@tier0/node-red-contrib-opcda-client 1.0.5 → 1.0.7

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmkeyfactory.js

@@ -0,0 +1,159 @@
+// @ts-check
+const Crypto = require('crypto');
+const Responses = require('./responses.js');
+const md4 = require('js-md4');
+
+class NTLMKeyFactory
+{
+  constructor()
+  {
+    this.clientSigningMagicConstant = Buffer.from(
+      'session key to client-to-server signing key magic constant\0', 'ascii');
+    this.serverSigningMagicConstant = Buffer.from(
+      'session key to server-to-client signing key magic constant\0', 'ascii');
+    this.clientSealingMagicConstant = Buffer.from(
+      'session key to client-to-server sealing key magic constant\0', 'ascii');
+    this.serverSealingMagicConstant = Buffer.from(
+      'session key to server-to-client sealing key magic constant\0', 'ascii');
+  }
+
+  getNTLMUserSessionKey(password)
+  {
+    let r = new Responses();
+    let ntlmHash = r.ntlmHash(password);
+    let md4Hash = md4.create();
+    md4Hash.update(ntlmHash);
+    return md4Hash.array();
+  }
+
+  getNTLMv2UserSessionKey(target, user, password, challenge, blob)
+  {
+    let ntlmv2Hash = new Responses().ntlmv2Hash(target, user, password);
+    let data = [...challenge, ...blob];
+    let mac = new Responses().hmacMD5(data, ntlmv2Hash);
+    return new Responses().hmacMD5(mac, ntlmv2Hash);
+  }
+
+  getNTLM2SessionResponseUserSessionKey(password, servernonce)
+  {
+    return new Responses().hmacMD5(servernonce, this.getNTLMUserSessionKey(password));
+  }
+
+  getSecondarySessionKey()
+  {
+    return [...Crypto.randomBytes(16)];
+  }
+
+  encryptSecondarySessionKey(secondaryKey, userSessionKey)
+  {
+    let rc4 = Crypto.createCipheriv('rc4', Buffer.from(userSessionKey), '');
+    return [...rc4.update(Buffer.from(secondaryKey))];
+  }
+
+  decryptSecondarySessionKey(encryptedKey, userSessionKey)
+  {
+    let rc4 = Crypto.createDecipheriv('rc4', Buffer.from(userSessionKey), '');
+    return [...rc4.update(Buffer.from(encryptedKey))];
+  }
+
+  generateClientSigningKeyUsingNegotiatedSecondarySessionKey(sessionKey)
+  {
+    let md5 = Crypto.createHash('md5');
+    md5.update(Buffer.from(sessionKey));
+    md5.update(this.clientSigningMagicConstant);
+    return [...md5.digest()];
+  }
+
+  generateServerSigningKeyUsingNegotiatedSecondarySessionKey(sessionKey)
+  {
+    let md5 = Crypto.createHash('md5');
+    md5.update(Buffer.from(sessionKey));
+    md5.update(this.serverSigningMagicConstant);
+    return [...md5.digest()];
+  }
+
+  generateClientSealingKeyUsingNegotiatedSecondarySessionKey(sessionKey)
+  {
+    let md5 = Crypto.createHash('md5');
+    md5.update(Buffer.from(sessionKey));
+    md5.update(this.clientSealingMagicConstant);
+    return [...md5.digest()];
+  }
+
+  generateServerSealingKeyUsingNegotiatedSecondarySessionKey(sessionKey)
+  {
+    let md5 = Crypto.createHash('md5');
+    md5.update(Buffer.from(sessionKey));
+    md5.update(this.serverSealingMagicConstant);
+    return [...md5.digest()];
+  }
+
+  getARCFOUR(key)
+  {
+    return Crypto.createCipheriv('rc4', Buffer.from(key), '');
+  }
+
+  applyARCFOUR(cipher, data)
+  {
+    return [...cipher.update(Buffer.from(data))];
+  }
+
+  /**
+   * NTLMSSP with Extended Session Security signing (part 1):
+   * Computes HMAC-MD5 signature over SeqNum + message data.
+   * @param {Number} seqNum
+   * @param {Array} signingKey
+   * @param {Array} message
+   * @param {Number} verifierIndex
+   * @returns {Array} 16-byte verifier: Version(4) + HMAC[0:8](8) + SeqNum(4)
+   */
+  signingPt1(seqNum, signingKey, message, verifierIndex)
+  {
+    let versionBuf = Buffer.alloc(4);
+    versionBuf.writeUInt32LE(1, 0);
+
+    let seqNumBuf = Buffer.alloc(4);
+    seqNumBuf.writeUInt32LE(seqNum, 0);
+
+    let hmac = Crypto.createHmac('md5', Buffer.from(signingKey));
+    hmac.update(seqNumBuf);
+    hmac.update(Buffer.from(message).slice(0, verifierIndex));
+    let mac = hmac.digest();
+
+    let verifier = new Array(16);
+    for (let i = 0; i < 4; i++) verifier[i] = versionBuf[i];
+    for (let i = 0; i < 8; i++) verifier[4 + i] = mac[i];
+    for (let i = 0; i < 4; i++) verifier[12 + i] = seqNumBuf[i];
+
+    return verifier;
+  }
+
+  /**
+   * NTLMSSP signing (part 2): RC4-encrypt the HMAC portion of the verifier.
+   * @param {Array} verifier
+   * @param {Object} cipher - RC4 cipher instance (stateful)
+   */
+  signingPt2(verifier, cipher)
+  {
+    let hmacPart = Buffer.from(verifier.slice(4, 12));
+    let encrypted = cipher.update(hmacPart);
+    for (let i = 0; i < 8; i++) verifier[4 + i] = encrypted[i];
+  }
+
+  /**
+   * Returns true if signatures do NOT match (mismatch indicator).
+   * @param {Array} expected
+   * @param {Array} actual
+   * @returns {Boolean}
+   */
+  compareSignature(expected, actual)
+  {
+    if (expected.length !== actual.length) return true;
+    for (let i = 0; i < expected.length; i++) {
+      if (expected[i] !== actual[i]) return true;
+    }
+    return false;
+  }
+}
+
+module.exports = NTLMKeyFactory;

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmutils.js

@@ -0,0 +1,262 @@
+// @ts-check
+const Crypto = require('crypto');
+const Encdec = require('../../ndr/encdec.js');
+const LegacyEncoding = require('legacy-encoding');
+
+class NtlmUtils 
+{
+    constructor()
+    {
+        this.S8 = [0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25];
+    }
+
+    /**
+     * 
+     * @param {Array} responseKeyNT 
+     * @param {Array} serverChallenge 
+     * @param {Array} clientChallenge 
+     * @param {Number} nanos1601 
+     * @param {avPairs} avPairs 
+     */
+    getNTLMv2Response(responseKeyNT, serverChallenge, clientChallenge, nanos1601, avPairs)
+    {
+        let avPairsLength = avPairs != null ? avPairs.length : 0;
+        let temp =[...Buffer.from(new Array(28 + avPairsLength + 4))];
+
+        Encdec.enc_uint16le(0x00000101, Buffer.from(temp), 0);
+        Encdec.enc_uint32le(0x00000000, Buffer.from(temp), 4);
+        Encdec.enc_uint64le(nanos1601, Buffer.from(temp), 8);
+
+        let aux = clientChallenge.slice(0, 8);
+        let aux_i = 16;
+        while (aux.length > 0) {
+            temp.splice(aux_i++, 1, aux.shift());
+        }
+        
+        Encdec.enc_uint32le(0x00000000, temp, 24);
+
+        if (avPairs != null) {
+            aux = avPairs.slice(0, avPairsLength);
+            aux_i = 28;
+            while (aux.length > 0) {
+                temp.splice(aux_i++, 1, aux.shift());
+            }
+        }
+
+        Encdec.enc_uint32le(0x00000000, temp, 28 + avPairsLength);
+
+        return this.computeResponse(responseKeyNT, serverChallenge, temp, 0, temp.length);
+    }
+
+    /**
+     * 
+     * @param {Array} responeKeyLM 
+     * @param {Array} serverChallenge 
+     * @param {Array} clientChallenge 
+     */
+    getLMv2Response(responeKeyLM, serverChallenge, clientChallenge)
+    {
+        return this.computeResponse(responeKeyLM, serverChallenge, clientChallenge, 0, clientChallenge.length);
+    }
+
+    /**
+     * 
+     * @param {Array} responseKey 
+     * @param {Array} serverChallenge 
+     * @param {Array} clientData 
+     * @param {Number} offset 
+     * @param {Number} length 
+     */
+    computeResponse(responseKey, serverChallenge, clientData, offset, length)
+    {
+        let hmac = Crypto.createHmac('md5',responseKey);
+        hmac.update(serverChallenge);
+        hmac.update(clientData);
+
+        let mac = hmac.digest();
+        let ret = new Array(mac.length + clientData.length);
+
+        let aux = [...mac.slice(0, mac.length)];
+        let aux_i = 0;
+        while (aux.length > 0)
+            ret.splice(aux_i++, 1, aux.shift());
+        
+        aux = clientData.slice(0, clientData.length);
+        aux_i = mac.length;
+        while (aux.length > 0)
+            ret.splice(aux_i++, 1, aux.shift());
+        
+            return ret;    
+    }
+
+    /**
+     * 
+     * @param {String} domain 
+     * @param {String} username 
+     * @param {String} password 
+     */
+    nTOWFv2 (domain, username, password)
+    {
+        let md4 = Crypto.createHmac('md4', '');
+        md4.update(LegacyEncoding.encode(password, 'utf16-le'));
+
+        let hmac = Crypto.createHmac('md5', md4.digest());
+        hmac.update(LegacyEncoding.encode(username.toUpperCase(), 'utf16-le'));
+        hmac.update(LegacyEncoding.encode(domain, 'utf16-le'));
+        
+        return [...hmac.digest()];
+    }
+
+    /**
+     * 
+     * @param {String} password 
+     */
+    nTOWFv1 (password)
+    {
+        if (password == null) {
+            throw new Error("Password parameter is required.");
+        }
+        
+        let md4 = Crypto.createHmac('md4', '');
+        md4.update(LegacyEncoding.encode(password, 'utf16-le'));
+        
+        return [...md4.digest()];
+    }
+
+    /**
+     * 
+     * @param {Array} nTOWFv1 
+     * @param {Array} serverChallenge 
+     * @param {Array} clientChallenge 
+     */
+    getNTLM2Response(nTOWFv1, serverChallenge, clientChallenge)
+    {
+        let sessionHash = new Array(8);
+
+        let md5 = Crypto.createHmac('md5', '');
+        md5.update(serverChallenge);
+        md5.update(clientChallenge);
+
+        let aux = [...md5.digest()].slice(0, 8);
+        let aux_i = 0;
+        while (aux.length > 0) sessionHash.splice(aux_i++, 1, aux.shift());
+        
+        let key = new Array(21);
+        aux = nTOWFv1.slice(0, 16);
+        aux_i = 0;
+        while (aux.length > 0) key.splice(aux_i++, 1, aux.shift());
+
+        let ntResponse = new Array(24);
+        this.E(key, sessionHash, ntResponse);
+
+        return ntResponse;
+    }
+
+    /**
+     * 
+     * @param {String} domain 
+     * @param {String} user 
+     * @param {String} password 
+     * @param {Array} challenge 
+     * @param {Array} clienteChallenge 
+     */
+    getLMv2Reponse (domain, user, password, challenge, clienteChallenge)
+    {
+        let response = new Array(24);
+        let md4 = Cryptol.createHmac('md4', '');
+
+        md4.update(LegacyEncoding.encode(password, 'utf16-le'));
+        let hmac = Crypto.createHmac('md5', md4.digest());
+        hmac.update(LegacyEncoding.encode(user.toUpperCase(), 'utf16-le'));
+        hmac.update(LegacyEncoding.encode(domain.toUpperCase(), 'utf16-le'));
+        hmac = Crypto.createHmac('md5', hmac.digest());
+        hmac.update(challenge);
+        hmac.update(clienteChallenge);
+        
+        let aux = [...hmac.digest()];
+        for (let index = 0; index < 16; index++) {
+            response[index] = aux[i];            
+        }
+
+        aux = clienteChallenge.slice(0, 8);
+        let aux_i = 16;
+        while (aux.length > 0) response.splice(aux_i++, 1, aux.shift());
+        
+        return response;
+    }
+
+    /**
+     * 
+     * @param {String} password 
+     * @param {Array} challenge 
+     */
+    getNTLMResponse (password, challenge)
+    {
+        let p21 = new Array(21);
+        let p24 = new Array(24);
+
+        let uni = LegacyEncoding.encode(password, 'utf16-le');
+        let md4 = Crypto.createHmac('md4', '');
+        md4.update(uni);
+        
+        let aux = [...md4.digest()];
+        for (let index = 0; index < 16; index++) {
+            p21[index] = aux[index];
+        }
+
+        this.E(p21, challenge, p24);
+
+        return p24;
+    }
+
+    /**
+     * 
+     * @param {*} tc 
+     * @param {String} password 
+     * @param {Array} challenge 
+     */
+    getPreNTLMResponse (tc, password, challenge)
+    {
+        let p14 = new Array(14);
+        let p21 = new Array(21);
+        let p24 = new Array(24);
+        let passwordBytes = LegacyEncoding.encode(password, tc.getConfig());
+        let passwordLength = passwordBytes.length;
+
+        if (passwordLength > 14) {
+            passwordLength = 14;
+        }
+
+        let aux = passwordBytes.slice(0, passwordLength);
+        let aux_i = 0;
+        while (aux.length > 0) p14.splice(aux_i++, 1, aux.shift());
+        this.E(p14, this.S8, p21);
+        this.E(p21, challenge, p24);
+
+        return p24;
+    }
+
+    E (key, data, e ) {
+        let key7 = new Array(7);
+        let e8 = new Array(8);
+
+        let aux;
+        let aux_i;
+        for ( let i = 0; i < key.length / 7; i++ ) {
+            aux = key.slice(i * 7, 7);
+            aux_i = 0;
+            while (aux.length > 0) key7.splice(aux_i++, 1, aux.shift());
+            
+            let des = Crypto.createDecipher('des', Buffer.from(key7));
+            aux = des.update(data);
+            for (let j = 0; j < data.length; j++) e8[j] = aux[j];
+            
+            aux = e8.slice(0, 8);
+            aux_i = i * 8;
+            while (aux.length > 0) e.splice(aux_i++, 1, aux.shift());
+        }
+    }
+
+}
+
+module.exports = NtlmUtils;

package/node_modules/@tier0/node-dcom/dcom/rpc/security/responses.js

@@ -0,0 +1,272 @@
+// @ts-check
+
+const Crypto = require('crypto');
+const LegacyEncoding = require('legacy-encoding');
+
+const md4 = require('js-md4');
+
+function createMD4() {
+    let hash = md4.create();
+    return {
+        update: function(data) {
+            hash.update(data);
+            return this;
+        },
+        digest: function() {
+            return Buffer.from(hash.array());
+        }
+    };
+}
+
+class Responses
+{
+    constructor(){}
+
+    /**
+     * @param {String} password 
+     * @param {Array} challenge 
+     */
+    getLMResponse (password, challenge)
+    {
+        let lmHash = this.lmHash(password);
+        return this.lmResponse(lmHash, challenge);
+    }
+
+    /**
+     * @param {String} password 
+     * @param {Array} challenge 
+     */
+    getNTLMResponse (password, challenge)
+    {
+        let ntlmHash = this.ntlmHash(password);
+        return this.lmResponse(ntlmHash, challenge);
+    }
+
+    /**
+     * @param {String} target 
+     * @param {String} user 
+     * @param {String} password 
+     * @param {Array} targetInformation 
+     * @param {Array} challenge 
+     * @param {Array} clientNonce 
+     */
+    getNTLMv2Response (target, user, password, targetInformation, challenge, clientNonce)
+    {
+        let ntlmv2Hash = this.ntlmv2Hash(target, user, password);
+        let blob = this.createBlob(targetInformation, clientNonce);
+        let ntlmv2Response = this.lmv2Response(ntlmv2Hash, blob, challenge);
+
+        return [ntlmv2Response, blob];
+    }
+
+    /**
+     * @param {String} target 
+     * @param {String} user 
+     * @param {String} password 
+     * @param {Array} challenge 
+     * @param {Array} clientNonce 
+     */
+    getLMv2Response (target, user, password, challenge, clientNonce)
+    {
+        let ntlmv2Hash = this.ntlmv2Hash(target, user, password);
+        return this.lmv2Response(ntlmv2Hash, clientNonce, challenge);
+    }
+
+    /**
+     * @param {String} password 
+     * @param {Buffer} challenge 
+     * @param {Buffer} clientNonce 
+     */
+    getNTLM2SessionResponse(password, challenge, clientNonce)
+    {        
+        let ntlm = this.ntlmHash(password);
+        let md5 = Crypto.createHash('md5');
+        
+        let combined = Buffer.concat(
+            [Buffer.from(challenge), Buffer.from(clientNonce)]);
+        md5.update(combined);
+        
+        let sessionHash = md5.digest().slice(0, 8);
+
+        return this.lmResponse(ntlm, sessionHash);
+    }
+
+    /**
+     * @param {String} password 
+     */
+    lmHash (password)
+    {
+        let oemPassword = Buffer.from(password.toUpperCase(), 'ascii');
+        let length = Math.min(oemPassword.length, 14);
+        let keyBytes = Buffer.alloc(14);
+        oemPassword.copy(keyBytes, 0, 0, length);
+
+        let lowKey = this.createDESKey(keyBytes, 0);
+        let highKey = this.createDESKey(keyBytes, 7);
+
+        let magicConstant = LegacyEncoding.encode("KGS!@#$%", "us-ascii");
+
+        let des = Crypto.createCipheriv('des-ecb', Buffer.from(lowKey), '');
+        des.setAutoPadding(false);
+        let lowHash = [...des.update(magicConstant)];
+
+        des = Crypto.createCipheriv('des-ecb', Buffer.from(highKey), '');
+        des.setAutoPadding(false);
+        let highHash = [...des.update(magicConstant)];
+
+        return Buffer.from([...lowHash, ...highHash]);
+    }
+
+    /**
+     * @param {String} password 
+     */
+    ntlmHash (password)
+    {
+        let unicodePassword = Buffer.from(password, 'utf16le');
+
+        let md4 = createMD4();
+
+        md4.update(unicodePassword);
+        
+        return md4.digest();
+    }
+
+    /**
+     * @param {String} target 
+     * @param {String} user 
+     * @param {String} password 
+     */
+    ntlmv2Hash (target, user, password)
+    {
+        let ntlmHash = this.ntlmHash(password);
+        let identity = user.toUpperCase() + target;
+
+        return this.hmacMD5(
+            [...LegacyEncoding.encode(identity, "utf16-le")],
+            [...ntlmHash]);
+    }
+
+    /**
+     * @param {Buffer} hash 
+     * @param {Array} challenge 
+     */
+    lmResponse (hash, challenge)
+    {
+        let hashBuf = Buffer.from(hash);
+        let keyBytes = Buffer.alloc(21);
+        hashBuf.copy(keyBytes, 0, 0, Math.min(hashBuf.length, 21));
+        
+        let lowKey = this.createDESKey(keyBytes, 0);
+        let middleKey = this.createDESKey(keyBytes, 7);
+        let highKey = this.createDESKey(keyBytes, 14);
+        
+        let challengeBuf = Buffer.from(challenge);
+
+        let des = Crypto.createCipheriv("des-ecb", Buffer.from(lowKey), '');
+        des.setAutoPadding(false);
+        let lowResponse = des.update(challengeBuf);
+
+        des = Crypto.createCipheriv("des-ecb", Buffer.from(middleKey), '');
+        des.setAutoPadding(false);
+        let middleResponse = des.update(challengeBuf);
+
+        des = Crypto.createCipheriv("des-ecb", Buffer.from(highKey), '');
+        des.setAutoPadding(false);
+        let highResponse = des.update(challengeBuf);
+
+        return Buffer.concat([lowResponse, middleResponse, highResponse]);
+    }
+
+    /**
+     * @param {Array} hash 
+     * @param {Array} clientData 
+     * @param {Array} challenge 
+     */
+    lmv2Response (hash, clientData, challenge)
+    {
+        let data = [...challenge, ...clientData];
+        let mac = this.hmacMD5(data, hash);
+        return [...mac, ...clientData];
+    }
+
+    /**
+     * @param {Array} targetInformation 
+     * @param {Array} clientNonce 
+     */
+    createBlob (targetInformation, clientNonce)
+    {
+        let blobSignature = [0x01, 0x01, 0x00, 0x00];
+        let reserved = [0x00, 0x00, 0x00, 0x00];
+        let unknown1 = [0x00, 0x00, 0x00, 0x00];
+        let unknown2 = [0x00, 0x00, 0x00, 0x00];
+
+        // Windows FILETIME: 100-nanosecond intervals since 1601-01-01
+        let timeMs = Date.now() + 11644473600000;
+        let time100ns = BigInt(timeMs) * 10000n;
+
+        let timeBuf = Buffer.alloc(8);
+        timeBuf.writeBigUInt64LE(time100ns, 0);
+        let timestamp = [...timeBuf];
+
+        return [
+            ...blobSignature,
+            ...reserved,
+            ...timestamp,
+            ...clientNonce,
+            ...unknown1,
+            ...(targetInformation || []),
+            ...unknown2
+        ];
+    }
+
+    /**
+     * @param {Array} data 
+     * @param {Array} key 
+     */
+    hmacMD5 (data, key)
+    {
+        let hmac = Crypto.createHmac('md5', Buffer.from(key));
+        hmac.update(Buffer.from(data));
+        return [...hmac.digest()];
+    }
+
+    /**
+     * @param {Buffer} bytes 
+     * @param {Number} offset 
+     */
+    createDESKey (bytes, offset)
+    {
+        let keyBytes = bytes.slice(offset, 7 + offset);
+        
+        let material = Buffer.alloc(8);
+        material[0] = keyBytes[0];
+        material[1] = ((keyBytes[0] << 7) & 0xff  | ((keyBytes[1] & 0xff) >>>1));
+        material[2] = ((keyBytes[1] << 6) & 0xff  | ((keyBytes[2] & 0xff) >>>2));
+        material[3] = ((keyBytes[2] << 5) & 0xff  | ((keyBytes[3] & 0xff) >>>3));
+        material[4] = ((keyBytes[3] << 4) & 0xff  | ((keyBytes[4] & 0xff) >>>4));
+        material[5] = ((keyBytes[4] << 3) & 0xff  | ((keyBytes[5] & 0xff) >>>5));
+        material[6] = ((keyBytes[5] << 2) & 0xff  | ((keyBytes[6] & 0xff) >>>6));
+        material[7] = ((keyBytes[6] << 1));
+
+        this.oddParity(material);
+        return material;
+    }
+    
+    /**
+     * @param {Buffer} bytes 
+     */
+    oddParity (bytes)
+    {
+        for (let index = 0; index < bytes.length; index++) {
+            let b = bytes[index];
+            let needsParity = (((b >>> 7) ^ (b >>> 6) ^ (b >>> 5) ^
+                (b >>> 4) ^ (b >>> 3) ^ (b >>> 2) ^(b >>> 1)) & 0x01) == 0;
+            if (needsParity) {
+                bytes[index] |= 0x01;
+            } else {
+                bytes[index] &= 0xfe;
+            }
+        }
+    }
+}
+module.exports = Responses;

package/node_modules/@tier0/node-dcom/dcom/rpc/security.js

@@ -0,0 +1,26 @@
+var NetworkDataRepresentation = require("../ndr/networkdatarepresentation.js");
+
+class Security{
+    constructor(){
+        this.USERNAME = "rpc.security.username";
+
+        this.PASSWORD = "rpc.security.password";
+
+        this.AUTHENTICATION_SERVICE_NONE = 0;
+
+        this.PROTECTION_LEVEL_NONE = 1;
+
+        this.PROTECTION_LEVEL_CONNECT = 2;
+
+        this.PROTECTION_LEVEL_CALL = 3;
+
+        this.PROTECTON_LEVEL_PACKET = 4;
+
+        this.PROTECTION_LEVEL_INTEGRITY = 5;
+
+        this.PROTECTION_LEVEL_PRIVACY = 6;
+    }
+  //TO-DO: functions implemented by NTLM1.java
+}
+
+module.exports = Security;