|
86797
|
1 ;;; ntlm.el --- NTLM (NT LanManager) authentication support
|
|
|
2
|
|
106815
|
3 ;; Copyright (C) 2001, 2007, 2008, 2009, 2010 Free Software Foundation, Inc.
|
|
86797
|
4
|
|
|
5 ;; Author: Taro Kawagishi <tarok@transpulse.org>
|
|
|
6 ;; Keywords: NTLM, SASL
|
|
|
7 ;; Version: 1.00
|
|
|
8 ;; Created: February 2001
|
|
|
9
|
|
|
10 ;; This file is part of GNU Emacs.
|
|
|
11
|
|
94677
|
12 ;; GNU Emacs is free software: you can redistribute it and/or modify
|
|
86797
|
13 ;; it under the terms of the GNU General Public License as published by
|
|
94677
|
14 ;; the Free Software Foundation, either version 3 of the License, or
|
|
|
15 ;; (at your option) any later version.
|
|
86797
|
16
|
|
|
17 ;; GNU Emacs is distributed in the hope that it will be useful,
|
|
|
18 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
19 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
20 ;; GNU General Public License for more details.
|
|
|
21
|
|
|
22 ;; You should have received a copy of the GNU General Public License
|
|
94677
|
23 ;; along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>.
|
|
86797
|
24
|
|
|
25 ;;; Commentary:
|
|
|
26
|
|
|
27 ;; This library is a direct translation of the Samba release 2.2.0
|
|
|
28 ;; implementation of Windows NT and LanManager compatible password
|
|
|
29 ;; encryption.
|
|
|
30 ;;
|
|
|
31 ;; Interface functions:
|
|
|
32 ;;
|
|
|
33 ;; ntlm-build-auth-request
|
|
|
34 ;; This will return a binary string, which should be used in the
|
|
|
35 ;; base64 encoded form and it is the caller's responsibility to encode
|
|
|
36 ;; the returned string with base64.
|
|
|
37 ;;
|
|
|
38 ;; ntlm-build-auth-response
|
|
|
39 ;; It is the caller's responsibility to pass a base64 decoded string
|
|
|
40 ;; (which will be a binary string) as the first argument and to
|
|
|
41 ;; encode the returned string with base64. The second argument user
|
|
|
42 ;; should be given in user@domain format.
|
|
|
43 ;;
|
|
|
44 ;; ntlm-get-password-hashes
|
|
|
45 ;;
|
|
|
46 ;;
|
|
|
47 ;; NTLM authentication procedure example:
|
|
|
48 ;;
|
|
|
49 ;; 1. Open a network connection to the Exchange server at the IMAP port (143)
|
|
|
50 ;; 2. Receive an opening message such as:
|
|
|
51 ;; "* OK Microsoft Exchange IMAP4rev1 server version 5.5.2653.7 (XXXX) ready"
|
|
|
52 ;; 3. Ask for IMAP server capability by sending "NNN capability"
|
|
|
53 ;; 4. Receive a capability message such as:
|
|
|
54 ;; "* CAPABILITY IMAP4 IMAP4rev1 IDLE LITERAL+ LOGIN-REFERRALS MAILBOX-REFERRALS NAMESPACE AUTH=NTLM"
|
|
|
55 ;; 5. Ask for NTLM authentication by sending a string
|
|
|
56 ;; "NNN authenticate ntlm"
|
|
|
57 ;; 6. Receive continuation acknowledgment "+"
|
|
|
58 ;; 7. Send NTLM authentication request generated by 'ntlm-build-auth-request
|
|
|
59 ;; 8. Receive NTLM challenge string following acknowledgment "+"
|
|
|
60 ;; 9. Generate response to challenge by 'ntlm-build-auth-response
|
|
|
61 ;; (here two hash function values of the user password are encrypted)
|
|
|
62 ;; 10. Receive authentication completion message such as
|
|
|
63 ;; "NNN OK AUTHENTICATE NTLM completed."
|
|
|
64
|
|
|
65 ;;; Code:
|
|
|
66
|
|
|
67 (require 'md4)
|
|
|
68
|
|
|
69 ;;;
|
|
|
70 ;;; NTLM authentication interface functions
|
|
|
71
|
|
|
72 (defun ntlm-build-auth-request (user &optional domain)
|
|
|
73 "Return the NTLM authentication request string for USER and DOMAIN.
|
|
|
74 USER is a string representing a user name to be authenticated and
|
|
|
75 DOMAIN is a NT domain. USER can include a NT domain part as in
|
|
|
76 user@domain where the string after @ is used as the domain if DOMAIN
|
|
|
77 is not given."
|
|
|
78 (interactive)
|
|
|
79 (let ((request-ident (concat "NTLMSSP" (make-string 1 0)))
|
|
|
80 (request-msgType (concat (make-string 1 1) (make-string 3 0)))
|
|
|
81 ;0x01 0x00 0x00 0x00
|
|
|
82 (request-flags (concat (make-string 1 7) (make-string 1 178)
|
|
|
83 (make-string 2 0)))
|
|
|
84 ;0x07 0xb2 0x00 0x00
|
|
|
85 lu ld off-d off-u)
|
|
|
86 (when (string-match "@" user)
|
|
|
87 (unless domain
|
|
|
88 (setq domain (substring user (1+ (match-beginning 0)))))
|
|
|
89 (setq user (substring user 0 (match-beginning 0))))
|
|
|
90 ;; set fields offsets within the request struct
|
|
|
91 (setq lu (length user))
|
|
|
92 (setq ld (length domain))
|
|
|
93 (setq off-u 32) ;offset to the string 'user
|
|
|
94 (setq off-d (+ 32 lu)) ;offset to the string 'domain
|
|
|
95 ;; pack the request struct in a string
|
|
|
96 (concat request-ident ;8 bytes
|
|
|
97 request-msgType ;4 bytes
|
|
|
98 request-flags ;4 bytes
|
|
|
99 (md4-pack-int16 lu) ;user field, count field
|
|
|
100 (md4-pack-int16 lu) ;user field, max count field
|
|
|
101 (md4-pack-int32 (cons 0 off-u)) ;user field, offset field
|
|
|
102 (md4-pack-int16 ld) ;domain field, count field
|
|
|
103 (md4-pack-int16 ld) ;domain field, max count field
|
|
|
104 (md4-pack-int32 (cons 0 off-d)) ;domain field, offset field
|
|
|
105 user ;bufer field
|
|
|
106 domain ;bufer field
|
|
|
107 )))
|
|
|
108
|
|
|
109 (eval-when-compile
|
|
|
110 (defmacro ntlm-string-as-unibyte (string)
|
|
|
111 (if (fboundp 'string-as-unibyte)
|
|
|
112 `(string-as-unibyte ,string)
|
|
|
113 string)))
|
|
|
114
|
|
|
115 (defun ntlm-build-auth-response (challenge user password-hashes)
|
|
|
116 "Return the response string to a challenge string CHALLENGE given by
|
|
|
117 the NTLM based server for the user USER and the password hash list
|
|
|
118 PASSWORD-HASHES. NTLM uses two hash values which are represented
|
|
|
119 by PASSWORD-HASHES. PASSWORD-HASHES should be a return value of
|
|
|
120 (list (ntlm-smb-passwd-hash password) (ntlm-md4hash password))"
|
|
|
121 (let* ((rchallenge (ntlm-string-as-unibyte challenge))
|
|
|
122 ;; get fields within challenge struct
|
|
|
123 ;;(ident (substring rchallenge 0 8)) ;ident, 8 bytes
|
|
|
124 ;;(msgType (substring rchallenge 8 12)) ;msgType, 4 bytes
|
|
|
125 (uDomain (substring rchallenge 12 20)) ;uDomain, 8 bytes
|
|
|
126 (flags (substring rchallenge 20 24)) ;flags, 4 bytes
|
|
|
127 (challengeData (substring rchallenge 24 32)) ;challengeData, 8 bytes
|
|
|
128 uDomain-len uDomain-offs
|
|
|
129 ;; response struct and its fields
|
|
|
130 lmRespData ;lmRespData, 24 bytes
|
|
|
131 ntRespData ;ntRespData, 24 bytes
|
|
|
132 domain ;ascii domain string
|
|
|
133 lu ld off-lm off-nt off-d off-u off-w off-s)
|
|
|
134 ;; extract domain string from challenge string
|
|
|
135 (setq uDomain-len (md4-unpack-int16 (substring uDomain 0 2)))
|
|
|
136 (setq uDomain-offs (md4-unpack-int32 (substring uDomain 4 8)))
|
|
|
137 (setq domain
|
|
|
138 (ntlm-unicode2ascii (substring challenge
|
|
|
139 (cdr uDomain-offs)
|
|
|
140 (+ (cdr uDomain-offs) uDomain-len))
|
|
|
141 (/ uDomain-len 2)))
|
|
|
142 ;; overwrite domain in case user is given in <user>@<domain> format
|
|
|
143 (when (string-match "@" user)
|
|
|
144 (setq domain (substring user (1+ (match-beginning 0))))
|
|
|
145 (setq user (substring user 0 (match-beginning 0))))
|
|
|
146
|
|
|
147 ;; generate response data
|
|
|
148 (setq lmRespData
|
|
|
149 (ntlm-smb-owf-encrypt (car password-hashes) challengeData))
|
|
|
150 (setq ntRespData
|
|
|
151 (ntlm-smb-owf-encrypt (cadr password-hashes) challengeData))
|
|
|
152
|
|
|
153 ;; get offsets to fields to pack the response struct in a string
|
|
|
154 (setq lu (length user))
|
|
|
155 (setq ld (length domain))
|
|
|
156 (setq off-lm 64) ;offset to string 'lmResponse
|
|
|
157 (setq off-nt (+ 64 24)) ;offset to string 'ntResponse
|
|
|
158 (setq off-d (+ 64 48)) ;offset to string 'uDomain
|
|
|
159 (setq off-u (+ 64 48 (* 2 ld))) ;offset to string 'uUser
|
|
|
160 (setq off-w (+ 64 48 (* 2 (+ ld lu)))) ;offset to string 'uWks
|
|
|
161 (setq off-s (+ 64 48 (* 2 (+ ld lu lu)))) ;offset to string 'sessionKey
|
|
|
162 ;; pack the response struct in a string
|
|
|
163 (concat "NTLMSSP\0" ;response ident field, 8 bytes
|
|
|
164 (md4-pack-int32 '(0 . 3)) ;response msgType field, 4 bytes
|
|
|
165
|
|
|
166 ;; lmResponse field, 8 bytes
|
|
|
167 ;;AddBytes(response,lmResponse,lmRespData,24);
|
|
|
168 (md4-pack-int16 24) ;len field
|
|
|
169 (md4-pack-int16 24) ;maxlen field
|
|
|
170 (md4-pack-int32 (cons 0 off-lm)) ;field offset
|
|
|
171
|
|
|
172 ;; ntResponse field, 8 bytes
|
|
|
173 ;;AddBytes(response,ntResponse,ntRespData,24);
|
|
|
174 (md4-pack-int16 24) ;len field
|
|
|
175 (md4-pack-int16 24) ;maxlen field
|
|
|
176 (md4-pack-int32 (cons 0 off-nt)) ;field offset
|
|
|
177
|
|
|
178 ;; uDomain field, 8 bytes
|
|
|
179 ;;AddUnicodeString(response,uDomain,domain);
|
|
|
180 ;;AddBytes(response, uDomain, udomain, 2*ld);
|
|
|
181 (md4-pack-int16 (* 2 ld)) ;len field
|
|
|
182 (md4-pack-int16 (* 2 ld)) ;maxlen field
|
|
|
183 (md4-pack-int32 (cons 0 off-d)) ;field offset
|
|
|
184
|
|
|
185 ;; uUser field, 8 bytes
|
|
|
186 ;;AddUnicodeString(response,uUser,u);
|
|
|
187 ;;AddBytes(response, uUser, uuser, 2*lu);
|
|
|
188 (md4-pack-int16 (* 2 lu)) ;len field
|
|
|
189 (md4-pack-int16 (* 2 lu)) ;maxlen field
|
|
|
190 (md4-pack-int32 (cons 0 off-u)) ;field offset
|
|
|
191
|
|
|
192 ;; uWks field, 8 bytes
|
|
|
193 ;;AddUnicodeString(response,uWks,u);
|
|
|
194 (md4-pack-int16 (* 2 lu)) ;len field
|
|
|
195 (md4-pack-int16 (* 2 lu)) ;maxlen field
|
|
|
196 (md4-pack-int32 (cons 0 off-w)) ;field offset
|
|
|
197
|
|
|
198 ;; sessionKey field, 8 bytes
|
|
|
199 ;;AddString(response,sessionKey,NULL);
|
|
|
200 (md4-pack-int16 0) ;len field
|
|
|
201 (md4-pack-int16 0) ;maxlen field
|
|
|
202 (md4-pack-int32 (cons 0 (- off-s off-lm))) ;field offset
|
|
|
203
|
|
|
204 ;; flags field, 4 bytes
|
|
|
205 flags ;
|
|
|
206
|
|
|
207 ;; buffer field
|
|
|
208 lmRespData ;lmResponse, 24 bytes
|
|
|
209 ntRespData ;ntResponse, 24 bytes
|
|
|
210 (ntlm-ascii2unicode domain ;unicode domain string, 2*ld bytes
|
|
|
211 (length domain)) ;
|
|
|
212 (ntlm-ascii2unicode user ;unicode user string, 2*lu bytes
|
|
|
213 (length user)) ;
|
|
|
214 (ntlm-ascii2unicode user ;unicode user string, 2*lu bytes
|
|
|
215 (length user)) ;
|
|
|
216 )))
|
|
|
217
|
|
|
218 (defun ntlm-get-password-hashes (password)
|
|
|
219 "Return a pair of SMB hash and NT MD4 hash of the given password PASSWORD"
|
|
|
220 (list (ntlm-smb-passwd-hash password)
|
|
|
221 (ntlm-md4hash password)))
|
|
|
222
|
|
|
223 (defun ntlm-ascii2unicode (str len)
|
|
|
224 "Convert an ASCII string into a NT Unicode string, which is
|
|
|
225 little-endian utf16."
|
|
|
226 (let ((utf (make-string (* 2 len) 0)) (i 0) val)
|
|
|
227 (while (and (< i len)
|
|
|
228 (not (zerop (setq val (aref str i)))))
|
|
|
229 (aset utf (* 2 i) val)
|
|
|
230 (aset utf (1+ (* 2 i)) 0)
|
|
|
231 (setq i (1+ i)))
|
|
|
232 utf))
|
|
|
233
|
|
|
234 (defun ntlm-unicode2ascii (str len)
|
|
|
235 "Extract 7 bits ASCII part of a little endian utf16 string STR of length LEN."
|
|
|
236 (let ((buf (make-string len 0)) (i 0) (j 0))
|
|
|
237 (while (< i len)
|
|
|
238 (aset buf i (logand (aref str j) 127)) ;(string-to-number "7f" 16)
|
|
|
239 (setq i (1+ i)
|
|
|
240 j (+ 2 j)))
|
|
|
241 buf))
|
|
|
242
|
|
|
243 (defun ntlm-smb-passwd-hash (passwd)
|
|
|
244 "Return the SMB password hash string of 16 bytes long for the given password
|
|
|
245 string PASSWD. PASSWD is truncated to 14 bytes if longer."
|
|
|
246 (let ((len (min (length passwd) 14)))
|
|
|
247 (ntlm-smb-des-e-p16
|
|
|
248 (concat (substring (upcase passwd) 0 len) ;fill top 14 bytes with passwd
|
|
|
249 (make-string (- 15 len) 0)))))
|
|
|
250
|
|
|
251 (defun ntlm-smb-owf-encrypt (passwd c8)
|
|
|
252 "Return the response string of 24 bytes long for the given password
|
|
|
253 string PASSWD based on the DES encryption. PASSWD is of at most 14
|
|
|
254 bytes long and the challenge string C8 of 8 bytes long."
|
|
|
255 (let ((len (min (length passwd) 16)) p22)
|
|
|
256 (setq p22 (concat (substring passwd 0 len) ;fill top 16 bytes with passwd
|
|
|
257 (make-string (- 22 len) 0)))
|
|
|
258 (ntlm-smb-des-e-p24 p22 c8)))
|
|
|
259
|
|
|
260 (defun ntlm-smb-des-e-p24 (p22 c8)
|
|
|
261 "Return a 24 bytes hashed string for a 21 bytes string P22 and a 8 bytes
|
|
|
262 string C8."
|
|
|
263 (concat (ntlm-smb-hash c8 p22 t) ;hash first 8 bytes of p22
|
|
|
264 (ntlm-smb-hash c8 (substring p22 7) t)
|
|
|
265 (ntlm-smb-hash c8 (substring p22 14) t)))
|
|
|
266
|
|
|
267 (defconst ntlm-smb-sp8 [75 71 83 33 64 35 36 37])
|
|
|
268
|
|
|
269 (defun ntlm-smb-des-e-p16 (p15)
|
|
|
270 "Return a 16 bytes hashed string for a 15 bytes string P15."
|
|
|
271 (concat (ntlm-smb-hash ntlm-smb-sp8 p15 t) ;hash of first 8 bytes of p15
|
|
|
272 (ntlm-smb-hash ntlm-smb-sp8 ;hash of last 8 bytes of p15
|
|
|
273 (substring p15 7) t)))
|
|
|
274
|
|
|
275 (defun ntlm-smb-hash (in key forw)
|
|
|
276 "Return the hash string of length 8 for a string IN of length 8 and
|
|
|
277 a string KEY of length 8. FORW is t or nil."
|
|
|
278 (let ((out (make-string 8 0))
|
|
|
279 outb ;string of length 64
|
|
|
280 (inb (make-string 64 0))
|
|
|
281 (keyb (make-string 64 0))
|
|
|
282 (key2 (ntlm-smb-str-to-key key))
|
|
|
283 (i 0) aa)
|
|
|
284 (while (< i 64)
|
|
|
285 (unless (zerop (logand (aref in (/ i 8)) (lsh 1 (- 7 (% i 8)))))
|
|
|
286 (aset inb i 1))
|
|
|
287 (unless (zerop (logand (aref key2 (/ i 8)) (lsh 1 (- 7 (% i 8)))))
|
|
|
288 (aset keyb i 1))
|
|
|
289 (setq i (1+ i)))
|
|
|
290 (setq outb (ntlm-smb-dohash inb keyb forw))
|
|
|
291 (setq i 0)
|
|
|
292 (while (< i 64)
|
|
|
293 (unless (zerop (aref outb i))
|
|
|
294 (setq aa (aref out (/ i 8)))
|
|
|
295 (aset out (/ i 8)
|
|
|
296 (logior aa (lsh 1 (- 7 (% i 8))))))
|
|
|
297 (setq i (1+ i)))
|
|
|
298 out))
|
|
|
299
|
|
|
300 (defun ntlm-smb-str-to-key (str)
|
|
|
301 "Return a string of length 8 for the given string STR of length 7."
|
|
|
302 (let ((key (make-string 8 0))
|
|
|
303 (i 7))
|
|
|
304 (aset key 0 (lsh (aref str 0) -1))
|
|
|
305 (aset key 1 (logior
|
|
|
306 (lsh (logand (aref str 0) 1) 6)
|
|
|
307 (lsh (aref str 1) -2)))
|
|
|
308 (aset key 2 (logior
|
|
|
309 (lsh (logand (aref str 1) 3) 5)
|
|
|
310 (lsh (aref str 2) -3)))
|
|
|
311 (aset key 3 (logior
|
|
|
312 (lsh (logand (aref str 2) 7) 4)
|
|
|
313 (lsh (aref str 3) -4)))
|
|
|
314 (aset key 4 (logior
|
|
|
315 (lsh (logand (aref str 3) 15) 3)
|
|
|
316 (lsh (aref str 4) -5)))
|
|
|
317 (aset key 5 (logior
|
|
|
318 (lsh (logand (aref str 4) 31) 2)
|
|
|
319 (lsh (aref str 5) -6)))
|
|
|
320 (aset key 6 (logior
|
|
|
321 (lsh (logand (aref str 5) 63) 1)
|
|
|
322 (lsh (aref str 6) -7)))
|
|
|
323 (aset key 7 (logand (aref str 6) 127))
|
|
|
324 (while (>= i 0)
|
|
|
325 (aset key i (lsh (aref key i) 1))
|
|
|
326 (setq i (1- i)))
|
|
|
327 key))
|
|
|
328
|
|
|
329 (defconst ntlm-smb-perm1 [57 49 41 33 25 17 9
|
|
|
330 1 58 50 42 34 26 18
|
|
|
331 10 2 59 51 43 35 27
|
|
|
332 19 11 3 60 52 44 36
|
|
|
333 63 55 47 39 31 23 15
|
|
|
334 7 62 54 46 38 30 22
|
|
|
335 14 6 61 53 45 37 29
|
|
|
336 21 13 5 28 20 12 4])
|
|
|
337
|
|
|
338 (defconst ntlm-smb-perm2 [14 17 11 24 1 5
|
|
|
339 3 28 15 6 21 10
|
|
|
340 23 19 12 4 26 8
|
|
|
341 16 7 27 20 13 2
|
|
|
342 41 52 31 37 47 55
|
|
|
343 30 40 51 45 33 48
|
|
|
344 44 49 39 56 34 53
|
|
|
345 46 42 50 36 29 32])
|
|
|
346
|
|
|
347 (defconst ntlm-smb-perm3 [58 50 42 34 26 18 10 2
|
|
|
348 60 52 44 36 28 20 12 4
|
|
|
349 62 54 46 38 30 22 14 6
|
|
|
350 64 56 48 40 32 24 16 8
|
|
|
351 57 49 41 33 25 17 9 1
|
|
|
352 59 51 43 35 27 19 11 3
|
|
|
353 61 53 45 37 29 21 13 5
|
|
|
354 63 55 47 39 31 23 15 7])
|
|
|
355
|
|
|
356 (defconst ntlm-smb-perm4 [32 1 2 3 4 5
|
|
|
357 4 5 6 7 8 9
|
|
|
358 8 9 10 11 12 13
|
|
|
359 12 13 14 15 16 17
|
|
|
360 16 17 18 19 20 21
|
|
|
361 20 21 22 23 24 25
|
|
|
362 24 25 26 27 28 29
|
|
|
363 28 29 30 31 32 1])
|
|
|
364
|
|
|
365 (defconst ntlm-smb-perm5 [16 7 20 21
|
|
|
366 29 12 28 17
|
|
|
367 1 15 23 26
|
|
|
368 5 18 31 10
|
|
|
369 2 8 24 14
|
|
|
370 32 27 3 9
|
|
|
371 19 13 30 6
|
|
|
372 22 11 4 25])
|
|
|
373
|
|
|
374 (defconst ntlm-smb-perm6 [40 8 48 16 56 24 64 32
|
|
|
375 39 7 47 15 55 23 63 31
|
|
|
376 38 6 46 14 54 22 62 30
|
|
|
377 37 5 45 13 53 21 61 29
|
|
|
378 36 4 44 12 52 20 60 28
|
|
|
379 35 3 43 11 51 19 59 27
|
|
|
380 34 2 42 10 50 18 58 26
|
|
|
381 33 1 41 9 49 17 57 25])
|
|
|
382
|
|
|
383 (defconst ntlm-smb-sc [1 1 2 2 2 2 2 2 1 2 2 2 2 2 2 1])
|
|
|
384
|
|
|
385 (defconst ntlm-smb-sbox [[[14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7]
|
|
|
386 [ 0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8]
|
|
|
387 [ 4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0]
|
|
|
388 [15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13]]
|
|
|
389 [[15 1 8 14 6 11 3 4 9 7 2 13 12 0 5 10]
|
|
|
390 [ 3 13 4 7 15 2 8 14 12 0 1 10 6 9 11 5]
|
|
|
391 [ 0 14 7 11 10 4 13 1 5 8 12 6 9 3 2 15]
|
|
|
392 [13 8 10 1 3 15 4 2 11 6 7 12 0 5 14 9]]
|
|
|
393 [[10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8]
|
|
|
394 [13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1]
|
|
|
395 [13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7]
|
|
|
396 [ 1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12]]
|
|
|
397 [[ 7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15]
|
|
|
398 [13 8 11 5 6 15 0 3 4 7 2 12 1 10 14 9]
|
|
|
399 [10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4]
|
|
|
400 [ 3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14]]
|
|
|
401 [[ 2 12 4 1 7 10 11 6 8 5 3 15 13 0 14 9]
|
|
|
402 [14 11 2 12 4 7 13 1 5 0 15 10 3 9 8 6]
|
|
|
403 [ 4 2 1 11 10 13 7 8 15 9 12 5 6 3 0 14]
|
|
|
404 [11 8 12 7 1 14 2 13 6 15 0 9 10 4 5 3]]
|
|
|
405 [[12 1 10 15 9 2 6 8 0 13 3 4 14 7 5 11]
|
|
|
406 [10 15 4 2 7 12 9 5 6 1 13 14 0 11 3 8]
|
|
|
407 [ 9 14 15 5 2 8 12 3 7 0 4 10 1 13 11 6]
|
|
|
408 [ 4 3 2 12 9 5 15 10 11 14 1 7 6 0 8 13]]
|
|
|
409 [[ 4 11 2 14 15 0 8 13 3 12 9 7 5 10 6 1]
|
|
|
410 [13 0 11 7 4 9 1 10 14 3 5 12 2 15 8 6]
|
|
|
411 [ 1 4 11 13 12 3 7 14 10 15 6 8 0 5 9 2]
|
|
|
412 [ 6 11 13 8 1 4 10 7 9 5 0 15 14 2 3 12]]
|
|
|
413 [[13 2 8 4 6 15 11 1 10 9 3 14 5 0 12 7]
|
|
|
414 [ 1 15 13 8 10 3 7 4 12 5 6 11 0 14 9 2]
|
|
|
415 [ 7 11 4 1 9 12 14 2 0 6 10 13 15 3 5 8]
|
|
|
416 [ 2 1 14 7 4 10 8 13 15 12 9 0 3 5 6 11]]])
|
|
|
417
|
|
|
418 (defsubst ntlm-string-permute (in perm n)
|
|
|
419 "Return a string of length N for a string IN and a permutation vector
|
|
|
420 PERM of size N. The length of IN should be height of PERM."
|
|
|
421 (let ((i 0) (out (make-string n 0)))
|
|
|
422 (while (< i n)
|
|
|
423 (aset out i (aref in (- (aref perm i) 1)))
|
|
|
424 (setq i (1+ i)))
|
|
|
425 out))
|
|
|
426
|
|
|
427 (defsubst ntlm-string-lshift (str count len)
|
|
|
428 "Return a string by circularly shifting a string STR by COUNT to the left.
|
|
|
429 length of STR is LEN."
|
|
|
430 (let ((c (% count len)))
|
|
|
431 (concat (substring str c len) (substring str 0 c))))
|
|
|
432
|
|
|
433 (defsubst ntlm-string-xor (in1 in2 n)
|
|
|
434 "Return exclusive-or of sequences in1 and in2"
|
|
|
435 (let ((w (make-string n 0)) (i 0))
|
|
|
436 (while (< i n)
|
|
|
437 (aset w i (logxor (aref in1 i) (aref in2 i)))
|
|
|
438 (setq i (1+ i)))
|
|
|
439 w))
|
|
|
440
|
|
|
441 (defun ntlm-smb-dohash (in key forw)
|
|
|
442 "Return the hash value for a string IN and a string KEY.
|
|
|
443 Length of IN and KEY are 64. FORW non nill means forward, nil means
|
|
|
444 backward."
|
|
|
445 (let (pk1 ;string of length 56
|
|
|
446 c ;string of length 28
|
|
|
447 d ;string of length 28
|
|
|
448 cd ;string of length 56
|
|
|
449 (ki (make-vector 16 0)) ;vector of string of length 48
|
|
|
450 pd1 ;string of length 64
|
|
|
451 l ;string of length 32
|
|
|
452 r ;string of length 32
|
|
|
453 rl ;string of length 64
|
|
|
454 (i 0) (j 0) (k 0))
|
|
|
455 (setq pk1 (ntlm-string-permute key ntlm-smb-perm1 56))
|
|
|
456 (setq c (substring pk1 0 28))
|
|
|
457 (setq d (substring pk1 28 56))
|
|
|
458
|
|
|
459 (setq i 0)
|
|
|
460 (while (< i 16)
|
|
|
461 (setq c (ntlm-string-lshift c (aref ntlm-smb-sc i) 28))
|
|
|
462 (setq d (ntlm-string-lshift d (aref ntlm-smb-sc i) 28))
|
|
|
463 (setq cd (concat (substring c 0 28) (substring d 0 28)))
|
|
|
464 (aset ki i (ntlm-string-permute cd ntlm-smb-perm2 48))
|
|
|
465 (setq i (1+ i)))
|
|
|
466
|
|
|
467 (setq pd1 (ntlm-string-permute in ntlm-smb-perm3 64))
|
|
|
468
|
|
|
469 (setq l (substring pd1 0 32))
|
|
|
470 (setq r (substring pd1 32 64))
|
|
|
471
|
|
|
472 (setq i 0)
|
|
|
473 (let (er ;string of length 48
|
|
|
474 erk ;string of length 48
|
|
|
475 (b (make-vector 8 0)) ;vector of strings of length 6
|
|
|
476 cb ;string of length 32
|
|
|
477 pcb ;string of length 32
|
|
|
478 r2 ;string of length 32
|
|
|
479 jj m n bj sbox-jmn)
|
|
|
480 (while (< i 16)
|
|
|
481 (setq er (ntlm-string-permute r ntlm-smb-perm4 48))
|
|
|
482 (setq erk (ntlm-string-xor er
|
|
|
483 (aref ki (if forw i (- 15 i)))
|
|
|
484 48))
|
|
|
485 (setq j 0)
|
|
|
486 (while (< j 8)
|
|
|
487 (setq jj (* 6 j))
|
|
|
488 (aset b j (substring erk jj (+ jj 6)))
|
|
|
489 (setq j (1+ j)))
|
|
|
490 (setq j 0)
|
|
|
491 (while (< j 8)
|
|
|
492 (setq bj (aref b j))
|
|
|
493 (setq m (logior (lsh (aref bj 0) 1) (aref bj 5)))
|
|
|
494 (setq n (logior (lsh (aref bj 1) 3)
|
|
|
495 (lsh (aref bj 2) 2)
|
|
|
496 (lsh (aref bj 3) 1)
|
|
|
497 (aref bj 4)))
|
|
|
498 (setq k 0)
|
|
|
499 (setq sbox-jmn (aref (aref (aref ntlm-smb-sbox j) m) n))
|
|
|
500 (while (< k 4)
|
|
|
501 (aset bj k
|
|
|
502 (if (zerop (logand sbox-jmn (lsh 1 (- 3 k))))
|
|
|
503 0 1))
|
|
|
504 (setq k (1+ k)))
|
|
|
505 (setq j (1+ j)))
|
|
|
506
|
|
|
507 (setq j 0)
|
|
|
508 (setq cb nil)
|
|
|
509 (while (< j 8)
|
|
|
510 (setq cb (concat cb (substring (aref b j) 0 4)))
|
|
|
511 (setq j (1+ j)))
|
|
|
512
|
|
|
513 (setq pcb (ntlm-string-permute cb ntlm-smb-perm5 32))
|
|
|
514 (setq r2 (ntlm-string-xor l pcb 32))
|
|
|
515 (setq l r)
|
|
|
516 (setq r r2)
|
|
|
517 (setq i (1+ i))))
|
|
|
518 (setq rl (concat r l))
|
|
|
519 (ntlm-string-permute rl ntlm-smb-perm6 64)))
|
|
|
520
|
|
|
521 (defun ntlm-md4hash (passwd)
|
|
|
522 "Return the 16 bytes MD4 hash of a string PASSWD after converting it
|
|
|
523 into a Unicode string. PASSWD is truncated to 128 bytes if longer."
|
|
|
524 (let (len wpwd)
|
|
|
525 ;; Password cannot be longer than 128 characters
|
|
|
526 (setq len (length passwd))
|
|
|
527 (if (> len 128)
|
|
|
528 (setq len 128))
|
|
|
529 ;; Password must be converted to NT unicode
|
|
|
530 (setq wpwd (ntlm-ascii2unicode passwd len))
|
|
|
531 ;; Calculate length in bytes
|
|
|
532 (setq len (* len 2))
|
|
|
533 (md4 wpwd len)))
|
|
|
534
|
|
|
535 (provide 'ntlm)
|
|
|
536
|
|
93975
|
537 ;; arch-tag: 348ace18-f8e2-4176-8fe9-d9ab4e96f296
|
|
86797
|
538 ;;; ntlm.el ends here
|
