155 lines
4.9 KiB
Python
155 lines
4.9 KiB
Python
"""NTLMSSP Type 3 parser tests.
|
||
|
||
Builds Type 3 buffers field-by-field per MS-NLMP §2.2.1.3 and asserts
|
||
the parser returns the universal Credential SD shape. Shared
|
||
infrastructure for SMB and RDP-NLA cred capture.
|
||
"""
|
||
from __future__ import annotations
|
||
|
||
import base64
|
||
import importlib.util
|
||
import struct
|
||
from pathlib import Path
|
||
|
||
import pytest
|
||
|
||
|
||
def _load_ntlmssp():
|
||
repo = Path(__file__).resolve().parents[2]
|
||
path = repo / "decnet" / "templates" / "_shared" / "ntlmssp.py"
|
||
spec = importlib.util.spec_from_file_location("_ntlmssp_under_test", path)
|
||
mod = importlib.util.module_from_spec(spec)
|
||
spec.loader.exec_module(mod)
|
||
return mod
|
||
|
||
|
||
@pytest.fixture(scope="module")
|
||
def ntlmssp():
|
||
return _load_ntlmssp()
|
||
|
||
|
||
def _build_type3(
|
||
*,
|
||
username: str,
|
||
domain: str,
|
||
nt_response: bytes,
|
||
unicode: bool = True,
|
||
) -> bytes:
|
||
"""Build a syntactically-valid NTLMSSP Type 3 message."""
|
||
if unicode:
|
||
u = username.encode("utf-16-le")
|
||
d = domain.encode("utf-16-le")
|
||
flags = 0x00000001 # NEGOTIATE_UNICODE
|
||
else:
|
||
u = username.encode("ascii")
|
||
d = domain.encode("ascii")
|
||
flags = 0x00000000
|
||
|
||
# Layout: 8 sig + 4 type + 6×8 field records + 4 flags = 64 bytes
|
||
# of header, then payload (concat of nt_response, domain, username).
|
||
header_size = 64
|
||
nt_off = header_size
|
||
dom_off = nt_off + len(nt_response)
|
||
user_off = dom_off + len(d)
|
||
|
||
hdr = bytearray(header_size)
|
||
hdr[0:8] = b"NTLMSSP\x00"
|
||
struct.pack_into("<I", hdr, 8, 3) # message type 3
|
||
# LmChallengeResponse (unused — empty)
|
||
struct.pack_into("<HHI", hdr, 12, 0, 0, 0)
|
||
# NtChallengeResponse
|
||
struct.pack_into("<HHI", hdr, 20, len(nt_response), len(nt_response), nt_off)
|
||
# DomainName
|
||
struct.pack_into("<HHI", hdr, 28, len(d), len(d), dom_off)
|
||
# UserName
|
||
struct.pack_into("<HHI", hdr, 36, len(u), len(u), user_off)
|
||
# Workstation (unused)
|
||
struct.pack_into("<HHI", hdr, 44, 0, 0, 0)
|
||
# EncryptedRandomSessionKey (unused)
|
||
struct.pack_into("<HHI", hdr, 52, 0, 0, 0)
|
||
# NegotiateFlags
|
||
struct.pack_into("<I", hdr, 60, flags)
|
||
|
||
return bytes(hdr) + nt_response + d + u
|
||
|
||
|
||
def test_parse_type3_ntlmv2(ntlmssp):
|
||
"""NTLMv2 NTChallengeResponse is variable-length (>= 28 bytes in
|
||
practice). Parser flags this as secret_kind=ntlmssp_v2."""
|
||
nt_response = b"\xab" * 16 + b"\x01\x01\x00\x00" + b"\x00" * 28 # ~48 bytes
|
||
blob = _build_type3(
|
||
username="alice", domain="ACME", nt_response=nt_response,
|
||
)
|
||
cred = ntlmssp.parse_type3(blob)
|
||
assert cred is not None
|
||
assert cred["username"] == "alice"
|
||
assert cred["domain"] == "ACME"
|
||
assert cred["principal"] == "ACME\\alice"
|
||
assert cred["secret_kind"] == "ntlmssp_v2"
|
||
assert base64.b64decode(cred["secret_b64"]) == nt_response
|
||
|
||
|
||
def test_parse_type3_ntlmv1(ntlmssp):
|
||
"""NTLMv1 NTChallengeResponse is exactly 24 bytes."""
|
||
nt_response = b"\xcd" * 24
|
||
blob = _build_type3(
|
||
username="bob", domain="WORKGROUP", nt_response=nt_response,
|
||
)
|
||
cred = ntlmssp.parse_type3(blob)
|
||
assert cred["secret_kind"] == "ntlmssp_v1"
|
||
assert cred["principal"] == "WORKGROUP\\bob"
|
||
|
||
|
||
def test_parse_type3_no_domain(ntlmssp):
|
||
nt_response = b"\xff" * 24
|
||
blob = _build_type3(
|
||
username="lonely", domain="", nt_response=nt_response,
|
||
)
|
||
cred = ntlmssp.parse_type3(blob)
|
||
assert cred["domain"] == ""
|
||
assert cred["principal"] == "lonely"
|
||
|
||
|
||
def test_parse_type3_oem_strings(ntlmssp):
|
||
"""Older clients without NEGOTIATE_UNICODE send ASCII strings."""
|
||
nt_response = b"\x11" * 24
|
||
blob = _build_type3(
|
||
username="ascii_user",
|
||
domain="WIN2000",
|
||
nt_response=nt_response,
|
||
unicode=False,
|
||
)
|
||
cred = ntlmssp.parse_type3(blob)
|
||
assert cred["username"] == "ascii_user"
|
||
assert cred["domain"] == "WIN2000"
|
||
|
||
|
||
def test_parse_type3_rejects_non_signature(ntlmssp):
|
||
assert ntlmssp.parse_type3(b"NotNtlmssp") is None
|
||
assert ntlmssp.parse_type3(b"") is None
|
||
# Right magic but wrong message type:
|
||
blob = bytearray(64)
|
||
blob[0:8] = b"NTLMSSP\x00"
|
||
struct.pack_into("<I", blob, 8, 1) # Type 1, not 3
|
||
assert ntlmssp.parse_type3(bytes(blob)) is None
|
||
|
||
|
||
def test_parse_type3_rejects_anonymous(ntlmssp):
|
||
"""Empty NT response (anonymous bind) → no credential to record."""
|
||
blob = _build_type3(username="", domain="", nt_response=b"")
|
||
assert ntlmssp.parse_type3(blob) is None
|
||
|
||
|
||
def test_find_ntlmssp_inside_outer_blob(ntlmssp):
|
||
"""SPNEGO-wrapped Type 3 — caller can locate the signature first
|
||
and slice from there. Tests the find_ntlmssp helper."""
|
||
nt_response = b"\xee" * 32
|
||
inner = _build_type3(
|
||
username="x", domain="y", nt_response=nt_response,
|
||
)
|
||
outer = b"\x60\x82\x01\x00" + b"\x00" * 16 + inner + b"\xff" * 8
|
||
off = ntlmssp.find_ntlmssp(outer)
|
||
assert off >= 0
|
||
cred = ntlmssp.parse_type3(outer[off:])
|
||
assert cred["username"] == "x"
|