badauth 0.1.0__tar.gz

badauth-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Tamas Jos (@skelsec)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

badauth-0.1.0/MANIFEST.in

@@ -0,0 +1,2 @@
+include LICENSE
+include README.md

badauth-0.1.0/PKG-INFO

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: badauth
+Version: 0.1.0
+Summary: Unified authentication library
+Home-page: https://github.com/CravateRouge/badauth
+Author: Tamas Jos
+Author-email: info@skelsecprojects.com
+Maintainer: Baptiste Crépin
+Maintainer-email: baptiste@cravaterouge.com
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+License-File: LICENSE
+Requires-Dist: unicrypto>=0.0.10
+Requires-Dist: asn1crypto>=1.3.0
+Requires-Dist: asysocks>=0.2.11
+Requires-Dist: kerbad>=0.5.3
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+Unified authentication library

badauth-0.1.0/README.md

@@ -0,0 +1 @@
+# badauth

badauth-0.1.0/badauth/__init__.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+#
+# Author:
+#  Tamas Jos (@skelsec)
+#
+
+import logging
+
+logger = logging.getLogger('badauth')
+handler = logging.StreamHandler()
+formatter = logging.Formatter(
+        '%(asctime)s %(name)-12s %(levelname)-8s %(message)s')
+handler.setFormatter(formatter)
+logger.addHandler(handler)
+logger.setLevel(logging.INFO)
+logger.propagate = False

badauth-0.1.0/badauth/_version.py

@@ -0,0 +1,8 @@
+
+__version__ = "0.1.0"
+__banner__ = \
+"""
+# badauth %s 
+# Author: Tamas Jos @skelsec (info@skelsecprojects.com)
+# Current Maintainer: Baptiste Crépin (baptiste@cravaterouge.com)
+""" % __version__

badauth-0.1.0/badauth/common/clientauthalgo.py

@@ -0,0 +1,49 @@
+from typing import Tuple
+from badauth.common.winapi.constants import ISC_REQ
+from badauth.common.credentials import UniCredential
+
+class ClientAuthAlgo:
+	def __init__(self, credential:UniCredential):
+		pass
+
+	#def is_guest(self):
+	#	raise NotImplementedError()
+
+	def get_seq_number(self) -> int:
+		"""Returns the !INITIAL! sequence number"""
+		raise NotImplementedError()
+	
+	def get_session_key(self) -> bytes:
+		"""Returns session key bytes"""
+		raise NotImplementedError()
+
+	async def encrypt(self, data:bytes, sequence_no:int):
+		"""Encryptes message"""
+		raise NotImplementedError()
+
+	async def decrypt(self, data:bytes, sequence_no:int, direction='init', auth_data=None) -> Tuple[bytes, Exception]:
+		"""Decrypts message. Also performs integrity checking."""
+		raise NotImplementedError()
+
+	async def sign(self, data:bytes, message_no:int, direction:str=None, reset_cipher:bool = False) -> bytes:
+		"""Singing outgoing messages. The reset_cipher parameter is needed for calculating mechListMIC."""
+		raise NotImplementedError()
+
+	async def verify(self, data:bytes, signature:bytes) -> bool:
+		"""Verifying message signature"""
+		raise NotImplementedError()
+	
+	def signing_needed(self) -> bool:
+		"""Returns wether signing is negotiated for this client"""
+		raise NotImplementedError()
+	
+	def encryption_needed(self) -> bool:
+		"""Returns wether encryption is negotiated for this client"""
+		raise NotImplementedError()
+		
+	def get_session_key(self) -> bytes:
+		"""Returns the session key bytes"""
+		raise NotImplementedError()
+
+	async def authenticate(self, authData:bytes, flags:ISC_REQ = None, cb_data:bytes = None, spn:str=None): # -> Tuple[bytes, bool, Exception]
+		raise NotImplementedError()

badauth-0.1.0/badauth/common/constants.py

@@ -0,0 +1,64 @@
+import enum
+
+class asyauthProtocol(enum.Enum):
+	NONE = 'NONE'
+	SIMPLE = 'SIMPLE'
+	PLAIN = 'PLAIN'
+	SICILY = 'SICILY'
+	NTLM = 'NTLM'
+	KERBEROS = 'KERBEROS'
+	CREDSSP = 'CREDSSP'
+	SPNEGO = 'SPNEGO'
+	SPNEGOEX = 'SPNEGOEX'
+	SSL = 'SSL' # SSL/TLS schannel later
+	SYS = 'SYS' #NFS
+	NULL = 'NULL' #NFS
+	SPNEGO_NTLM = 'SPNEGO_NTLM'
+	SPNEGO_KERBEROS = 'SPNEGO_KERBEROS'
+	CREDSSP_NTLM = 'CREDSSP_NTLM'
+	CREDSSP_KERBEROS = 'CREDSSP_KERBEROS'
+
+class asyauthSubProtocol(enum.Enum):
+	NATIVE = 'NATIVE'
+	SSPI = 'SSPI'
+	WSNET = 'WSNET'
+	WSNETDIRECT = 'WSNETDIRECT'
+	SSPIPROXY = 'SSPIPROXY'
+	CUSTOM = 'CUSTOM'
+
+class asyauthSecret(enum.Enum):
+	NONE = 'NONE'
+	PASSWORD = 'PASSWORD'
+	PASS = 'PASS'
+	PW = 'PW'
+	PWB64 = 'PWB64'
+	PWPROMPT = 'PWPROMPT'
+	PWHEX = 'PWHEX'
+	LM = 'LM'
+	NT = 'NT'
+	RC4 = 'RC4'
+	AES = 'AES'
+	CCACHE = 'CCACHE'
+	CCACHEHEX = 'CCACHEHEX'
+	CCACHEB64 = 'CCACHEB64'
+	KEYTAB = 'KEYTAB'
+	KEYTABHEX = 'KEYTABHEX'
+	KEYTABB64 = 'KEYTABB64'
+	PFX = 'PFX'
+	PFXB64 = 'PFXB64'
+	PFXHEX = 'PFXHEX'
+	PFXSTR = 'PFXSTR'
+	PEM = 'PEM'
+	CERTSTORE = 'CERTSTORE'
+	KIRBI = 'KIRBI'
+	KIRBIHEX = 'KIRBIHEX'
+	KIRBIB64 = 'KIRBIB64'
+	DES = 'DES'
+	TDES = 'TDES'
+	DES3 = 'DES3'
+	SSHPRIVKEY = 'SSHPRIVKEY'
+	SSHPRIVKEYSTR = 'SSHPRIVKEYSTR'
+	SSHPRIVKEYB64 = 'SSHPRIVKEYB64'
+	SYS = 'SYS' #NFS
+	NULL = 'NULL' #NFS
+	WSNET = 'WSNET'

badauth-0.1.0/badauth/common/credentials/__init__.py

@@ -0,0 +1,390 @@
+import base64
+import platform
+import copy
+from urllib.parse import urlparse, parse_qs, unquote
+from badauth.utils.paramprocessor import str_one, int_one, bool_one
+from badauth.common.constants import asyauthSecret, asyauthProtocol, asyauthSubProtocol
+from badauth.common.subprotocols import SubProtocol, SubProtocolNative, SubProtocolSSPI
+
+class UniCredential:
+	def __init__(self, secret:str = None, username:str = None, domain:str = None, stype:asyauthSecret = asyauthSecret.NONE, protocol:asyauthProtocol = None, subprotocol:SubProtocol = SubProtocolNative(), **kwargs):
+		self.domain = domain
+		self.username = username
+		self.secret = secret
+		self.stype = stype
+		self.protocol = protocol
+		self.subprotocol = subprotocol
+		self.metadata = kwargs
+
+		if stype in [asyauthSecret.PASS, asyauthSecret.PW]:
+			self.stype = asyauthSecret.PASSWORD
+		elif stype == asyauthSecret.PWB64:
+			self.stype = asyauthSecret.PASSWORD
+			self.secret = base64.b64decode(self.secret).decode()
+		elif stype == asyauthSecret.PWHEX:
+			self.stype = asyauthSecret.PASSWORD
+			self.secret = bytes.fromhex(self.secret).decode()
+		elif stype == asyauthSecret.PWPROMPT:
+			import getpass
+			self.stype = asyauthSecret.PASSWORD
+			self.secret = getpass.getpass('Enter password: ')
+	
+	def build_context(self, protocol=None, target = None, **kwargs):
+		if protocol is None:
+			protocol = self.protocol
+		
+		if protocol == asyauthProtocol.NTLM:
+			if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+				from badauth.common.credentials.ntlm import NTLMCredential
+				return NTLMCredential(self.secret, self.username, self.domain, self.stype, subprotocol=self.subprotocol, **kwargs).build_context()
+			else:
+				raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+		
+		elif protocol == asyauthProtocol.KERBEROS:
+			if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+				from badauth.common.credentials.kerberos import KerberosCredential
+				return KerberosCredential(
+					self.secret, 
+					self.username, 
+					self.domain, 
+					self.stype, 
+					subprotocol=self.subprotocol, 
+					target=target, 
+					**kwargs
+				).build_context()
+			else:
+				raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+		
+		elif protocol == asyauthProtocol.SPNEGO:
+			if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+				from badauth.common.credentials.spnego import SPNEGOCredential
+				return SPNEGOCredential([self.build_context(target=target, **kwargs)], subprotocol=self.subprotocol).build_context()
+			else:
+				raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+		
+		elif protocol == asyauthProtocol.SPNEGOEX:
+			if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+				from badauth.common.credentials.spnegoex import SPNEGOEXCredential
+				return SPNEGOEXCredential([self.build_context(target=target, **kwargs)], subprotocol=self.subprotocol).build_context()
+			else:
+				raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+		
+		elif protocol == asyauthProtocol.CREDSSP:
+			if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+				from badauth.common.credentials.credssp import CREDSSPCredential
+				return CREDSSPCredential([self.build_context(target=target, **kwargs)], subprotocol=self.subprotocol).build_context()
+			else:
+				raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+		
+		else:
+			return copy.deepcopy(self)
+		
+	@staticmethod
+	def get_url_params():
+		return {
+			'timeout' : int_one,
+			'dns' : str_one,
+			'dnsc' : str_one, #cross-domain DNS
+			'dc' : str_one,
+			'dcc' : str_one, #cross-domain DC IP
+			'realmc' : str_one, #cross-domain realm
+		}
+
+	@staticmethod
+	def from_url(connection_url):
+		from asysocks.unicomm.common.target import UniTarget, UniProto
+
+		secret = None
+		username = None
+		domain = None
+		stype = asyauthSecret.NONE
+		protocol = asyauthProtocol.NONE
+		subprotocol = SubProtocolNative()
+		url_e = urlparse(connection_url)
+		url_dict = url_e._asdict()
+		for prop, val in url_dict.items():
+			if type(val) is str and prop != 'query':
+				url_dict[prop] = unquote(val)
+		url_e = url_e._replace(**url_dict)
+		schemes = url_e.scheme.upper().split('+')
+		if len(schemes) == 1:
+			try:
+				protocol = asyauthProtocol(schemes)
+			except:
+				pass
+		else:
+			auth_tags = schemes[1].replace('-','_')
+			try:
+				protocol = asyauthProtocol(auth_tags)
+			except:
+				auth_tags = schemes[1].split('-')
+				if len(auth_tags) > 1:
+					try:
+						spt = asyauthSubProtocol(auth_tags[0])
+					except:
+						protocol = asyauthProtocol(auth_tags[0])
+						stype = asyauthSecret(auth_tags[1])
+					else:
+						protocol = asyauthProtocol(auth_tags[1])
+						query = None
+						if url_e.query is not None:
+							query = parse_qs(url_e.query)
+						subprotocol = SubProtocol.from_url_params(spt, query)
+						
+				else:
+					try:
+						spt = asyauthSubProtocol(auth_tags[0])
+						protocol = asyauthProtocol.NTLM
+					except:
+						protocol = asyauthProtocol(auth_tags[0])
+						
+		if url_e.username is not None:
+			if url_e.username.find('\\') != -1:
+				domain, username = url_e.username.split('\\')
+				if domain == '.':
+					domain = None
+			else:
+				domain = None
+				username = url_e.username
+		
+		secret = url_e.password
+		credobj = None
+		if protocol == asyauthProtocol.KERBEROS:
+			from badauth.common.credentials.kerberos import KerberosCredential
+			credobj = KerberosCredential
+		
+		elif protocol in [asyauthProtocol.NTLM, asyauthProtocol.SICILY]:
+			from badauth.common.credentials.ntlm import NTLMCredential
+			credobj = NTLMCredential
+
+		extraparams = {}
+		if credobj is not None:
+			extraparams = credobj.get_url_params()
+
+		paramstemplate = UniCredential.get_url_params()
+		params = dict.fromkeys(UniCredential.get_url_params(),None)
+		extra = dict.fromkeys(extraparams.keys(),None)
+		proxy_present = False
+		if url_e.query is not None:
+			query = parse_qs(url_e.query)
+			for k in query:
+				if k.startswith('proxy') is True:
+					proxy_present = True
+				if k in params:
+					params[k] = paramstemplate[k](query[k])
+				if k in extraparams:
+					extra[k] = extraparams[k](query[k])
+		
+		if protocol in [asyauthProtocol.NTLM, asyauthProtocol.SICILY]:
+			res = credobj(
+				secret,
+				username, 
+				domain,
+				stype,
+				subprotocol=subprotocol,
+				**extra
+			)
+			if protocol == asyauthProtocol.SICILY:
+				res.protocol = asyauthProtocol.SICILY
+			return res
+		
+		elif protocol == asyauthProtocol.KERBEROS:
+			proxies = None
+			if proxy_present is True:
+				from asysocks.unicomm.common.proxy import UniProxyTarget
+				proxies = UniProxyTarget.from_url_params(url_e.query, url_e.hostname,endpoint_port=88)
+
+			target = None
+			if extra['dc'] is not None:
+				target = UniTarget(extra['dc'], 88, UniProto.CLIENT_TCP, proxies = proxies, dns=params['dns'], dc_ip=extra['dc'])
+
+			cross_target = None
+			if extra['dcc'] is not None:
+				cross_target = UniTarget(extra['dcc'], 88, UniProto.CLIENT_TCP, proxies = proxies, dns=params['dnsc'], dc_ip=extra['dcc'])
+
+			etypes = extra['etype']
+
+			return credobj(
+				secret, 
+				username, 
+				domain, 
+				stype, 
+				target = target, 
+				altname = extra['altname'], 
+				altdomain = extra['altdomain'],
+				certdata=extra['certdata'],
+				keydata=extra['keydata'],
+				etypes = etypes, 
+				subprotocol = subprotocol,
+				cross_target = cross_target,
+				cross_realm = extra['realmc'],
+			)
+		else:
+			return UniCredential(
+				secret,
+				username,
+				domain,
+				stype,
+				protocol,
+				subprotocol
+			)
+
+	def __str__(self):
+		import enum
+		t = '==== UniCredential ====\r\n'
+		for k in self.__dict__:
+			val = self.__dict__[k]
+			if isinstance(val, enum.IntFlag):
+				val = val
+			elif isinstance(val, enum.Enum):
+				val = val.name
+			
+			t += '%s: %s\r\n' % (k, str(val))
+			
+		return t
+	
+	@staticmethod
+	def get_sspi_ntlm():
+		"""Returns an NTLM credential object matching the current user (Windows only)"""
+		if platform.system() != 'Windows':
+			raise Exception('This function only works on Windows systems!')
+		from winacl.functions.highlevel import get_logon_info
+		from badauth.common.credentials.ntlm import NTLMCredential
+		userinfo = get_logon_info()
+		return NTLMCredential(
+			None,
+			userinfo['username'],
+			userinfo['domain'],
+			stype=asyauthSecret.NONE,
+			subprotocol = SubProtocolSSPI()
+		)
+	
+	@staticmethod
+	def get_sspi_kerberos():
+		"""Returns a Kerberos credential object matching the current user (Windows only)"""
+		if platform.system() != 'Windows':
+			raise Exception('This function only works on Windows systems!')
+		from winacl.functions.highlevel import get_logon_info
+		from badauth.common.credentials.kerberos import KerberosCredential
+		from asysocks.unicomm.common.target import UniTarget, UniProto
+		userinfo = get_logon_info()
+		dctarget = UniTarget(
+			userinfo['logonserver'], 
+			88, 
+			UniProto.CLIENT_TCP, 
+			dc_ip=userinfo['logonserver'],
+			domain = userinfo['dnsdomainname'],
+		)
+		return KerberosCredential(
+			None,
+			userinfo['username'],
+			userinfo['dnsdomainname'],
+			stype=asyauthSecret.NONE,
+			target=dctarget,
+			subprotocol = SubProtocolSSPI()
+		)
+
+	@staticmethod
+	def get_sspi(authtype:str):
+		if platform.system() != 'Windows':
+			raise Exception('This function only works on Windows systems!')
+		if authtype.upper() == 'NTLM':
+			credobj = UniCredential.get_sspi_ntlm()
+		elif authtype.upper() == 'KERBEROS':
+			credobj = UniCredential.get_sspi_kerberos()
+		else:
+			raise Exception('Only NTLM or KERBEROS auth types supported here!')
+		return credobj
+
+	@staticmethod
+	def get_sspi_spnego(authtype:str):
+		"""Returns a SPNEGO credential object matching the current user (Windows only)"""
+		if platform.system() != 'Windows':
+			raise Exception('This function only works on Windows systems!')
+		from badauth.common.credentials.spnego import SPNEGOCredential
+		credobj = UniCredential.get_sspi(authtype)
+		return SPNEGOCredential([credobj])
+	
+	@staticmethod
+	def get_sspi_spnego(authtype:str):
+		"""Returns a CREDSSP credential object matching the current user (Windows only)"""
+		if platform.system() != 'Windows':
+			raise Exception('This function only works on Windows systems!')
+		from badauth.common.credentials.credssp import CREDSSPCredential
+		credobj = UniCredential.get_sspi(authtype)
+		return CREDSSPCredential([credobj])
+	
+	@staticmethod
+	def get_help(protocol:str = '', authprotos:str = '', extraparams:str = ''):
+		"""Returns user help regarding the credential url format"""
+		template = """
+URL format:
+
+	protocol+authproto-secrettype://[domain]\\username:secret@[ip|hostname]:[port]/?param1=value1&param2=value2
+
+protocol: The protocol to use (see below)
+	%s
+authproto (protocol dependent): 
+	%s
+username: The username to authenticate with
+secret: The secret to authenticate with (depends on secrettype)
+domain: The domain of the user
+secrettype: The type of the secret (see below)
+	password/pw/pass: A plaintext password
+	pwb64: A base64 encoded password
+	pwprompt: Password will be prompted for on STDIN
+	pwhex: A hex encoded password
+	nt: NT hash
+	==== Kerberos only ====
+	rc4: RC4 key (Kerberos only)
+	aes: AES key (any size, Kerberos only)
+	aes128: AES128 key (Kerberos only)
+	aes256: AES256 key (Kerberos only)
+	ccache: ccache file name (only local directory)
+	ccachehex: A hex encoded ccache file
+	ccacheb64: A base64 encoded ccache file
+	keytab: keytab file name (only local directory)
+	keytabhex: A hex encoded keytab file
+	keytabb64: A base64 encoded keytab file
+	pfx: pfx file name (only local directory)
+	pfxhex: A hex encoded pfx file
+	pfxb64: A base64 encoded pfx file
+	pem: pem file name (only local directory)
+	pemhex: A hex encoded pem file
+	pemb64: A base64 encoded pem file
+	certstore: Use Windows certificate store (Windows only, Kerberos only)
+	kirbi: kirbi file name (only local directory)
+	kirbihex: A hex encoded kirbi file
+	kirbib64: A base64 encoded kirbi file
+	==== SSH Only ====
+	sshprivkey: ssh private key file name (only local directory)
+	sshprivkeystr: ssh private key file data in string format
+	sshprivkeyb64: A base64 encoded ssh private key file
+
+Extra parameters are in the form of param=value. The following parameters are supported:
+	altname: Alternative name for certificate authentication
+	altdomain: Alternative domain for certificate authentication
+	etype: Supported encryption type to use (Kerberos only)
+	dc: The domain controller to use (Kerberos only)
+	dns: Don't use this.
+	%s
+"""
+		return template % (protocol, authprotos, extraparams)
+		#add examples
+
+
+
+from badauth.common.credentials.credssp import CREDSSPCredential
+from badauth.common.credentials.kerberos import KerberosCredential
+from badauth.common.credentials.ntlm import NTLMCredential
+from badauth.common.credentials.spnego import SPNEGOCredential
+from badauth.common.credentials.spnegoex import SPNEGOEXCredential
+
+
+__all__ = [
+	'CREDSSPCredential', 
+	'KerberosCredential', 
+	'NTLMCredential', 
+	'SPNEGOCredential',
+	'SPNEGOEXCredential',
+]

badauth-0.1.0/badauth/common/credentials/credssp.py

@@ -0,0 +1,24 @@
+
+from typing import List
+from badauth.common.credentials import UniCredential
+from badauth.common.constants import asyauthSecret, asyauthProtocol, asyauthSubProtocol
+from badauth.common.subprotocols import SubProtocol
+from badauth.common.subprotocols import SubProtocolNative
+from badauth.common.credentials.spnego import SPNEGOCredential
+
+class CREDSSPCredential(UniCredential):
+	def __init__(self, credentials:List[UniCredential] = [], subprotocol:SubProtocol = SubProtocolNative()):
+		UniCredential.__init__(self, protocol = asyauthProtocol.CREDSSP, subprotocol=subprotocol)
+		self.credentials = credentials
+
+	def build_context(self, *args, **kwargs):
+		spnego_cred = SPNEGOCredential(self.credentials)
+		if self.subprotocol.type == asyauthSubProtocol.NATIVE:
+			from badauth.protocols.credssp.client.native import CredSSPClientNative
+			credssp_ctx = CredSSPClientNative(self)
+			credssp_ctx.auth_ctx = spnego_cred.build_context()
+		else:
+			raise Exception('Unsupported subprotocol "%s"' % self.subprotocol)
+
+		return credssp_ctx
+