ntlm_decoder 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '09f1720dec3f32f464670ff095d4290ea688e39db8878ed97551ec7a731c2529'
+  data.tar.gz: f484f6f30e338273d8a0ce2f12dcbbdddcf99a8f447f5cee26d8959ef655752b
+SHA512:
+  metadata.gz: 6043bd8ea6b0050df838ecfca7f7ce5b20ca8d1def59fe57ef837ed4462161437eef2cbf5e8e74af72b8534764b10a7c3bfed1869fbdc4bcac180505a9753fcf
+  data.tar.gz: 64aeb7d72b78729d74159993c8c7868288969eb14f8afda35766f2e25adb28701830f68ed0487365c5ed2a3fdb75bc6bef2984d80d59714cdf13f30d5c9dcc7c

data/lib/ntlm_decoder.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+require 'base64'
+
+module NTLMDecoder
+
+  def self.check_for_header(string)
+    true if to_hex(string)[0..6] == "NTLMSSP"
+  end
+
+  def self.decode(string)
+    hex = to_hex(string)
+    tid = hex[60..-1].split("\x00")
+
+    domain_start     = tid.index("\x02") + 2
+    domain_end       = tid.index("\x01") - 1
+
+    server_start     = tid.index("\x01") + 2
+    server_end       = tid.index("\x04") - 1
+
+    dns_domain_start = tid.index("\x04") + 2
+    dns_domain_end   = tid.index("\x03") - 1
+
+    dns_server_start = tid.index("\x03") + 2
+
+    begin
+      dns_server_end   = tid.index("\x05") - 1
+    rescue NoMethodError
+      dns_server_end   = -1
+    end
+
+    return {
+      domain: tid[domain_start..domain_end].join,
+      server: tid[server_start..server_end].join,
+      dns:    tid[dns_domain_start..dns_domain_end].join,
+      fqdn:   tid[dns_server_start..dns_server_end].join
+    }
+
+  end
+
+  private
+
+  def self.to_hex(string)
+    Base64.decode64(string)
+  end
+
+end

metadata

@@ -0,0 +1,45 @@
+--- !ruby/object:Gem::Specification
+name: ntlm_decoder
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Aidan Damerell
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2019-11-06 00:00:00.000000000 Z
+dependencies: []
+description: Given an Base64 encoded NTLM type 2 message, return a hash of the data
+  held in the TID.
+email: aidan.damerell@icloud.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/ntlm_decoder.rb
+homepage: https://rubygems.org/gems/ntlm_decoder
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.8
+signing_key: 
+specification_version: 4
+summary: Extract Target Information Data from NTLM Type 2
+test_files: []