o
    jE                     @   s   d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZm Z m!Z!m"Z"m#Z# d dl$m%Z% G dd dZ&dS )    N)cast)ISC_REQ)hmac)hashlib)RC4)logger)NTLMCredential)NTLMServerInfo)NegotiateFlags)NTLMSSP_MESSAGE_SIGNATURE)NTLMSSP_MESSAGE_SIGNATURE_NOEXT)NTLMNegotiate)NTLMChallenge)NTLMAuthenticate)	netntlmv2
AVPAIRType
LMResponsenetntlmnetntlm_ess)ChannelBindingsStructc                   @   s  e Zd ZdefddZdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dAddZdAddZdAddZdd Zdd Zdd Zdd ZdBd!d"ZdCd$d%Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ ZdDd1d2ZdDd3d4Zd5d6 ZdDd7d8ZdDd9d:ZdEd;d<Zd=d> ZdFd?d@Z d S )GNTLMClientNative
credentialc                 C   s   || _ |jd ur|jntd| _d | _d | _d | _d | _d | _d | _	d | _
|jd ur.|jntd| _d | _d | _d | _d | _d | _d | _d | _d | _d| _d| _d | _|j| _d | _d S )N      r   )r   	challengeosurandomntlmNegotiatentlmChallengentlmAuthenticatentlmNegotiate_rawntlmChallenge_rawntlmAuthenticate_rawEncryptedRandomSessionKeysession_keyRandomSessionKeySessionBaseKeyKeyExchangeKeySignKey_clientSealKey_clientSignKey_serverSealKey_servercrypthandle_clientcrypthandle_server
seq_numberiteration_cntntlm_credentials	timestamp
extra_info)selfr    r4   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/client/native.py__init__   s.   
zNTLMClientNative.__init__c                 C      t d t|| _d S )NzLoading negotiate message)r   debugr   
from_bytesr   r3   datar4   r4   r5   load_negotiate9      
zNTLMClientNative.load_negotiatec                 C   r7   )NzLoading challenge message)r   r8   r   r9   r   r:   r4   r4   r5   load_challenge=   r=   zNTLMClientNative.load_challengec                 C   r7   )NzLoading authenticate message)r   r8   r   r9   r   r:   r4   r4   r5   load_authenticateA   r=   z"NTLMClientNative.load_authenticatec                 C   s   t d || _| d d S )NzLoading sessionkeyT)r   r8   r%   setup_cryptor:   r4   r4   r5   load_sessionkeyE   s   
z NTLMClientNative.load_sessionkeyc                 C   s   | j jS N)r   is_guestr3   r4   r4   r5   rC   J   s   zNTLMClientNative.is_guestc                 C      | j S rB   )r.   rD   r4   r4   r5   get_seq_numberM      zNTLMClientNative.get_seq_numberTc                 C   6   |dkr| j  jtjO  _d S | j  jtj M  _d S NT)r   flagsr
   NEGOTIATE_SIGNr3   tfr4   r4   r5   set_signP      zNTLMClientNative.set_signc                 C   rH   rI   )r   rJ   r
   NEGOTIATE_SEALrL   r4   r4   r5   set_sealV   rO   zNTLMClientNative.set_sealc                 C   rH   rI   )r   rJ   r
   NEGOTIATE_VERSIONrL   r4   r4   r5   set_version\   rO   zNTLMClientNative.set_versionc                 C      t j| jj v S rB   )r
   "NEGOTIATE_EXTENDED_SESSIONSECURITYr   rD   r4   r4   r5   is_extended_securityb      z%NTLMClientNative.is_extended_securityc                 C   s   t | j| _| jS rB   )r	   from_challenger   r2   rD   r4   r4   r5   get_extra_infoe   s   zNTLMClientNative.get_extra_infoc                 C   s   |   dkr`t }tj| jjv r:td|| }tj|dd}|	| ||
 d d |_||_|d7 }| S tj|dd}|	td||  |
 d d |_||_|d7 }| S td)NTz<imd5)	digestmodr      zNot implemented!)rV   r   r
   NEGOTIATE_KEY_EXCHr   structpackr   newupdatedigestChecksumSeqNum	Exceptionto_bytes)r3   handle
signingKeyseqNummessagemsgtttr4   r4   r5   MACi   s"   

zNTLMClientNative.MACc                    s"   |  | j| j|||| jj}|S )z2
		This function is to support SSPI encryption.
		)SEALr(   r)   r,   encrypt)r3   r;   sequence_nor4   r4   r5   rp      s   zNTLMClientNative.encryptinitNc           	         sL   |dd }t |dd }| j|}| | jj| j|j|}|dfS )z2
		This function is to support SSPI decryption.
		r   N)r   r9   r-   rp   rn   r*   rd   )	r3   r;   rq   	direction	auth_dataedatasrv_sigsealedMessage	signaturer4   r4   r5   decrypt   s   zNTLMClientNative.decryptFc                    sJ   |  | jj| j||}|du rt| j| _t| j| _|  jd7  _|S )zc
		Singing outgoing messages. The reset_cipher parameter is needed for calculating mechListMIC. 
		Tr\   )	rn   r,   rp   r(   r   r)   r+   r-   r.   )r3   r;   
message_nors   reset_cipherrx   r4   r4   r5   sign   s   zNTLMClientNative.signc                    s,   t |}| | jj| j|j|}||kS )z'
		Verifying incoming server message
		)r   r9   rn   r-   rp   r*   rd   )r3   r;   rx   signature_structcalc_sigr4   r4   r5   verify   s   
zNTLMClientNative.verifyc           	      C   s    ||}|  ||||}||fS )z)
		This is the official SEAL function.
		rn   )	r3   rh   
sealingKeymessageToSignmessageToEncryptri   cipher_encryptrw   rx   r4   r4   r5   ro      s   zNTLMClientNative.SEALc                 C   s   |  ||||S )z)
		This is the official SIGN function.
		r   )r3   rh   rj   ri   r   r4   r4   r5   SIGN   s   zNTLMClientNative.SIGNc                 C   s   t j| jj v pt j| jj v S rB   )r
   rK   r   rP   rD   r4   r4   r5   signing_needed   s   zNTLMClientNative.signing_neededc                 C   rT   rB   )r
   rP   r   rD   r4   r4   r5   encryption_needed   rW   z"NTLMClientNative.encryption_neededClientc                 C   s0  t j| jj v rNt j| jj v r| j}nt j| jj v r!| jd d }n| jd d }|dkr=td}||d  |	 }n+td}||d  |	 }nt j| jj v r_| jd d d }n	| jd d d }|dkrz|| _
|d uryt| j
| _n|| _|d urt| j| _|d urtd	|| f  |S )
N      r   rZ   s;   session key to client-to-server sealing key magic constant s;   session key to server-to-client sealing key magic constant    s   8zSetting %s sealkey to %s)r
   rU   r   NEGOTIATE_128r%   NEGOTIATE_56r   r`   ra   rb   r)   r   r,   r+   r-   r   r8   hex)r3   modesealkeyrZ   r4   r4   r5   calc_sealkey   s6   



zNTLMClientNative.calc_sealkeyc                 C   s   t j| jj v r/|dkrtd}|| jd  | }ntd}|| jd  | }nd }|dkrG|d urBt	d|
   || _|S |d urTt	d|
   || _|S )Nr   rZ   s;   session key to client-to-server signing key magic constant s;   session key to server-to-client signing key magic constant zSetting client signkey to %szSetting server signkey to %s)r
   rU   r   r   r`   ra   r%   rb   r   r8   r   r(   r*   )r3   r   rZ   signkeyr4   r4   r5   calc_signkey   s$   



zNTLMClientNative.calc_signkeyc                 C   rE   rB   )r%   rD   r4   r4   r5   get_session_key  rG   z NTLMClientNative.get_session_keyc                 C      |dkr| j S | jS Nr   )r)   r+   r3   r   r4   r4   r5   get_sealkey     zNTLMClientNative.get_sealkeyc                 C   r   r   )r(   r*   r   r4   r4   r5   get_signkey  r   zNTLMClientNative.get_signkeyc                 C   s   t d | jstd| _t d| j   | jjdkr;d| _d| _	t
| j	}|| j| _t d| j   n|du rZ| jj| _t
| j	}|| j| _t d| j   | d | d	 | d | d	 d S )
NzSetting up cryptor   zRandomSessionKey: %sTs                   zEncryptedRandomSessionKey: %sFr   Server)r   r8   r%   r   r   r   r   rC   r&   r'   r   rp   r#   r0   r   r   )r3   	is_remoterc4r4   r4   r5   r@     s&   






zNTLMClientNative.setup_cryptoc                 C   s   t |tdu r	|S |d u r| jjS t| jj}|tjO }|tjO }|tjO }|tj	O }|tj
O }|tjO }|tjO }|tjO }|tjO }|tjO }tj|v rU|tjO }n|tj M }tj|v rg|tjO }|S |tj M }|S rI   )
isinstancer
   r   rJ   copydeepcopyr   r]   r   rR   rU   NEGOTIATE_NTLMNEGOTIATE_LM_KEYREQUEST_TARGETNTLM_NEGOTIATE_OEMNEGOTIATE_UNICODEr   	INTEGRITYrK   CONFIDENTIALITYrP   )r3   rJ   	ntlmflagsr4   r4   r5   isc_to_ntlm_flags:  s.   












z"NTLMClientNative.isc_to_ntlm_flagsc                    s  d }zd|v rddl m} t||d }W n   Y | |}td|  | jdkr_|d ur4td|  jd7  _tj	|| j
j| j
j| j
jd| _| j | _td| j  | jd	d fS || _t|| _| j
jdkr1td
 | j
jd	krtd t }| d d|_tj	||d | j|d ur|jnd d| _td| j  | j dd fS |tj@ rtd t 	| jj!| j"| j
| _#| j#$ | _%| &  tj	|| j#j| j#j'| jj(| j|d ur|jnd d| _td| j  nt)	| jj!| j
| _#| j#j$|tj*@ |tj+@ d| _%| &  tj	|| j#j| j#j'| jj(| j|d ur#|jnd d| _td| j  n| j
jd	krjt }d|_| d | &  tj	||| j|d urU|jnd d| _td| j  | j dd fS | jj,}	|d urx||	t-j.< |d urt/ }
||
_0t12d}|3|
  |4 |	t-j5< t6j	| jj!| j"|	| j
| j7d| _#| j#$ | _%td| j%8   | &  d }tj	|| j
j9|d ur|jnd | j
j:| j#j| j#j'| jj(| j|d	| _td| j  | j | _;| j;dd fS )Ntargetr   )	UniTargetz	Flags: %sz-First call as client MUST be with empty data!r\   )
domainnameworkstationnameversionzNegotiate: %sTzNTLMv1 is used herezNTLMv1 Guest authenticationF    )lm_responsemicencrypted_sessionr   z#NTLMv1 Guest - NTLMAuthenticate: %szNTLMv1 with extended security)r   nt_responser   r   r   z4NTLMv1 with extended security - NTLMAuthenticate: %s)with_lmnon_nt_session_keyzNTLMv1 - NTLMAuthenticate: %s)r   r   r   z#NTLMv2 Guest - NTLMAuthenticate: %srZ   )r1   zNTLMv2 - KeyExchangeKey: %s)r   r   usernamer   r   r   r   r   zNTLMv2 - NTLMAuthenticate: %s)<asysocks.unicomm.common.targetr   r   r   r   r8   r/   re   r   	constructr   negotiate_domainnegotiate_workstationnegotiate_versionr   rf   r    r!   r   r9   r   ntlm_versionrC   r   rS   Responser   r#   hostnamer   r
   rU   r   ServerChallenger   r0   calc_key_exchange_keyr'   r@   
NTResponseVersionr   r   REQUEST_NON_NT_SESSION_KEY
TargetInfor   MsvAvTargetNamer   application_datar   r`   ra   rb   MsvChannelBindingsr   r1   r   domainr   r"   )r3   authDatarJ   cb_dataspnkwargsr   r   lmrespti	cb_structmd5_ctxr   r4   r4   r5   authenticateZ  s   

 









 zNTLMClientNative.authenticate)T)rr   N)NF)r   )F)NNN)!__name__
__module____qualname__r   r6   r<   r>   r?   rA   rC   rF   rN   rQ   rS   rV   rY   rn   rp   ry   r|   r   ro   r   r   r   r   r   r   r   r   r@   r   r   r4   r4   r4   r5   r      s<     







$


 r   )'r   r   r^   typingr   asyauth.common.winapi.constantsr   	unicryptor   r   unicrypto.symmetricr   asyauth.protocols.ntlmr   asyauth.common.credentials.ntlmr   ,asyauth.protocols.ntlm.structures.serverinfor	   1asyauth.protocols.ntlm.structures.negotiate_flagsr
   ;asyauth.protocols.ntlm.structures.ntlmssp_message_signaturer   Aasyauth.protocols.ntlm.structures.ntlmssp_message_signature_noextr   )asyauth.protocols.ntlm.messages.negotiater   )asyauth.protocols.ntlm.messages.challenger   ,asyauth.protocols.ntlm.messages.authenticater   !asyauth.protocols.ntlm.creds_calcr   r   r   r   r   #minikerberos.gssapi.channelbindingsr   r   r4   r4   r4   r5   <module>   s(    