o
    jN                     @   s  d dl Z d dlmZ d dlmZ d dlmZ ddlmZ d dlT d dl	m
Z
 d d	lmZ d d
lmZ d dlmZ d dlmZ G dd dZG dd dZG dd dZG dd dZG dd dZG dd dZG dd dZdd Zdd Zd%dd Zd%d!d"Zd#d$ ZdS )&    N)DES)hashlib)hmac   )asyauthSecret)*)NegotiateFlags)NTLMCredential)NTLMAuthenticate)NTLMChallenge)NTLMNegotiatec                   @   s   e Zd ZdddZdd ZdS )
CredentialNc                 C   s   || _ || _|| _|| _d S N)ctypedomainusernamefullhash)selfr   r   r   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/creds_calc.py__init__   s   
zCredential.__init__c                 C   s   | j | j| j| jdS )Nr   r   r   r   r   r   r   r   r   to_dict   s
   zCredential.to_dict)NNN)__name__
__module____qualname__r   r   r   r   r   r   r      s    
r   c                   @   s&   e Zd ZedededefddZdS )NTLMCredentialsntlmNegotiatentlmChallengentlmAuthenticatec                 C   s  t |jtrGtd|j|jd|j|j|j |jj |jj	
  f d}t }|j|_|j|_|j|_|jj|_|jj	|_	| }||gS td|j|jtj}|jtj@ rzt }||_|j|_t |_|jj|j_t |_|jj|j_| gS t }||_|j|_|j|_|j|_t |_|jj|j_t |_|jj|j_|jj|jjkr| gS t }|j|_|j|_|j|_t |_|jj|j_| | gS )N	netNTLMv2%s::%s:%s:%s:%sr   r   r    )
isinstanceNTChallengeNTLMv2Responser   UserName
DomainNameServerChallengehexResponseChallengeFromClinetto_bytesnetlmv2r   r   LMChallengeClientResponseto_credentialr	   r   NTr   "NEGOTIATE_EXTENDED_SESSIONSECURITYnetntlm_esscredentials
LMResponseNTLMv1Response
NTResponsenetntlmnetlm)r   r   r    credscreds2basecredr   r   r   	construct    sb   




zNTLMCredentials.constructN)r   r   r   staticmethodr   r   r
   r?   r   r   r   r   r      s    r   c                   @   &   e Zd Zdd Zdd Zd	ddZdS )
r;   c                 C   s   d | _ d | _d | _d | _d S r   )r   r   r*   r1   r   r   r   r   r   o   s   
znetlm.__init__c                 C   s$   t d| jd| j| j| jf d}|S )NnetLMz%s:$NETLM$%s$%sr   r   )r   r   r*   r1   r   credr   r   r   r2   y   s
   znetlm.to_credentialplainc                 C   s   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j }n|dkr6t|| j  | j }ntdt|| j}| j|	 kS )a@  
		Verifies the authentication data against the user credentials
		Be careful! If the credtype is 'hash' then LM hash is expected!
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform
		:return: bool
		NTFrF   hashUnknown cred type!)
r   r   LMOWFv1bytesfromhex	ExceptionDESLr*   r1   r+   )r   r<   credtypelm_hashcalc_responser   r   r   verify   s   

znetlm.verifyNrF   r   r   r   r   r2   rQ   r   r   r   r   r;   m   s    
r;   c                   @   rA   )
r/   c                 C   "   d | _ d | _d | _d | _d | _d S r   )r   r   r*   r1   r-   r   r   r   r   r      s
   
znetlmv2.__init__c                 C   s(   t d| jd| j| j| j| jf d}|S )NnetLMv2z$NETLMv2$%s$%s$%s$%srC   )r   r   r*   r1   r-   rD   r   r   r   r2      s   znetlmv2.to_credentialrF   c                 C      |du rdS | j |vrdS | j|| j  vrdS |dkr*t|| j  | j | j| j }n|dkrAtd| j| j t|| j  | j }ntdtj|dd}|t| j	 |t| j
 | j| kS )	
		Verifies the authentication data against the user credentials
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform
		:return: bool
		NTFrF   rG   rH   md5	digestmod)r   r   LMOWFv2rJ   rK   rL   r   newupdater*   r-   r1   	hexdigest)r   r<   rN   rO   hmr   r   r   rQ      s   	
&znetlmv2.verifyNrR   rS   r   r   r   r   r/      s    r/   c                   @   sJ   e Zd Zdd Zdd ZedefddZdd	 ZdddZ	dddZ
dS )r5   c                 C   rT   r   r6   r*   r7   r9   SessionBaseKeyr   r   r   r   r      s
   
znetntlm_ess.__init__c                 C   sz   | j jtjkrt| j j}n| j jtjtjfv rt	| j j}t
j| jdd}|| j || j d d  | S )NrX   rY      )r6   styper   PASSWORDNTOWFv1secretr3   RC4rJ   rK   r   r\   ra   r]   r*   r7   r.   digest)r   nt_hashr_   r   r   r   calc_key_exchange_key   s   z!netntlm_ess.calc_key_exchange_keyr6   c                 C   s   t  }||_| |_|jtjkrt|j}n|jtjtj	fv r$t
|j}t |_|d |j_t| |d d   }t||d d }t |_||j_t| |_|S )Ns                   rb   )r5   r6   r*   rc   r   rd   re   rf   r3   rg   rJ   rK   ri   r7   r,   r   rX   rh   rM   r8   r9   md4ra   )server_challengeclient_challenger6   
ntlm_credsri   temp_1datar   r   r   r?      s   znetntlm_ess.constructc              
   C   s   | j j}|d u r
d}| j j}|d u rd}| jj}|d u rd}t|tr'| }| jj}|d u r1d}t|tr:| }t	d|d||||| j
 f d}|S )Nr$       znetNTLMv1-ESSr"   rC   )r6   r   r   r7   r,   r%   rJ   r+   r9   r   r*   )r   r   r   
lmresponse
ntresponserE   r   r   r   r2     s,   

znetntlm_ess.to_credentialrF   c                 C   X   |dkrt || j | j }n|dkrt|| j | j }ntdt| }|S NrF   rG   rH   	re   r   r   rJ   rK   rL   r   rk   rh   r   r<   rN   ri   session_base_keyr   r   r   calc_session_base_key$     z!netntlm_ess.calc_session_base_keyc                 C   s   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j }n|dkr6t|| j  | j }ntdtt| jt| j	dd  
 }t||dd }|t| jkS )rW   NTFrF   rG   rH   rb   )r   r   re   rJ   rK   rL   r   rX   r*   r-   rh   rM   r1   )r   r<   rN   ri   ro   rP   r   r   r   rQ   /  s   
*znetntlm_ess.verifyNrR   )r   r   r   r   rj   r@   r	   r?   r2   ry   rQ   r   r   r   r   r5      s    
r5   c                   @   sF   e Zd Zdd ZdddZedd Zdd	 ZdddZdddZ	dS )r:   c                 C   rT   r   r`   r   r   r   r   r   Q  s
   
znetntlm.__init__Fc                 C   s   | j jrt| j j}n| j j}|r=t|d d | j d d }t|dd d | j d d }|| }|S |rI|d d d }|S | j}|S )N   rb   s   s           )	r6   passwordrI   rO   r   encryptr7   r.   ra   )r   with_lmnon_nt_session_keyrO   temp1temp2kexr   r   r   rj   ]  s   $(znetntlm.calc_key_exchange_keyc                 C   s   t  }||_| |_d }|jtjkrt|j}t|j}n|jtj	tj
fv r+t|j}t |_t|| |j_|rDt |_t|| |j_nt|_t| |_|S r   )r:   r6   r*   rc   r   rd   re   rf   rI   r3   rg   rJ   rK   r8   r9   rM   r,   r7   rs   r   rk   rh   ra   )rl   r6   rn   rO   ri   r   r   r   r?   q  s"   
znetntlm.constructc                 C   s&   t d| jd| j| j| jjf d}|S )N	netNTLMv1z%s:$NETNTLM$%s$%srC   )r   r   r*   r9   r,   rD   r   r   r   r2     s
   znetntlm.to_credentialrF   c                 C   rt   ru   rv   rw   r   r   r   ry     rz   znetntlm.calc_session_base_keyc                 C   s   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j }n|dkr6t|| j  | j }ntdt|| jt| jkS )rW   NTFrF   rG   rH   )	r   r   re   rJ   rK   rL   rM   r*   r1   )r   r<   rN   ri   r   r   r   rQ     s   
znetntlm.verifyN)FFrR   )
r   r   r   r   rj   r@   r?   r2   ry   rQ   r   r   r   r   r:   O  s    


r:   c                   @   sD   e Zd Zdd Zdd Zdd Zeddd	Zd
d ZdddZ	dS )	netntlmv2c                 C   rT   r   r`   r   r   r   r   r     s
   
znetntlmv2.__init__c                 C   s   | j S r   )ra   r   r   r   r   rj     s   znetntlmv2.calc_key_exchange_keyc                 C   s   |j s
|js
td|jrt|j|j|j}ntd |j|jt|j }| jj	}t
| jj	tr6t| jj	}tj|dd}|| | S )Nz%Password or NT hash must be supplied!rX   rY   )ri   r|   rL   NTOWFv2r   r   rJ   rK   r9   r,   r%   strr   r\   r]   rh   )r   r6   
nt_hash_v2responser_   r   r   r   calc_key_exhange_key_server  s   
z%netntlmv2.calc_key_exhange_key_serverNc                 C   s8  t  }||_| |_|jtjkrt|j|j|j	}n|jtj
tjfv r0td |j|j	t|j}ntd|j |s>tj }t|||}| }tj|dd}	|	|  |	| |	 }
t |_|
|j_||j_tj|dd}	|	|  |	| t |_|	 |j_||j_tj|dd}	|	|
 |	 |_|S )NzUnsupported secret type "%s"rX   rY   )r   r6   r*   rc   r   rd   r   rf   r   r   r3   rg   rJ   rK   rL   datetimeutcnowNTLMv2ClientChallenger?   r.   r   r\   r]   rh   r'   r9   r,   r-   LMv2Responser7   ra   )rl   rm   server_detailsr6   	timestamprn   r   cctempr_   
NTProofStrr   r   r   r?     s:   






znetntlmv2.constructc              
   C   s8   t d| j| jd| jj| jj| j| jj| jjf d}|S )Nr!   r"   r#   )r   r   r   r6   r*   r9   r,   r-   rD   r   r   r   r2   	  s   "znetntlmv2.to_credentialrF   c                 C   rV   )	z
		Verifies the authentication data against the user credentials
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform 
		:return: bool
		NTFrF   rG   rH   rX   rY   )r   r   r   rJ   rK   rL   r   r\   r]   r*   r-   r1   r^   )r   r<   rN   ri   r_   r   r   r   rQ     s   	
&	znetntlmv2.verifyr   rR   )
r   r   r   r   rj   r   r@   r?   r2   rQ   r   r   r   r   r     s    +	r   c                 C   sd   d}| d d  dd }t|d d d}||}t|dd  d}||}|| S )Ns   KGS!@#$%    r{   ascii)ljustupperr   encoder}   )r|   	LM_SECRETt1dr1r2r   r   r   rI   ;  s   

rI   c                 C   s&   t | tdu r| d} t|  S )NTutf-16le)r%   r   r   r   rk   rh   )r|   r   r   r   re   F  s   
re   c                 C   s   |d u rd}t | |||S )Nr$   )r   )PasswdUserUserDom
PasswdHashr   r   r   r[   L  s   r[   c                 C   sV   |d u rd}|d urt j|dd}n	t jt| dd}|| | d | S )Nr$   rX   rY   r   )r   r\   re   r]   r   r   rh   )r   r   r   r   fpr   r   r   r   R  s   r   c                 C   s   t | dkr
tdt |dkrtdd}|t| dd |7 }|t| dd |7 }|t| dd d	 |7 }|S )
z
	Indicates the encryption of an 8-byte data item D with the 16-byte key K
	using the Data Encryption Standard Long (DESL) algorithm.
	The result is 24 bytes in length.
	:param K:
	:param D:
	:return:
	   zK MUST be 16 bytes longrb   zD MUST be 8 bytes longrq   Nr{   r   s        )lenrL   r   r}   )KDresr   r   r   rM   ]  s   	rM   r   )r   unicrypto.symmetricr   	unicryptor   r   common.constantsr   4asyauth.protocols.ntlm.structures.challenge_response1asyauth.protocols.ntlm.structures.negotiate_flagsr   asyauth.common.credentials.ntlmr	   ,asyauth.protocols.ntlm.messages.authenticater
   )asyauth.protocols.ntlm.messages.challenger   )asyauth.protocols.ntlm.messages.negotiater   r   r   r;   r/   r5   r:   r   rI   re   r[   r   rM   r   r   r   r   <module>   s0    N14}h 

