KEYCREDENTIALLINK_ENTRY_IDENTIFIER structures are equal, false otherwise.

func (*KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Marshal

func (k *KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Marshal() ([]byte, error)

Marshal returns the raw bytes of the KEYCREDENTIALLINK_ENTRY_IDENTIFIER structure.

Returns: - A byte slice representing the raw bytes of the KEYCREDENTIALLINK_ENTRY_IDENTIFIER structure.

func (*KEYCREDENTIALLINK_ENTRY_IDENTIFIER) String

func (k *KEYCREDENTIALLINK_ENTRY_IDENTIFIER) String() string

String returns a string representation of the KEYCREDENTIALLINK_ENTRY_IDENTIFIER.

Returns: - A string representing the KEYCREDENTIALLINK_ENTRY_IDENTIFIER.

func (*KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Unmarshal

func (k *KEYCREDENTIALLINK_ENTRY_IDENTIFIER) Unmarshal(data []byte) (int, error)

Unmarshal parses the provided byte slice into the KEYCREDENTIALLINK_ENTRY_IDENTIFIER structure.

Parameters: - data: A byte slice containing the raw key credential entry type to be parsed.

Returns: - The number of bytes read from the data.

KeyCredentialLink represents a key credential structure used for authentication and authorization.

Fields: - Version: A KeyCredentialLinkVersion object representing the version of the key credential. - Identifier: A string representing the unique identifier of the key credential. - KeyHash: A byte slice containing the hash of the key material. - KeyMaterial: A KeyMaterial object representing the key material of the key credential. - Usage: A KeyUsage object representing the usage of the key credential. - LegacyUsage: A string representing the legacy usage of the key credential. - Source: A KeySource object representing the source of the key credential. - LastLogonTime: A DateTime object representing the last logon time associated with the key credential. - CreationTime: A DateTime object representing the creation time of the key credential.

Methods: - ParseDNWithBinary: Parses the provided DNWithBinary object into the KeyCredentialLink structure.

Note: The KeyCredentialLink structure is used to store and manage key credentials, which are used for authentication and authorization purposes. The structure includes fields for version, identifier, key hash, raw key material, usage, legacy usage, source, last logon time, creation time, owner, and raw binary data. The ParseDNWithBinary method is used to parse a DNWithBinary object and populate the fields of the KeyCredentialLink structure.

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f3f01e95-6d0c-4fe6-8b43-d585167658fa

type KeyCredentialLink struct {
    // A KeyCredentialLinkVersion object representing the version of the key credential.
    // This field is MANDATORY.
    Version version.KeyCredentialLinkVersion
    // A string representing the unique identifier of the key credential.
    // This field is MANDATORY.
    Identifier string
    // A byte slice containing the hash of the key material.
    // This field is OPTIONAL.
    KeyHash []byte
    // A KeyMaterial object representing the key material of the key credential.
    // This field is MANDATORY.
    KeyMaterial bcrypt.KeyMaterial
    // A KeyUsage object representing the usage of the key credential.
    // This field is MANDATORY.
    Usage usage.KeyUsage
    // A string representing the legacy usage of the key credential.
    // This field is OPTIONAL.
    LegacyUsage string
    // A KeySource object representing the source of the key credential.
    // This field is OPTIONAL.
    Source *source.KeySource
    // A CustomKeyInformation object representing the custom key information of the key credential.
    // This field is OPTIONAL.
    CustomKeyInfo *customkeyinformation.CustomKeyInformation
    // A GUID object representing the device ID of the key credential.
    // This field is OPTIONAL.
    DeviceId *guid.GUID
    // A DateTime object representing the last logon time associated with the key credential.
    // This field is OPTIONAL.
    LastLogonTime *utils.DateTime
    // A DateTime object representing the creation time of the key credential.
    // This field is OPTIONAL.
    CreationTime *utils.DateTime
}

func NewKeyCredentialLink(version version.KeyCredentialLinkVersion, identifier string, keyMaterial bcrypt.KeyMaterial, deviceId *guid.GUID, lastLogonTime *utils.DateTime, creationTime *utils.DateTime) *KeyCredentialLink

NewKeyCredentialLink creates a new KeyCredentialLink structure.

Parameters:

- version: A KeyCredentialLinkVersion object representing the version of the key credential.

- Identifier: A string representing the unique identifier of the key credential.

- KeyHash: A byte slice containing the hash of the key material.

- KeyMaterial: An RSAKeyMaterial object representing the raw RSA key material.

- Usage: A KeyUsage object representing the usage of the key credential.

- LegacyUsage: A string representing the legacy usage of the key credential.

- Source: A KeySource object representing the source of the key credential.

- CustomKeyInfo: A CustomKeyInformation object representing the custom key information of the key credential.

- DeviceId: A GUID object representing the device ID of the key credential.

- LastLogonTime: A DateTime object representing the last logon time associated with the key credential.

- CreationTime: A DateTime object representing the creation time of the key credential.

Returns:

- A pointer to a KeyCredentialLink object.

func (*KeyCredentialLink) CheckIntegrity

func (kc *KeyCredentialLink) CheckIntegrity() bool

CheckIntegrity checks the integrity of the key credential.

Returns: - A boolean value indicating the integrity of the key credential.

func (*KeyCredentialLink) ComputeKeyHash

func (kc *KeyCredentialLink) ComputeKeyHash() []byte

ComputeKeyHash computes the key hash of the key credential.

Returns: - A byte slice containing the key hash.

func (*KeyCredentialLink) Describe

func (kc *KeyCredentialLink) Describe(indent int)

Describe prints a detailed description of the KeyCredentialLink structure.

Parameters: - indent: An integer value specifying the indentation level for the output.

func (*KeyCredentialLink) Marshal

func (kc *KeyCredentialLink) Marshal() ([]byte, error)

Marshal returns the raw bytes of the KeyCredentialLink structure.

Returns: - A byte slice representing the raw bytes of the KeyCredentialLink structure. - An error if the conversion fails.

func (*KeyCredentialLink) ParseDNWithBinary

func (kc *KeyCredentialLink) ParseDNWithBinary(dnWithBinary ldap.DNWithBinary) error

ParseDNWithBinary parses the provided DNWithBinary object into the KeyCredentialLink structure.

Parameters: - dnWithBinary: A DNWithBinary object containing the distinguished name and binary data to be parsed.

Returns: - An error if the parsing fails, otherwise nil.

Note: The function performs the following steps: 1. Sets the RawBytes and RawBytesSize fields to the provided binary data and its length, respectively. 2. Sets the Owner field to the distinguished name from the DNWithBinary object. 3. Parses the version information from the binary data and updates the RawBytesSize and remainder accordingly. 4. Iterates through the remaining binary data, parsing each entry based on its type and length. 5. Updates the corresponding fields of the KeyCredentialLink structure based on the parsed entry type and data.

The function handles various entry types, including key identifier, key hash, key material, key usage, legacy usage, key source, last logon time, and creation time. Unsupported entry types, such as device ID and custom key information, are commented out for future implementation.

func (*KeyCredentialLink) ToKeyCredentialLinkBlob

func (kc *KeyCredentialLink) ToKeyCredentialLinkBlob() (*KEYCREDENTIALLINK_BLOB, error)

ToKeyCredentialLinkBlob converts the KeyCredentialLink structure to a KEYCREDENTIALLINK_BLOB structure.

Returns: - A pointer to a KEYCREDENTIALLINK_BLOB structure. - An error if the conversion fails.

Note: The function converts the KeyCredentialLink structure to a KEYCREDENTIALLINK_BLOB structure. The function sorts the entries by their Identifier fields in increasing order. The function returns the KEYCREDENTIALLINK_BLOB structure.

func (*KeyCredentialLink) Unmarshal

func (kc *KeyCredentialLink) Unmarshal(data []byte) (int, error)

Unmarshal parses the provided binary data into the KeyCredentialLink structure.

Parameters: - data: A byte slice containing the binary data to be parsed.

Returns: - bytesRead: The number of bytes read from the data. - error: An error if the parsing fails, otherwise nil.

Note: The function performs the following steps: 1. Sets the RawBytes and RawBytesSize fields to the provided binary data and its length. 2. Parses the version information from the binary data. 3. Iterates through the remaining binary data, parsing each entry based on its type and length. 4. Updates the corresponding fields of the KeyCredentialLink structure based on the parsed entry type and data.

The function handles various entry types, including: - Key identifier - Key hash - Key material - Key usage (both V2 enum and legacy string formats) - Key source - Device ID - Custom key information - Last logon timestamp - Creation time

Subpackages

crypto

Go API reference for the crypto package of the Manticore security library.

Open

key

Packages under key in the Manticore security library.

Open

utils

Go API reference for the utils package of the Manticore security library.

Open

version

Go API reference for the version package of the Manticore security library.

Open