ai-remote 0.1.0

package/src/protocols/rdp/ntlm.ts

@@ -0,0 +1,380 @@
+// NTLMv2 (MS-NLMP), the authentication CredSSP carries for a local Windows
+// account. MD5, RC4 and the HMAC construction already exist for RDP Standard
+// Security; only MD4 and the NTLM message formats are new here.
+
+import { Writer, concatBytes } from './buffer';
+import { md5, rc4Crypt, rc4Init } from './crypto';
+
+// --- MD4 (RFC 1320), used only to hash the password ------------------------
+
+function rotl32(value, count: number) {
+  return (value << count) | (value >>> (32 - count));
+}
+
+export function md4(message: string) {
+  const blockCount = Math.floor((message.length + 8) / 64) + 1;
+  const padded = new Uint8Array(blockCount * 64);
+  padded.set(message);
+  padded[message.length] = 0x80;
+
+  const view = new DataView(padded.buffer);
+  const bitLength = message.length * 8;
+  view.setUint32(padded.length - 8, bitLength >>> 0, true);
+  view.setUint32(padded.length - 4, Math.floor(bitLength / 4294967296), true);
+
+  let a0 = 0x67452301, b0 = 0xefcdab89, c0 = 0x98badcfe, d0 = 0x10325476;
+  const x = new Uint32Array(16);
+
+  const round1Shifts = [3, 7, 11, 19];
+  const round2Order = [0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15];
+  const round2Shifts = [3, 5, 9, 13];
+  const round3Order = [0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15];
+  const round3Shifts = [3, 9, 11, 15];
+
+  for (let block = 0; block < blockCount; block++) {
+    for (let i = 0; i < 16; i++) x[i] = view.getUint32(block * 64 + i * 4, true);
+
+    let a = a0, b = b0, c = c0, d = d0;
+    const step = (value, shift) => rotl32(value | 0, shift);
+
+    for (let i = 0; i < 16; i++) {
+      const f = (b & c) | (~b & d);
+      const shift = round1Shifts[i % 4];
+      const next = step((a + f + x[i]) | 0, shift);
+      a = d; d = c; c = b; b = next;
+    }
+    for (let i = 0; i < 16; i++) {
+      const g = (b & c) | (b & d) | (c & d);
+      const shift = round2Shifts[i % 4];
+      const next = step((a + g + x[round2Order[i]] + 0x5a827999) | 0, shift);
+      a = d; d = c; c = b; b = next;
+    }
+    for (let i = 0; i < 16; i++) {
+      const h = b ^ c ^ d;
+      const shift = round3Shifts[i % 4];
+      const next = step((a + h + x[round3Order[i]] + 0x6ed9eba1) | 0, shift);
+      a = d; d = c; c = b; b = next;
+    }
+
+    a0 = (a0 + a) | 0;
+    b0 = (b0 + b) | 0;
+    c0 = (c0 + c) | 0;
+    d0 = (d0 + d) | 0;
+  }
+
+  const digest = new Uint8Array(16);
+  const out = new DataView(digest.buffer);
+  out.setUint32(0, a0 >>> 0, true);
+  out.setUint32(4, b0 >>> 0, true);
+  out.setUint32(8, c0 >>> 0, true);
+  out.setUint32(12, d0 >>> 0, true);
+  return digest;
+}
+
+/** HMAC-MD5. WebCrypto has no MD5, so it is built from the MD5 here. */
+export function hmacMd5(key: Uint8Array, message: string) {
+  const blockSize = 64;
+  const normalized = key.length > blockSize ? md5(key) : key;
+  const padded = new Uint8Array(blockSize);
+  padded.set(normalized);
+
+  const inner = new Uint8Array(blockSize);
+  const outer = new Uint8Array(blockSize);
+  for (let i = 0; i < blockSize; i++) {
+    inner[i] = padded[i] ^ 0x36;
+    outer[i] = padded[i] ^ 0x5c;
+  }
+
+  return md5(concatBytes(outer, md5(concatBytes(inner, message))));
+}
+
+// --- NTLM messages ----------------------------------------------------------
+
+const NTLMSSP_SIGNATURE = new Uint8Array([0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00]);
+
+export const NTLM_FLAG = {
+  UNICODE: 0x00000001,
+  REQUEST_TARGET: 0x00000004,
+  SIGN: 0x00000010,
+  SEAL: 0x00000020,
+  NTLM: 0x00000200,
+  ALWAYS_SIGN: 0x00008000,
+  EXTENDED_SESSION_SECURITY: 0x00080000,
+  TARGET_INFO: 0x00800000,
+  VERSION: 0x02000000,
+  KEY_128: 0x20000000,
+  KEY_EXCH: 0x40000000,
+  KEY_56: 0x80000000,
+};
+
+// CredSSP needs SEAL and KEY_EXCH: the sealing keys are what protect the
+// public-key binding and the credentials.
+const CLIENT_FLAGS =
+  NTLM_FLAG.UNICODE |
+  NTLM_FLAG.REQUEST_TARGET |
+  NTLM_FLAG.SIGN |
+  NTLM_FLAG.SEAL |
+  NTLM_FLAG.NTLM |
+  NTLM_FLAG.ALWAYS_SIGN |
+  NTLM_FLAG.EXTENDED_SESSION_SECURITY |
+  NTLM_FLAG.TARGET_INFO |
+  NTLM_FLAG.VERSION |
+  NTLM_FLAG.KEY_128 |
+  NTLM_FLAG.KEY_EXCH |
+  NTLM_FLAG.KEY_56;
+
+const MSV_AV_EOL = 0x0000;
+const MSV_AV_TIMESTAMP = 0x0007;
+const MSV_AV_FLAGS = 0x0006;
+const MSV_AV_FLAGS_MIC = 0x00000002;
+
+const utf16 = (text: string) => {
+  const writer = new Writer(text.length * 2 + 2);
+  writer.utf16le(text);
+  return writer.take();
+};
+
+/** Windows 10 build 19041, which is what a current client reports. */
+const VERSION_FIELD = new Uint8Array([10, 0, 0x63, 0x45, 0x00, 0x00, 0x00, 0x0f]);
+
+export function negotiateMessage() {
+  const writer = new Writer(40);
+  writer.raw(NTLMSSP_SIGNATURE);
+  writer.u32le(1);              // MessageType: NEGOTIATE
+  writer.u32le(CLIENT_FLAGS >>> 0);
+  writer.u16le(0).u16le(0).u32le(0); // DomainNameFields: absent
+  writer.u16le(0).u16le(0).u32le(0); // WorkstationFields: absent
+  writer.raw(VERSION_FIELD);
+  return writer.take();
+}
+
+export function parseChallengeMessage(bytes: Uint8Array) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (view.getUint32(8, true) !== 2) {
+    throw new Error('NTLM: the host did not answer with a challenge message');
+  }
+
+  const targetNameLength = view.getUint16(12, true);
+  const targetNameOffset = view.getUint32(16, true);
+  const flags = view.getUint32(20, true);
+  const serverChallenge = bytes.subarray(24, 32).slice();
+  const targetInfoLength = view.getUint16(40, true);
+  const targetInfoOffset = view.getUint32(44, true);
+
+  return {
+    flags,
+    serverChallenge,
+    targetName: bytes.subarray(targetNameOffset, targetNameOffset + targetNameLength).slice(),
+    targetInfo: bytes.subarray(targetInfoOffset, targetInfoOffset + targetInfoLength).slice(),
+  };
+}
+
+/** Walk the AV pair list the host sent, so its timestamp can be reused. */
+function readAvPairs(targetInfo) {
+  const pairs = [];
+  let offset = 0;
+  const view = new DataView(targetInfo.buffer, targetInfo.byteOffset, targetInfo.byteLength);
+
+  while (offset + 4 <= targetInfo.length) {
+    const id = view.getUint16(offset, true);
+    const length = view.getUint16(offset + 2, true);
+    const value = targetInfo.subarray(offset + 4, offset + 4 + length);
+    offset += 4 + length;
+    if (id === MSV_AV_EOL) break;
+    pairs.push({ id, value });
+  }
+
+  return pairs;
+}
+
+function writeAvPairs(pairs) {
+  const writer = new Writer(256);
+  for (const pair of pairs) {
+    writer.u16le(pair.id);
+    writer.u16le(pair.value.length);
+    writer.raw(pair.value);
+  }
+  writer.u16le(MSV_AV_EOL).u16le(0);
+  return writer.take();
+}
+
+/** Windows FILETIME: 100ns ticks since 1601. */
+function fileTimeNow() {
+  const ticks = (BigInt(Date.now()) + 11644473600000n) * 10000n;
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, ticks, true);
+  return out;
+}
+
+/**
+ * Build the AUTHENTICATE message plus every key CredSSP needs afterwards.
+ *
+ * The MIC is always sent: a current Windows host expects one, and sending it
+ * obliges the client to flag it in the AV pair list, which in turn feeds the
+ * NTProofStr -- so the modified list has to be the one that goes on the wire.
+ */
+export function authenticateMessage({ username, domain, password, challenge, negotiateBytes, challengeBytes }) {
+  const responseKey = hmacMd5(
+    md4(utf16(password)),
+    utf16(username.toUpperCase() + domain)
+  );
+
+  const pairs = readAvPairs(challenge.targetInfo);
+  const timestamp = pairs.find((pair) => pair.id === MSV_AV_TIMESTAMP)?.value.slice() || fileTimeNow();
+
+  const flagsPair = pairs.find((pair) => pair.id === MSV_AV_FLAGS);
+  if (flagsPair) {
+    const view = new DataView(flagsPair.value.buffer, flagsPair.value.byteOffset, 4);
+    view.setUint32(0, view.getUint32(0, true) | MSV_AV_FLAGS_MIC, true);
+  } else {
+    const value = new Uint8Array(4);
+    new DataView(value.buffer).setUint32(0, MSV_AV_FLAGS_MIC, true);
+    pairs.push({ id: MSV_AV_FLAGS, value });
+  }
+  const targetInfo = writeAvPairs(pairs);
+
+  const clientChallenge = new Uint8Array(8);
+  crypto.getRandomValues(clientChallenge);
+
+  const temp = concatBytes(
+    new Uint8Array([0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]), // version, reserved
+    timestamp,
+    clientChallenge,
+    new Uint8Array(4),
+    targetInfo,
+    new Uint8Array(4)
+  );
+
+  const proof = hmacMd5(responseKey, concatBytes(challenge.serverChallenge, temp));
+  const ntResponse = concatBytes(proof, temp);
+  const sessionBaseKey = hmacMd5(responseKey, proof);
+
+  // With KEY_EXCH the client picks the session key and sends it sealed.
+  const exportedSessionKey = new Uint8Array(16);
+  crypto.getRandomValues(exportedSessionKey);
+  const encryptedSessionKey = rc4Crypt(rc4Init(sessionBaseKey), exportedSessionKey);
+
+  const domainBytes = utf16Trimmed(domain);
+  const userBytes = utf16Trimmed(username);
+  const workstationBytes = utf16Trimmed('');
+  const lmResponse = new Uint8Array(24);
+
+  const headerLength = 72;
+  let offset = headerLength;
+  const layout = [];
+  const place = (bytes: Uint8Array) => {
+    layout.push({ bytes, offset });
+    offset += bytes.length;
+    return layout[layout.length - 1];
+  };
+
+  const lm = place(lmResponse);
+  const nt = place(ntResponse);
+  const dom = place(domainBytes);
+  const user = place(userBytes);
+  const workstation = place(workstationBytes);
+  const sessionKey = place(encryptedSessionKey);
+
+  const writer = new Writer(offset + 16);
+  writer.raw(NTLMSSP_SIGNATURE);
+  writer.u32le(3); // MessageType: AUTHENTICATE
+  const field = (entry) => {
+    writer.u16le(entry.bytes.length);
+    writer.u16le(entry.bytes.length);
+    writer.u32le(entry.offset + 16); // the MIC sits between header and payload
+  };
+  field(lm);
+  field(nt);
+  field(dom);
+  field(user);
+  field(workstation);
+  field(sessionKey);
+  writer.u32le(CLIENT_FLAGS >>> 0);
+  writer.raw(VERSION_FIELD);
+  writer.zeros(16); // MIC, filled in below
+  for (const entry of layout) writer.raw(entry.bytes);
+
+  const message = writer.take();
+  const mic = hmacMd5(
+    exportedSessionKey,
+    concatBytes(negotiateBytes, challengeBytes, message)
+  );
+  message.set(mic, headerLength);
+
+  return {
+    message,
+    exportedSessionKey,
+    keys: sessionKeys(exportedSessionKey),
+  };
+}
+
+function utf16Trimmed(text: string) {
+  if (!text) return new Uint8Array(0);
+  const bytes = utf16(text);
+  // utf16le() appends no terminator, but Writer sizing may leave slack.
+  return bytes.subarray(0, text.length * 2).slice();
+}
+
+const CLIENT_SIGNING = 'session key to client-to-server signing key magic constant\0';
+const SERVER_SIGNING = 'session key to server-to-client signing key magic constant\0';
+const CLIENT_SEALING = 'session key to client-to-server sealing key magic constant\0';
+const SERVER_SEALING = 'session key to server-to-client sealing key magic constant\0';
+
+function sessionKeys(exportedSessionKey) {
+  const derive = (label: string) => md5(concatBytes(exportedSessionKey, new TextEncoder().encode(label)));
+
+  return {
+    clientSigningKey: derive(CLIENT_SIGNING),
+    serverSigningKey: derive(SERVER_SIGNING),
+    clientSealing: rc4Init(derive(CLIENT_SEALING)),
+    serverSealing: rc4Init(derive(SERVER_SEALING)),
+  };
+}
+
+/**
+ * NTLM message confidentiality (MS-NLMP 3.4.3). The signature covers the
+ * plaintext, and both the payload and the checksum draw from the same RC4
+ * stream -- payload first.
+ */
+export class NtlmSealer {
+  private readonly keys: NtlmSessionKeys;
+  private sendSequence: number;
+  private receiveSequence: number;
+
+  constructor(keys) {
+    this.keys = keys;
+    this.sendSequence = 0;
+    this.receiveSequence = 0;
+  }
+
+  seal(plaintext: Uint8Array) {
+    const sequence = new Uint8Array(4);
+    new DataView(sequence.buffer).setUint32(0, this.sendSequence, true);
+
+    const digest = hmacMd5(this.keys.clientSigningKey, concatBytes(sequence, plaintext));
+    const sealed = rc4Crypt(this.keys.clientSealing, plaintext);
+    const checksum = rc4Crypt(this.keys.clientSealing, digest.subarray(0, 8));
+
+    this.sendSequence += 1;
+    return concatBytes(new Uint8Array([1, 0, 0, 0]), checksum, sequence, sealed);
+  }
+
+  unseal(bytes: Uint8Array) {
+    if (bytes.length < 16) throw new Error('NTLM: sealed message is too short');
+    const sealed = bytes.subarray(16);
+    const plaintext = rc4Crypt(this.keys.serverSealing, sealed);
+
+    // The checksum is verified so a tampered pubKeyAuth is reported as such
+    // rather than surfacing later as a confusing protocol error.
+    const sequence = bytes.subarray(12, 16);
+    const digest = hmacMd5(this.keys.serverSigningKey, concatBytes(sequence, plaintext));
+    const expected = rc4Crypt(this.keys.serverSealing, digest.subarray(0, 8));
+    const actual = bytes.subarray(4, 12);
+    if (!expected.every((byte, i) => byte === actual[i])) {
+      throw new Error('NTLM: the host signature did not verify');
+    }
+
+    this.receiveSequence += 1;
+    return plaintext;
+  }
+}