o
    jfM                     @   sZ  d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z- d dl.m/Z/ d dlm0Z0 d dl1m1Z1 G dd dZ2ddede2fddZ3dS )    N)castCallable)ISC_REQ)asyauthSecretasyauthProtocolasyauthSubProtocol)hmac)hashlib)RC4)logger)NTLMCredential)NTLMServerInfo)NegotiateFlags)NTLMSSP_MESSAGE_SIGNATURE)NTLMSSP_MESSAGE_SIGNATURE_NOEXT)NTLMNegotiate)NTLMChallenge)NTLMAuthenticate)	netntlmv2
AVPAIRType
LMResponsenetntlmnetntlm_ess)ChannelBindingsStruct)AVPairs
MsvAvFlags)Version)FILETIME)datetimec                   @   s  e Zd ZdefddZdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dAddZdAddZdAddZdd Zdd Zdd Zdd ZdBd!d"ZdCd$d%Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ ZdDd1d2ZdDd3d4Zd5d6 ZdDd7d8ZdDd9d:ZdEd;d<Zd=d> ZdFd?d@Z d S )GNTLMServerNative
credentialc                 C   s   || _ |jd ur|jntd| _d | _d | _d | _d | _d | _d | _	d | _
|jd ur.|jntd| _d | _d | _d | _d | _d | _d | _d | _d | _d| _d| _d | _|j| _d | _d S )N      r   )r    	challengeosurandomntlmNegotiatentlmChallengentlmAuthenticatentlmNegotiate_rawntlmChallenge_rawntlmAuthenticate_rawEncryptedRandomSessionKeysession_keyRandomSessionKeySessionBaseKeyKeyExchangeKeySignKey_clientSealKey_clientSignKey_serverSealKey_servercrypthandle_clientcrypthandle_server
seq_numberiteration_cntntlm_credentials	timestamp
extra_info)selfr     r=   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/server/native.py__init__   s.   
zNTLMServerNative.__init__c                 C      t d t|| _d S )NzLoading negotiate message)r   debugr   
from_bytesr&   r<   datar=   r=   r>   load_negotiate?      
zNTLMServerNative.load_negotiatec                 C   r@   )NzLoading challenge message)r   rA   r   rB   r'   rC   r=   r=   r>   load_challengeC   rF   zNTLMServerNative.load_challengec                 C   r@   )NzLoading authenticate message)r   rA   r   rB   r(   rC   r=   r=   r>   load_authenticateG   rF   z"NTLMServerNative.load_authenticatec                 C   s   t d || _| d d S )NzLoading sessionkeyT)r   rA   r.   setup_cryptorC   r=   r=   r>   load_sessionkeyK   s   
z NTLMServerNative.load_sessionkeyc                 C   s   | j jS N)r    is_guestr<   r=   r=   r>   rL   P   s   zNTLMServerNative.is_guestc                 C      | j S rK   )r7   rM   r=   r=   r>   get_seq_numberS      zNTLMServerNative.get_seq_numberTc                 C   6   |dkr| j  jtjO  _d S | j  jtj M  _d S NT)r    flagsr   NEGOTIATE_SIGNr<   tfr=   r=   r>   set_signV      zNTLMServerNative.set_signc                 C   rQ   rR   )r    rS   r   NEGOTIATE_SEALrU   r=   r=   r>   set_seal\   rX   zNTLMServerNative.set_sealc                 C   rQ   rR   )r    rS   r   NEGOTIATE_VERSIONrU   r=   r=   r>   set_versionb   rX   zNTLMServerNative.set_versionc                 C      t j| jj v S rK   )r   "NEGOTIATE_EXTENDED_SESSIONSECURITYr'   rM   r=   r=   r>   is_extended_securityh      z%NTLMServerNative.is_extended_securityc                 C   s   t | j| _| jS rK   )r   from_challenger'   r;   rM   r=   r=   r>   get_extra_infok   s   zNTLMServerNative.get_extra_infoc                 C   s   |   dkr`t }tj| jjv r:td|| }tj|dd}|	| ||
 d d |_||_|d7 }| S tj|dd}|	td||  |
 d d |_||_|d7 }| S td)NTz<imd5)	digestmodr!      zNot implemented!)r_   r   r   NEGOTIATE_KEY_EXCHr'   structpackr   newupdatedigestChecksumSeqNum	Exceptionto_bytes)r<   handle
signingKeyseqNummessagemsgtttr=   r=   r>   MACo   s"   

zNTLMServerNative.MACc                    s"   |  | j| j|||| jj}|S )z2
		This function is to support SSPI encryption.
		)SEALr1   r2   r5   encrypt)r<   rD   sequence_nor=   r=   r>   ry      s   zNTLMServerNative.encryptinitNc           	         sL   |dd }t |dd }| j|}| | jj| j|j|}|dfS )z2
		This function is to support SSPI decryption.
		r"   N)r   rB   r6   ry   rw   r3   rm   )	r<   rD   rz   	direction	auth_dataedatasrv_sigsealedMessage	signaturer=   r=   r>   decrypt   s   zNTLMServerNative.decryptFc                    sJ   |  | jj| j||}|du rt| j| _t| j| _|  jd7  _|S )zc
		Singing outgoing messages. The reset_cipher parameter is needed for calculating mechListMIC. 
		Tre   )	rw   r5   ry   r1   r
   r2   r4   r6   r7   )r<   rD   
message_nor|   reset_cipherr   r=   r=   r>   sign   s   zNTLMServerNative.signc                    s,   t |}| | jj| j|j|}||kS )z'
		Verifying incoming server message
		)r   rB   rw   r6   ry   r3   rm   )r<   rD   r   signature_structcalc_sigr=   r=   r>   verify   s   
zNTLMServerNative.verifyc           	      C   s    ||}|  ||||}||fS )z)
		This is the official SEAL function.
		rw   )	r<   rq   
sealingKeymessageToSignmessageToEncryptrr   cipher_encryptr   r   r=   r=   r>   rx      s   zNTLMServerNative.SEALc                 C   s   |  ||||S )z)
		This is the official SIGN function.
		r   )r<   rq   rs   rr   r   r=   r=   r>   SIGN   s   zNTLMServerNative.SIGNc                 C   s   t j| jj v pt j| jj v S rK   )r   rT   r'   rY   rM   r=   r=   r>   signing_needed   s   zNTLMServerNative.signing_neededc                 C   r]   rK   )r   rY   r'   rM   r=   r=   r>   encryption_needed   r`   z"NTLMServerNative.encryption_neededClientc                 C   s0  t j| jj v rNt j| jj v r| j}nt j| jj v r!| jd d }n| jd d }|dkr=td}||d  |	 }n+td}||d  |	 }nt j| jj v r_| jd d d }n	| jd d d }|dkrz|| _
|d uryt| j
| _n|| _|d urt| j| _|d urtd	|| f  |S )
N      r   rc   s;   session key to client-to-server sealing key magic constant s;   session key to server-to-client sealing key magic constant    s   8zSetting %s sealkey to %s)r   r^   r'   NEGOTIATE_128r.   NEGOTIATE_56r	   ri   rj   rk   r2   r
   r5   r4   r6   r   rA   hex)r<   modesealkeyrc   r=   r=   r>   calc_sealkey   s6   



zNTLMServerNative.calc_sealkeyc                 C   s   t j| jj v r/|dkrtd}|| jd  | }ntd}|| jd  | }nd }|dkrG|d urBt	d|
   || _|S |d urTt	d|
   || _|S )Nr   rc   s;   session key to client-to-server signing key magic constant s;   session key to server-to-client signing key magic constant zSetting client signkey to %szSetting server signkey to %s)r   r^   r'   r	   ri   rj   r.   rk   r   rA   r   r1   r3   )r<   r   rc   signkeyr=   r=   r>   calc_signkey   s$   



zNTLMServerNative.calc_signkeyc                 C   rN   rK   )r.   rM   r=   r=   r>   get_session_key  rP   z NTLMServerNative.get_session_keyc                 C      |dkr| j S | jS Nr   )r2   r4   r<   r   r=   r=   r>   get_sealkey     zNTLMServerNative.get_sealkeyc                 C   r   r   )r1   r3   r   r=   r=   r>   get_signkey  r   zNTLMServerNative.get_signkeyc                 C   s   t d | jstd| _t d| j   | jjdkr;d| _d| _	t
| j	}|| j| _t d| j   n|du rZ| jj| _t
| j	}|| j| _t d| j   | d | d	 | d | d	 d S )
NzSetting up cryptor"   zRandomSessionKey: %sTs                   zEncryptedRandomSessionKey: %sFr   Server)r   rA   r.   r$   r%   r   r    rL   r/   r0   r
   ry   r,   r9   r   r   )r<   	is_remoterc4r=   r=   r>   rI   "  s&   






zNTLMServerNative.setup_cryptoc                 C   s   t |tdu r	|S |d u r| jjS t| jj}|tjO }|tjO }|tjO }|tj	O }|tj
O }|tjO }|tjO }|tjO }|tjO }|tjO }|tj M }tj|v r[|tjO }n|tj M }tj|v rm|tjO }|S |tj M }|S rR   )
isinstancer   r    rS   copydeepcopyr   rf   r   r[   r^   NEGOTIATE_NTLMNEGOTIATE_LM_KEYREQUEST_TARGETNTLM_NEGOTIATE_OEMNEGOTIATE_UNICODETARGET_TYPE_SERVERr   	INTEGRITYrT   CONFIDENTIALITYrY   )r<   rS   	ntlmflagsr=   r=   r>   isc_to_ntlm_flags@  s0   












z"NTLMServerNative.isc_to_ntlm_flagsc                    s  d }zd|v rddl m} t||d }W n   Y | |}td|  | jdkr|d u r4td|  jd7  _t	|| _
|| _t }d|tj< d|tj< d	|tj< d	|tj< d	|tj< tt  |tj< t| j
j}|tjO }|tjO }|tj M }|tj M }|tj  M }|tj! M }t"j#t$%d
| j&j'd ur| j&j'nd|| j&j(|d| _)td| j
  | j) | _*| j*dd fS || _+t,	|| _-td| j-  | j&j.dkrdS | j-jBdkrdS dS )Ntargetr   )	UniTargetz	Flags: %sz'First call as server MUST be with data!re   TESTzTEST$z
TEST.localr!    )r#   
targetName
targetInfoversionrS   zNegotiate: %sTzAuthenticate: %s)NFN)Qasysocks.unicomm.common.targetr   r   r   r   rA   r8   rn   r   rB   r&   r)   r   r   MsvAvNbDomainNameMsvAvNbComputerNameMsvAvDnsDomainNameMsvAvDnsComputerNameMsvAvDnsTreeNamer   from_datetimer   nowro   MsvAvTimestampr   r   r   r[   NEGOTIATE_TARGET_INFONEGOTIATE_ALWAYS_SIGNrY   rT   r   r   	constructr$   r%   r    negotiate_domainnegotiate_versionr'   r*   r+   r   r(   ntlm_versionrL   r   r\   Responser,   hostnamer^   r   ServerChallenger#   r9   calc_key_exchange_keyr0   rI   
NTResponser   r   r   REQUEST_NON_NT_SESSION_KEYUserName
TargetInfoMsvAvTargetNamer   application_datar	   ri   rj   rk   MsvChannelBindingsr   r:   r   domainusername)r<   authDatarS   cb_dataspnkwargsr   r   
targetinfolmrespti	cb_structmd5_ctxmicr=   r=   r>   authenticate_servera  sb   








9z$NTLMServerNative.authenticate_server)T)r{   N)NF)r   )F)NNN)!__name__
__module____qualname__r   r?   rE   rG   rH   rJ   rL   rO   rW   rZ   r\   r_   rb   rw   ry   r   r   r   rx   r   r   r   r   r   r   r   r   rI   r   r   r=   r=   r=   r>   r      s<     







$


!r   ntlm_credential_factoryreturnc                 C   s.   | d u rt dddtjd}n|  }t|}|S )Ntest)stype)r   r   PASSWORDr   )r   ntlm_settingsntlm_ctxr=   r=   r>   ntlmserver_factory  s   r   rK   )4r   r$   rg   typingr   r   asyauth.common.winapi.constantsr   asyauth.common.constantsr   r   r   	unicryptor   r	   unicrypto.symmetricr
   asyauth.protocols.ntlmr   asyauth.common.credentials.ntlmr   ,asyauth.protocols.ntlm.structures.serverinfor   1asyauth.protocols.ntlm.structures.negotiate_flagsr   ;asyauth.protocols.ntlm.structures.ntlmssp_message_signaturer   Aasyauth.protocols.ntlm.structures.ntlmssp_message_signature_noextr   )asyauth.protocols.ntlm.messages.negotiater   )asyauth.protocols.ntlm.messages.challenger   ,asyauth.protocols.ntlm.messages.authenticater   !asyauth.protocols.ntlm.creds_calcr   r   r   r   r   #minikerberos.gssapi.channelbindingsr   (asyauth.protocols.ntlm.structures.avpairr   r   )asyauth.protocols.ntlm.structures.versionr   r   r   r   r   r=   r=   r=   r>   <module>   s:       t