The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

crypto

import "github.com/TheManticoreProject/Manticore/windows/protocols/ms-nrpc/crypto"

Package crypto implements the Netlogon secure-channel cryptographic primitives ([MS-NRPC] 3.1.4.3/3.1.4.4/3.1.4.5): session-key derivation, credential computation, and client authenticator computation, for both the AES and the legacy (strong-key/DES) cipher suites. It depends only on the NDR wire structures in the parent package, never on the RPC opnums, so it stays reusable and free of import cycles.

Index

func AddToCredential

func AddToCredential(cred msnrpc.NETLOGON_CREDENTIAL, delta uint32) msnrpc.NETLOGON_CREDENTIAL

AddToCredential adds delta to a credential ([MS-NRPC] 3.1.4.5): the least-significant 4 octets are treated as a little-endian 32-bit integer and delta is added with overflow ignored; the most-significant 4 octets are left unchanged. This is the arithmetic used to advance the stored credential by a timestamp or by the constant 1.

func ComputeNetlogonAuthenticator

func ComputeNetlogonAuthenticator(storedCredential msnrpc.NETLOGON_CREDENTIAL, timestamp uint32, sessionKey [16]byte) msnrpc.NETLOGON_AUTHENTICATOR

ComputeNetlogonAuthenticator computes a client Netlogon authenticator ([MS-NRPC] 3.1.4.5) for the legacy (non-AES) cipher suite: identical arithmetic to ComputeNetlogonAuthenticatorAES but using the DES-based ComputeNetlogonCredential.

func ComputeNetlogonAuthenticatorAES

func ComputeNetlogonAuthenticatorAES(storedCredential msnrpc.NETLOGON_CREDENTIAL, timestamp uint32, sessionKey [16]byte) msnrpc.NETLOGON_AUTHENTICATOR

ComputeNetlogonAuthenticatorAES computes a client Netlogon authenticator ([MS-NRPC] 3.1.4.5) for the AES cipher suite: it adds timestamp to the stored credential (low 32 bits, overflow ignored) and encrypts the sum with the session key (ComputeNetlogonCredentialAES). This is a pure function — it does not advance the caller’s stored credential; a caller that maintains a rolling secure channel should use SecureChannel, which applies the stored-credential updates the protocol requires.

Parameters:

  • storedCredential: The current stored client credential.
  • timestamp: The authenticator timestamp (seconds since 1970-01-01 UTC).
  • sessionKey: The 16-byte AES session key.

Returns:

  • The NETLOGON_AUTHENTICATOR to send with the request.

func ComputeNetlogonCredential

func ComputeNetlogonCredential(input msnrpc.NETLOGON_CREDENTIAL, sessionKey [16]byte) msnrpc.NETLOGON_CREDENTIAL

ComputeNetlogonCredential computes a Netlogon credential for the legacy (non-AES) cipher suite ([MS-NRPC] 3.1.4.4.2): the 8-byte input is encrypted with two DES-ECB passes whose keys are the first and second 7 octets of the session key, each expanded by transformKey. It is used by both the strong-key (RC4) and DES paths, in place of ComputeNetlogonCredentialAES.

func ComputeNetlogonCredentialAES

func ComputeNetlogonCredentialAES(challenge msnrpc.NETLOGON_CREDENTIAL, sessionKey [16]byte) msnrpc.NETLOGON_CREDENTIAL

ComputeNetlogonCredentialAES computes a Netlogon credential ([MS-NRPC] 3.1.4.4.1) by encrypting an 8-byte challenge with AES-128 in 8-bit cipher feedback (CFB8) mode under the session key and an all-zero IV.

Parameters:

  • challenge: The 8-byte input challenge.
  • sessionKey: The 16-byte AES session key.

Returns:

  • The 8-byte Netlogon credential.

func ComputeSessionKeyAES

func ComputeSessionKeyAES(password string, ntHash []byte, clientChallenge, serverChallenge msnrpc.NETLOGON_CREDENTIAL) [16]byte

ComputeSessionKeyAES derives the AES Netlogon session key ([MS-NRPC] 3.1.4.4.1). The key material is the account’s NT one-way function (NTOWFv1 = MD4(UTF16-LE(password))); the session key is the first 16 octets of HMAC-SHA256(NTOWFv1, ClientChallenge || ServerChallenge).

Exactly one of password or ntHash supplies the key material: when ntHash is non-nil it is used directly (the raw 16-byte NT hash, e.g. for pass-the-hash), otherwise it is derived from password.

Parameters:

  • password: The account cleartext password, or "" when ntHash is used.
  • ntHash: The raw 16-byte NT hash, or nil when password is used.
  • clientChallenge: The client challenge.
  • serverChallenge: The server challenge.

Returns:

  • The 16-byte AES session key.

func ComputeSessionKeyStrongKey

func ComputeSessionKeyStrongKey(password string, ntHash []byte, clientChallenge, serverChallenge msnrpc.NETLOGON_CREDENTIAL) [16]byte

ComputeSessionKeyStrongKey derives the legacy “strong-key” Netlogon session key ([MS-NRPC] 3.1.4.3.1, the non-AES branch), used when AES is not negotiated but strong keys are. It is HMAC-MD5(NTOWFv1, MD5(0x00000000 || ClientChallenge || ServerChallenge)); the 16-byte HMAC-MD5 output is the session key. Exactly one of password or ntHash supplies the key material (see ComputeSessionKeyAES).