rubyntlm 0.6.6 → 0.6.7

data/lib/net/ntlm/rc4.rb

@@ -1,59 +1,66 @@
+# frozen_string_literal: true
+
 require 'openssl'
 
 module Net
-module NTLM
-
-  begin
-    OpenSSL::Cipher.new("rc4")
-  rescue
-    # libssl-3.0+ doesn't support legacy Rc4 -> use our own implementation
-
-    class Rc4
-      def initialize(str)
-        raise ArgumentError, "RC4: Key supplied is blank"  if str.eql?('')
-        initialize_state(str)
-        @q1, @q2 = 0, 0
-      end
+  # NTLM cryptographic primitives.
+  module NTLM
+    begin
+      OpenSSL::Cipher.new('rc4')
+    rescue StandardError
+      # libssl-3.0+ doesn't support legacy Rc4 -> use our own implementation
 
-      def encrypt(text)
-        text.each_byte.map do |b|
-          @q1 = (@q1 + 1) % 256
-          @q2 = (@q2 + @state[@q1]) % 256
-          @state[@q1], @state[@q2] = @state[@q2], @state[@q1]
-          b ^ @state[(@state[@q1] + @state[@q2]) % 256]
-        end.pack("C*")
-      end
+      # Pure-Ruby RC4 implementation, used when OpenSSL does not provide RC4.
+      class Rc4
+        def initialize(str)
+          raise ArgumentError, 'RC4: Key supplied is blank' if str.eql?('')
+
+          initialize_state(str)
+          @q1 = 0
+          @q2 = 0
+        end
+
+        def encrypt(text)
+          text.each_byte.map { |byte| keystream_byte ^ byte }.pack('C*')
+        end
 
-      private
+        private
 
-      # The initial state which is then modified by the key-scheduling algorithm
-      INITIAL_STATE = (0..255).to_a
+        # The initial state which is then modified by the key-scheduling algorithm
+        INITIAL_STATE = (0..255).to_a
 
-      # Performs the key-scheduling algorithm to initialize the state.
-      def initialize_state(key)
-        i = j = 0
-        @state = INITIAL_STATE.dup
-        key_length = key.length
-        while i < 256
-          j = (j + @state[i] + key.getbyte(i % key_length)) % 256
-          @state[i], @state[j] = @state[j], @state[i]
-          i += 1
+        # Advances the cipher state and returns the next keystream byte.
+        def keystream_byte
+          @q1 = (@q1 + 1) % 256
+          @q2 = (@q2 + @state[@q1]) % 256
+          @state[@q1], @state[@q2] = @state[@q2], @state[@q1]
+          @state[(@state[@q1] + @state[@q2]) % 256]
         end
-      end
-    end
 
-  else
-    # Openssl/libssl provides RC4, so we can use it.
-    class Rc4
-      def initialize(str)
-        @ci = OpenSSL::Cipher.new("rc4")
-        @ci.key = str
+        # Performs the key-scheduling algorithm to initialize the state.
+        def initialize_state(key)
+          i = j = 0
+          @state = INITIAL_STATE.dup
+          key_length = key.length
+          while i < 256
+            j = (j + @state[i] + key.getbyte(i % key_length)) % 256
+            @state[i], @state[j] = @state[j], @state[i]
+            i += 1
+          end
+        end
       end
+    else
+      # Openssl/libssl provides RC4, so we can use it.
+      class Rc4
+        def initialize(str)
+          @ci = OpenSSL::Cipher.new('rc4')
+          @ci.key = str
+        end
 
-      def encrypt(text)
-        @ci.update(text) + @ci.final
+        def encrypt(text)
+          @ci.update(text) + @ci.final
+        end
       end
     end
   end
 end
-end

data/lib/net/ntlm/response.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module Net
+  # NTLM response builders: LM, NTLM, NTLMv2, LMv2 and NTLM2 session responses.
+  module NTLM
+    class << self
+      # Builds an LM response for the given challenge
+      # @param [Hash] arg :lm_hash, :challenge
+      def lm_response(arg)
+        hash, chal = lm_args(arg)
+        keys = gen_keys hash.ljust(21, "\0")
+        apply_des(pack_challenge(chal), keys).join
+      end
+
+      # Builds an NTLM response for the given challenge
+      # @param [Hash] arg :ntlm_hash, :challenge
+      def ntlm_response(arg)
+        hash = arg[:ntlm_hash]
+        chal = arg[:challenge]
+        chal = NTLM.pack_int64le(chal) if chal.is_a?(Integer)
+        keys = gen_keys hash.ljust(21, "\0")
+        apply_des(chal, keys).join
+      end
+
+      # Builds an NTLMv2 response for the given challenge
+      # @param [Hash] arg :ntlmv2_hash, :challenge, :target_info
+      # @option opt [String] :client_challenge 8-byte client challenge
+      # @option opt [Integer] :timestamp Time of the response
+      def ntlmv2_response(arg, opt = {})
+        key, chal, ti = ntlmv2_args(arg)
+        cc = client_challenge(opt)
+        bb = ntlmv2_blob(ti, opt[:timestamp], cc).serialize
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), key, pack_challenge(chal) + bb) + bb
+      end
+
+      # Builds an LMv2 response for the given challenge
+      # @param [Hash] arg :ntlmv2_hash, :challenge
+      # @option opt [String] :client_challenge 8-byte client challenge
+      def lmv2_response(arg, opt = {})
+        key = arg[:ntlmv2_hash]
+        chal = arg[:challenge]
+
+        chal = NTLM.pack_int64le(chal) if chal.is_a?(Integer)
+
+        cc = opt[:client_challenge] || rand(MAX64)
+        cc = NTLM.pack_int64le(cc) if cc.is_a?(Integer)
+
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), key, chal + cc) + cc
+      end
+
+      # Builds an NTLM2 session response for the given challenge
+      # @param [Hash] arg :ntlm_hash, :challenge
+      # @option opt [String] :client_challenge 8-byte client challenge
+      def ntlm2_session(arg, opt = {})
+        passwd_hash, chal = ntlm2_session_args(arg)
+        cc = client_challenge(opt)
+        keys = gen_keys(passwd_hash.ljust(21, "\0"))
+        session_hash = OpenSSL::Digest::MD5.digest(pack_challenge(chal) + cc).slice(0, 8)
+        response = apply_des(session_hash, keys).join
+        [cc.ljust(24, "\0"), response]
+      end
+
+      private
+
+      # @api private
+      def lm_args(arg)
+        [arg[:lm_hash], arg[:challenge]]
+      rescue StandardError
+        raise ArgumentError
+      end
+
+      # @api private
+      def ntlmv2_args(arg)
+        [arg[:ntlmv2_hash], arg[:challenge], arg[:target_info]]
+      rescue StandardError
+        raise ArgumentError
+      end
+
+      # @api private
+      def ntlm2_session_args(arg)
+        [arg[:ntlm_hash], arg[:challenge]]
+      rescue StandardError
+        raise ArgumentError
+      end
+
+      # @api private
+      def client_challenge(opt)
+        cc = opt[:client_challenge] || rand(MAX64)
+        cc = NTLM.pack_int64le(cc) if cc.is_a?(Integer)
+        cc
+      end
+
+      # @api private
+      def pack_challenge(chal)
+        chal.is_a?(Integer) ? NTLM.pack_int64le(chal) : chal
+      end
+
+      # @api private
+      def ntlmv2_blob(target_info, timestamp, challenge)
+        ts = timestamp || Time.now.to_i
+        # epoch -> milsec from Jan 1, 1601
+        ts = 10_000_000 * (ts + TIME_OFFSET)
+
+        blob = Blob.new
+        blob.timestamp = ts
+        blob.challenge = challenge
+        blob.target_info = target_info
+        blob
+      end
+    end
+  end
+end

data/lib/net/ntlm/security_buffer.rb

@@ -1,25 +1,26 @@
+# frozen_string_literal: true
 
 module Net
   module NTLM
-
+    # NTLMSSP security buffer: length/allocated/offset triplet plus payload.
     class SecurityBuffer < FieldSet
-
-      int16LE   :length,        {:value => 0}
-      int16LE   :allocated,     {:value => 0}
-      int32LE   :offset,        {:value => 0}
+      int16_le   :length,        { value: 0 }
+      int16_le   :allocated,     { value: 0 }
+      int32_le   :offset,        { value: 0 }
 
       attr_accessor :active
-      def initialize(opts={})
+
+      def initialize(opts = {})
         super()
         @value  = opts[:value]
-        @active = opts[:active].nil? ? true : opts[:active]
+        @active = opts[:active].nil? || opts[:active]
         @size = 8
       end
 
-      def parse(str, offset=0)
-        if @active and str.size >= offset + @size
+      def parse(str, offset = 0)
+        if @active && str.size >= offset + @size
           super(str, offset)
-          @value = str[self.offset, self.length]
+          @value = str[self.offset, length]
           @size
         else
           0
@@ -30,9 +31,7 @@ module Net
         super if @active
       end
 
-      def value
-        @value
-      end
+      attr_reader :value
 
       def value=(val)
         @value = val
@@ -43,6 +42,5 @@ module Net
         @active ? @value.size : 0
       end
     end
-
   end
-end
+end

data/lib/net/ntlm/string.rb

@@ -1,14 +1,16 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
-
+    # Fixed-size string field.
     class String < Field
       def initialize(opts)
         super(opts)
         @size = opts[:size]
       end
 
-      def parse(str, offset=0)
-        if @active and str.size >= offset + @size
+      def parse(str, offset = 0)
+        if @active && str.size >= offset + @size
           @value = str[offset, @size]
           @size
         else
@@ -20,16 +22,15 @@ module Net
         if @active
           @value.to_s
         else
-          ""
+          ''
         end
       end
 
       def value=(val)
         @value = val
         @size = @value.nil? ? 0 : @value.size
-        @active = (@size > 0)
+        @active = @size.positive?
       end
     end
-
   end
-end
+end

data/lib/net/ntlm/target_info.rb

@@ -1,22 +1,22 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
-
     # Represents a list of AV_PAIR structures
     # @see https://msdn.microsoft.com/en-us/library/cc236646.aspx
     class TargetInfo
-
       # Allowed AvId values for an AV_PAIR
-      MSV_AV_EOL               = "\x00\x00".freeze
-      MSV_AV_NB_COMPUTER_NAME  = "\x01\x00".freeze
-      MSV_AV_NB_DOMAIN_NAME    = "\x02\x00".freeze
-      MSV_AV_DNS_COMPUTER_NAME = "\x03\x00".freeze
-      MSV_AV_DNS_DOMAIN_NAME   = "\x04\x00".freeze
-      MSV_AV_DNS_TREE_NAME     = "\x05\x00".freeze
-      MSV_AV_FLAGS             = "\x06\x00".freeze
-      MSV_AV_TIMESTAMP         = "\x07\x00".freeze
-      MSV_AV_SINGLE_HOST       = "\x08\x00".freeze
-      MSV_AV_TARGET_NAME       = "\x09\x00".freeze
-      MSV_AV_CHANNEL_BINDINGS  = "\x0A\x00".freeze
+      MSV_AV_EOL               = "\x00\x00"
+      MSV_AV_NB_COMPUTER_NAME  = "\x01\x00"
+      MSV_AV_NB_DOMAIN_NAME    = "\x02\x00"
+      MSV_AV_DNS_COMPUTER_NAME = "\x03\x00"
+      MSV_AV_DNS_DOMAIN_NAME   = "\x04\x00"
+      MSV_AV_DNS_TREE_NAME     = "\x05\x00"
+      MSV_AV_FLAGS             = "\x06\x00"
+      MSV_AV_TIMESTAMP         = "\x07\x00"
+      MSV_AV_SINGLE_HOST       = "\x08\x00"
+      MSV_AV_TARGET_NAME       = "\x09\x00"
+      MSV_AV_CHANNEL_BINDINGS  = "\x0A\x00"
 
       # @param av_pair_sequence [String] AV_PAIR list from challenge message
       def initialize(av_pair_sequence)
@@ -26,8 +26,8 @@ module Net
       attr_reader :av_pairs
 
       def to_s
-        result = ''
-        av_pairs.each do |k,v|
+        result = +''
+        av_pairs.each do |k, v|
           result << k
           result << [v.length].pack('S')
           result << v
@@ -40,49 +40,57 @@ module Net
       private
 
       VALID_PAIR_ID = [
-          MSV_AV_EOL,
-          MSV_AV_NB_COMPUTER_NAME,
-          MSV_AV_NB_DOMAIN_NAME,
-          MSV_AV_DNS_COMPUTER_NAME,
-          MSV_AV_DNS_DOMAIN_NAME,
-          MSV_AV_DNS_TREE_NAME,
-          MSV_AV_FLAGS,
-          MSV_AV_TIMESTAMP,
-          MSV_AV_SINGLE_HOST,
-          MSV_AV_TARGET_NAME,
-          MSV_AV_CHANNEL_BINDINGS
+        MSV_AV_EOL,
+        MSV_AV_NB_COMPUTER_NAME,
+        MSV_AV_NB_DOMAIN_NAME,
+        MSV_AV_DNS_COMPUTER_NAME,
+        MSV_AV_DNS_DOMAIN_NAME,
+        MSV_AV_DNS_TREE_NAME,
+        MSV_AV_FLAGS,
+        MSV_AV_TIMESTAMP,
+        MSV_AV_SINGLE_HOST,
+        MSV_AV_TARGET_NAME,
+        MSV_AV_CHANNEL_BINDINGS
       ].freeze
 
       def read_pairs(av_pair_sequence)
-        offset = 0
         result = {}
         return result if av_pair_sequence.nil?
 
-        until offset >= av_pair_sequence.length
-          id = av_pair_sequence[offset..offset+1]
+        read_all_pairs(av_pair_sequence, result)
 
-          unless VALID_PAIR_ID.include?(id)
-            raise Net::NTLM::InvalidTargetDataError.new( 
-              "Invalid AvId #{to_hex(id)} in AV_PAIR structure",
-              av_pair_sequence
-            )
-          end
-
-          length = av_pair_sequence[offset+2..offset+3].unpack('S')[0].to_i
-          if length > 0
-            value = av_pair_sequence[offset+4..offset+4+length-1]
-            result[id] = value
-          end
+        result
+      end
 
-          offset += 4 + length
+      def read_all_pairs(sequence, result)
+        offset = 0
+        loop do
+          offset = read_pair(sequence, offset, result)
+          break if offset >= sequence.length
         end
+      end
 
-        result
+      def read_pair(sequence, offset, result)
+        id = sequence[offset..offset + 1]
+        validate_pair_id(id, sequence)
+        length = sequence[offset + 2..offset + 3].unpack1('S').to_i
+        result[id] = sequence[offset + 4, length] if length.positive?
+        offset + 4 + length
+      end
+
+      def validate_pair_id(id, sequence)
+        return if VALID_PAIR_ID.include?(id)
+
+        raise Net::NTLM::InvalidTargetDataError.new(
+          "Invalid AvId #{to_hex(id)} in AV_PAIR structure",
+          sequence
+        )
       end
 
       def to_hex(str)
         return nil if str.nil?
-        str.bytes.map {|b| '0x' + b.to_s(16).rjust(2,'0').upcase}.join('-')
+
+        str.bytes.map { |b| "0x#{b.to_s(16).rjust(2, '0').upcase}" }.join('-')
       end
     end
   end

data/lib/net/ntlm/version.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
     # @private
     module VERSION
       MAJOR = 0
       MINOR = 6
-      TINY  = 6
+      TINY  = 7
       STRING = [MAJOR, MINOR, TINY].join('.')
     end
   end