LDAP Channel binding implementation #1697
Conversation
|
@FrankSpierings Hi, I'm reviewing your changes. So far, code seems to work as expected. I suggested some minor changes in the code. In order to approve the PR those should be applied. Thanks! |
anadrianmanrique
added
the
waiting for response
I might be a n00b; but I don't see your suggestions. Should these just show up in my pull request? |
| @@ -37,10 +37,10 @@ | |||
|
|
|||
|
|
|||
| def computeResponse(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='', nthash='', | |||
| use_ntlmv2=USE_NTLMv2): | |||
| use_ntlmv2=USE_NTLMv2, channel_binding_value=''): | |||
There was a problem hiding this comment.
set channel_binding_value default value as b''
| @@ -594,7 +594,7 @@ def getNTLMSSPType1(workstation='', domain='', signingRequired = False, use_ntlm | |||
|
|
|||
| return auth | |||
|
|
|||
| def getNTLMSSPType3(type1, type2, user, password, domain, lmhash = '', nthash = '', use_ntlmv2 = USE_NTLMv2): | |||
| def getNTLMSSPType3(type1, type2, user, password, domain, lmhash = '', nthash = '', use_ntlmv2 = USE_NTLMv2, channel_binding_value = ''): | |||
There was a problem hiding this comment.
set channel_binding_value default value as b''
| @@ -898,7 +898,7 @@ def LMOWFv2( user, password, domain, lmhash = ''): | |||
|
|
|||
|
|
|||
| def computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='', | |||
| nthash='', use_ntlmv2=USE_NTLMv2): | |||
| nthash='', use_ntlmv2=USE_NTLMv2, channel_binding_value=''): | |||
There was a problem hiding this comment.
set channel_binding_value default value as b''
| # The following variable length AvPairs must be terminated like so | ||
| av_pairs[NTLMSSP_AV_EOL] = b'' | ||
|
|
||
| # Format according to: |
There was a problem hiding this comment.
Good! code is now more readable (Y)
| serverName + b'\x00' * 4 | ||
|
|
||
| if channel_binding_value is None: | ||
| channel_binding_value = b'' |
There was a problem hiding this comment.
remove 924,925,926, as channel_binding_value should be always be either b'' or a binary buffer
|
@FrankSpierings sorry, my bad, please check now |
|
Hi guys, huge fan of this PR as this would also enable NetExec to still function using NTLM, despite LDAP Signing & LDAPS channel binding being enabled (copy&pasted the code into the @FrankSpierings any updates on this? |
|
continued in #1844. Notice that these changes break test_ntlm.py as computeResponseNTLMv2 changed it's internal implementation |
* Implemented LDAP channel binding as cleanly as I could, based on https://github.com/ly4k/ldap3. * Set channel binding to bytes value as requested in the review * Fix test sessionBaseKey * Fix test ntResponse * Fix test encryptedSessionKey * Fix test ntlmChallengeResponse * Fix test ntlmChallengeResponse * Removing leftover print statement * Remove unnecessary AV_EOL, this is done by impackets struct anyway --------- Co-authored-by: frank <[email protected]>
Implemented LDAP channel binding as cleanly as I could, based on https://github.com/ly4k/ldap3.
The fact that I had to add a parameter to
computeResponse/computeResponseNTLMv2/getNTLMSSPType3, is not great.This works for
GetUserSPNs.py, since it uses Impackets version ofldap.py. I have seen thataddcomputer.pyuses https://github.com/cannatag/ldap3. So that stills needs work.