o
    �õ±j•E  ã                   @   sú   d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZm Z m!Z!m"Z"m#Z# d dl$m%Z% G dd„ dƒZ&dS )é    N)Úcast)ÚISC_REQ)Úhmac)Úhashlib)ÚRC4)Úlogger)ÚNTLMCredential)ÚNTLMServerInfo)ÚNegotiateFlags)ÚNTLMSSP_MESSAGE_SIGNATURE)ÚNTLMSSP_MESSAGE_SIGNATURE_NOEXT)ÚNTLMNegotiate)ÚNTLMChallenge)ÚNTLMAuthenticate)Ú	netntlmv2Ú
AVPAIRTypeÚ
LMResponseÚnetntlmÚnetntlm_ess)ÚChannelBindingsStructc                   @   s  e Zd Zdefdd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dAdd„ZdAdd„ZdAdd„Zdd„ Zdd„ Zdd„ Zdd„ ZdBd!d"„ZdCd$d%„Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ ZdDd1d2„ZdDd3d4„Zd5d6„ ZdDd7d8„ZdDd9d:„ZdEd;d<„Zd=d>„ ZdFd?d@„Z d S )GÚNTLMClientNativeÚ
credentialc                 C   s¼   || _ |jd ur|jnt d¡| _d | _d | _d | _d | _d | _d | _	d | _
|jd ur.|jnt d¡| _d | _d | _d | _d | _d | _d | _d | _d | _d| _d| _d | _|j| _d | _d S )Né   é   r   )r   Ú	challengeÚosÚurandomÚntlmNegotiateÚntlmChallengeÚntlmAuthenticateÚntlmNegotiate_rawÚntlmChallenge_rawÚntlmAuthenticate_rawÚEncryptedRandomSessionKeyÚsession_keyÚRandomSessionKeyÚSessionBaseKeyÚKeyExchangeKeyÚSignKey_clientÚSealKey_clientÚSignKey_serverÚSealKey_serverÚcrypthandle_clientÚcrypthandle_serverÚ
seq_numberÚiteration_cntÚntlm_credentialsÚ	timestampÚ
extra_info)Úselfr   © r4   ú—/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/client/native.pyÚ__init__   s.   
zNTLMClientNative.__init__c                 C   ó   t  d¡ t |¡| _d S )NzLoading negotiate message)r   Údebugr   Ú
from_bytesr   ©r3   Údatar4   r4   r5   Úload_negotiate9   ó   
zNTLMClientNative.load_negotiatec                 C   r7   )NzLoading challenge message)r   r8   r   r9   r   r:   r4   r4   r5   Úload_challenge=   r=   zNTLMClientNative.load_challengec                 C   r7   )NzLoading authenticate message)r   r8   r   r9   r   r:   r4   r4   r5   Úload_authenticateA   r=   z"NTLMClientNative.load_authenticatec                 C   s   t  d¡ || _|  d¡ d S )NzLoading sessionkeyT)r   r8   r%   Úsetup_cryptor:   r4   r4   r5   Úload_sessionkeyE   s   
z NTLMClientNative.load_sessionkeyc                 C   s   | j jS ©N)r   Úis_guest©r3   r4   r4   r5   rC   J   s   zNTLMClientNative.is_guestc                 C   ó   | j S rB   )r.   rD   r4   r4   r5   Úget_seq_numberM   ó   zNTLMClientNative.get_seq_numberTc                 C   ó6   |dkr| j  jtjO  _d S | j  jtj M  _d S ©NT)r   Úflagsr
   ÚNEGOTIATE_SIGN©r3   Útfr4   r4   r5   Úset_signP   ó   zNTLMClientNative.set_signc                 C   rH   rI   )r   rJ   r
   ÚNEGOTIATE_SEALrL   r4   r4   r5   Úset_sealV   rO   zNTLMClientNative.set_sealc                 C   rH   rI   )r   rJ   r
   ÚNEGOTIATE_VERSIONrL   r4   r4   r5   Úset_version\   rO   zNTLMClientNative.set_versionc                 C   ó   t j| jj v S rB   )r
   Ú"NEGOTIATE_EXTENDED_SESSIONSECURITYr   rD   r4   r4   r5   Úis_extended_securityb   ó   z%NTLMClientNative.is_extended_securityc                 C   s   t  | j¡| _| jS rB   )r	   Úfrom_challenger   r2   rD   r4   r4   r5   Úget_extra_infoe   s   zNTLMClientNative.get_extra_infoc                 C   sÈ   |   ¡ dkr`tƒ }tj| jjv r:t d|¡| }tj|dd�}| 	|¡ || 
¡ d d… ƒ|_||_|d7 }| ¡ S tj|dd�}| 	t d|¡| ¡ | 
¡ d d… |_||_|d7 }| ¡ S tdƒ‚)NTz<iÚmd5)Ú	digestmodr   é   zNot implemented!)rV   r   r
   ÚNEGOTIATE_KEY_EXCHr   ÚstructÚpackr   ÚnewÚupdateÚdigestÚChecksumÚSeqNumÚ	ExceptionÚto_bytes)r3   ÚhandleÚ
signingKeyÚseqNumÚmessageÚmsgÚttÚtr4   r4   r5   ÚMACi   s"   
ò
ùzNTLMClientNative.MACc                 Ã   s"   �|   | j| j|||| jj¡}|S )z2
		This function is to support SSPI encryption.
		)ÚSEALr(   r)   r,   Úencrypt)r3   r;   Úsequence_nor4   r4   r5   rp   …   s   €úzNTLMClientNative.encryptÚinitNc           	      Ã   sL   �|dd… }t  |dd… ¡}| j |¡}|  | jj| j|j|¡}|dfS )z2
		This function is to support SSPI decryption.
		r   N)r   r9   r-   rp   rn   r*   rd   )	r3   r;   rq   Ú	directionÚ	auth_dataÚedataÚsrv_sigÚsealedMessageÚ	signaturer4   r4   r5   Údecrypt“   s   €zNTLMClientNative.decryptFc                 Ã   sJ   �|   | jj| j||¡}|du rt| jƒ| _t| jƒ| _|  jd7  _|S )zc
		Singing outgoing messages. The reset_cipher parameter is needed for calculating mechListMIC. 
		Tr\   )	rn   r,   rp   r(   r   r)   r+   r-   r.   )r3   r;   Ú
message_nors   Úreset_cipherrx   r4   r4   r5   Úsign¡   s   €zNTLMClientNative.signc                 Ã   s,   �t  |¡}|  | jj| j|j|¡}||kS )z'
		Verifying incoming server message
		)r   r9   rn   r-   rp   r*   rd   )r3   r;   rx   Úsignature_structÚcalc_sigr4   r4   r5   Úverify¯   s   €
zNTLMClientNative.verifyc           	      C   s    ||ƒ}|   ||||¡}||fS )z)
		This is the official SEAL function.
		©rn   )	r3   rh   Ú
sealingKeyÚmessageToSignÚmessageToEncryptri   Úcipher_encryptrw   rx   r4   r4   r5   ro   ¹   s   zNTLMClientNative.SEALc                 C   s   |   ||||¡S )z)
		This is the official SIGN function.
		r€   )r3   rh   rj   ri   r„   r4   r4   r5   ÚSIGNÁ   s   zNTLMClientNative.SIGNc                 C   s   t j| jj v pt j| jj v S rB   )r
   rK   r   rP   rD   r4   r4   r5   Úsigning_neededÇ   s   þzNTLMClientNative.signing_neededc                 C   rT   rB   )r
   rP   r   rD   r4   r4   r5   Úencryption_neededÍ   rW   z"NTLMClientNative.encryption_neededÚClientc                 C   s0  t j| jj v rNt j| jj v r| j}nt j| jj v r!| jd d… }n| jd d… }|dkr=t d¡}| |d ¡ | 	¡ }n+t d¡}| |d ¡ | 	¡ }nt j| jj v r_| jd d… d }n	| jd d… d }|dkrz|| _
|d uryt| j
ƒ| _n|| _|d ur‡t| jƒ| _|d ur–t d	|| ¡ f ¡ |S )
Né   é   rˆ   rZ   s;   session key to client-to-server sealing key magic constant s;   session key to server-to-client sealing key magic constant ó    s   å8°zSetting %s sealkey to %s)r
   rU   r   ÚNEGOTIATE_128r%   ÚNEGOTIATE_56r   r`   ra   rb   r)   r   r,   r+   r-   r   r8   Úhex)r3   ÚmodeÚsealkeyrZ   r4   r4   r5   Úcalc_sealkeyÐ   s6   



€zNTLMClientNative.calc_sealkeyc                 C   s²   t j| jj v r/|dkrt d¡}| | jd ¡ | ¡ }nt d¡}| | jd ¡ | ¡ }nd }|dkrG|d urBt 	d| 
¡  ¡ || _|S |d urTt 	d| 
¡  ¡ || _|S )Nrˆ   rZ   s;   session key to client-to-server signing key magic constant s;   session key to server-to-client signing key magic constant zSetting client signkey to %szSetting server signkey to %s)r
   rU   r   r   r`   ra   r%   rb   r   r8   rŽ   r(   r*   )r3   r�   rZ   Úsignkeyr4   r4   r5   Úcalc_signkeyô   s$   



üzNTLMClientNative.calc_signkeyc                 C   rE   rB   )r%   rD   r4   r4   r5   Úget_session_key  rG   z NTLMClientNative.get_session_keyc                 C   ó   |dkr| j S | jS ©Nrˆ   )r)   r+   ©r3   r�   r4   r4   r5   Úget_sealkey  ó   zNTLMClientNative.get_sealkeyc                 C   r•   r–   )r(   r*   r—   r4   r4   r5   Úget_signkey  r™   zNTLMClientNative.get_signkeyc                 C   sà   t  d¡ | jst d¡| _t  d| j ¡  ¡ | jjdkr;d| _d| _	t
| j	ƒ}| | j¡| _t  d| j ¡  ¡ n|du rZ| jj| _t
| j	ƒ}| | j¡| _t  d| j ¡  ¡ |  d¡ |  d	¡ |  d¡ |  d	¡ d S )
NzSetting up cryptor   zRandomSessionKey: %sTs                   zEncryptedRandomSessionKey: %sFrˆ   ÚServer)r   r8   r%   r   r   rŽ   r   rC   r&   r'   r   rp   r#   r0   r‘   r“   )r3   Ú	is_remoteÚrc4r4   r4   r5   r@     s&   






zNTLMClientNative.setup_cryptoc                 C   sÞ   t |tƒdu r	|S |d u r| jjS t | jj¡}|tjO }|tjO }|tjO }|tj	O }|tj
O }|tjO }|tjO }|tjO }|tjO }|tjO }tj|v rU|tjO }n|tj M }tj|v rg|tjO }|S |tj M }|S rI   )Ú
isinstancer
   r   rJ   ÚcopyÚdeepcopyr�   r]   rŒ   rR   rU   ÚNEGOTIATE_NTLMÚNEGOTIATE_LM_KEYÚREQUEST_TARGETÚNTLM_NEGOTIATE_OEMÚNEGOTIATE_UNICODEr   Ú	INTEGRITYrK   ÚCONFIDENTIALITYrP   )r3   rJ   Ú	ntlmflagsr4   r4   r5   Úisc_to_ntlm_flags:  s.   












þz"NTLMClientNative.isc_to_ntlm_flagsc                 Ë   sä  �d }zd|v rddl m} t||d ƒ}W n   Y |  |¡}t d| ¡ | jdkr_|d ur4tdƒ‚|  jd7  _tj	|| j
j| j
j| j
jd�| _| j ¡ | _t d| j ¡ | jd	d fS || _t |¡| _| j
jdk�r1t d
¡ | j
jd	kr­t d¡ tƒ }|  d¡ d|_tj	||d | j|d ur˜|jnd d�| _t d| j ¡ | j ¡ dd fS |tj@ rðt d¡ t  	| jj!| j"| j
¡| _#| j# $¡ | _%|  &¡  tj	|| j#j| j#j'| jj(| j|d urâ|jnd d�| _t d| j ¡ nöt) 	| jj!| j
¡| _#| j#j$|tj*@ |tj+@ d�| _%|  &¡  tj	|| j#j| j#j'| jj(| j|d u�r#|jnd d�| _t d| j ¡ nµ| j
jd	k�rjtƒ }d|_|  d¡ |  &¡  tj	||| j|d u�rU|jnd d�| _t d| j ¡ | j ¡ dd fS | jj,}	|d u�rx||	t-j.< |d u�r–t/ƒ }
||
_0t1 2d¡}| 3|
 ¡ ¡ | 4¡ |	t-j5< t6j	| jj!| j"|	| j
| j7d�| _#| j# $¡ | _%t d| j% 8¡  ¡ |  &¡  d }tj	|| j
j9|d u�rÊ|jnd | j
j:| j#j| j#j'| jj(| j|d�	| _t d| j ¡ | j ¡ | _;| j;dd fS )NÚtargetr   )Ú	UniTargetz	Flags: %sz-First call as client MUST be with empty data!r\   )Ú
domainnameÚworkstationnameÚversionzNegotiate: %sTzNTLMv1 is used herezNTLMv1 Guest authenticationFó    )Úlm_responseÚmicÚencrypted_sessionr­   z#NTLMv1 Guest - NTLMAuthenticate: %szNTLMv1 with extended security)r°   Únt_responser®   r²   r­   z4NTLMv1 with extended security - NTLMAuthenticate: %s)Úwith_lmÚnon_nt_session_keyzNTLMv1 - NTLMAuthenticate: %s)r°   r²   r­   z#NTLMv2 Guest - NTLMAuthenticate: %srZ   )r1   zNTLMv2 - KeyExchangeKey: %s)r¬   r­   Úusernamer°   r³   r®   r²   r±   zNTLMv2 - NTLMAuthenticate: %s)<Úasysocks.unicomm.common.targetr«   r   r©   r   r8   r/   re   r   Ú	constructr   Únegotiate_domainÚnegotiate_workstationÚnegotiate_versionr   rf   r    r!   r   r9   r   Úntlm_versionrC   r   rS   ÚResponser   r#   Úhostnamer   r
   rU   r   ÚServerChallenger   r0   Úcalc_key_exchange_keyr'   r@   Ú
NTResponseÚVersionr   r¢   ÚREQUEST_NON_NT_SESSION_KEYÚ
TargetInfor   ÚMsvAvTargetNamer   Úapplication_datar   r`   ra   rb   ÚMsvChannelBindingsr   r1   rŽ   Údomainr¶   r"   )r3   ÚauthDatarJ   Úcb_dataÚspnÚkwargsrª   r«   ÚlmrespÚtiÚ	cb_structÚmd5_ctxr±   r4   r4   r5   ÚauthenticateZ  sÐ   €€

 


û

úú
ü



 ÷zNTLMClientNative.authenticate)T)rr   N)NF)rˆ   )F)NNN)!Ú__name__Ú
__module__Ú__qualname__r   r6   r<   r>   r?   rA   rC   rF   rN   rQ   rS   rV   rY   rn   rp   ry   r|   r   ro   r…   r†   r‡   r‘   r“   r”   r˜   rš   r@   r©   rÑ   r4   r4   r4   r5   r      s<     







$


 r   )'rŸ   r   r^   Útypingr   Úasyauth.common.winapi.constantsr   Ú	unicryptor   r   Úunicrypto.symmetricr   Úasyauth.protocols.ntlmr   Úasyauth.common.credentials.ntlmr   Ú,asyauth.protocols.ntlm.structures.serverinfor	   Ú1asyauth.protocols.ntlm.structures.negotiate_flagsr
   Ú;asyauth.protocols.ntlm.structures.ntlmssp_message_signaturer   ÚAasyauth.protocols.ntlm.structures.ntlmssp_message_signature_noextr   Ú)asyauth.protocols.ntlm.messages.negotiater   Ú)asyauth.protocols.ntlm.messages.challenger   Ú,asyauth.protocols.ntlm.messages.authenticater   Ú!asyauth.protocols.ntlm.creds_calcr   r   r   r   r   Ú#minikerberos.gssapi.channelbindingsr   r   r4   r4   r4   r5   Ú<module>   s(    