o
    �õ±jàN  ã                   @   s  d dl Z d dlmZ d dlmZ d dlmZ ddlmZ d dlT d dl	m
Z
 d d	lmZ d d
lmZ d dlmZ d dlmZ G dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZdd„ Zdd„ Zd%dd „Zd%d!d"„Zd#d$„ ZdS )&é    N)ÚDES)Úhashlib)Úhmacé   )ÚasyauthSecret)Ú*)ÚNegotiateFlags)ÚNTLMCredential)ÚNTLMAuthenticate)ÚNTLMChallenge)ÚNTLMNegotiatec                   @   s   e Zd Zddd„Zdd„ ZdS )Ú
CredentialNc                 C   s   || _ || _|| _|| _d S ©N)ÚctypeÚdomainÚusernameÚfullhash)Úselfr   r   r   r   © r   ú”/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/creds_calc.pyÚ__init__   s   
zCredential.__init__c                 C   s   | j | j| j| jdœS )N©r   r   r   r   r   ©r   r   r   r   Úto_dict   s
   üzCredential.to_dict)NNN)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r      s    
r   c                   @   s&   e Zd Zedededefdd„ƒZdS )ÚNTLMCredentialsÚntlmNegotiateÚntlmChallengeÚntlmAuthenticatec                 C   sœ  t |jtƒrGtd|j|jd|j|j|j ¡ |jj ¡ |jj	 
¡  ¡ f d�}tƒ }|j|_|j|_|j|_|jj|_|jj	|_	| ¡ }||gS td|j|jtjƒ}|jtj@ rztƒ }||_|j|_tƒ |_|jj|j_tƒ |_|jj|j_| ¡ gS tƒ }||_|j|_|j|_|j|_tƒ |_|jj|j_tƒ |_|jj|j_|jj|jjkr­| ¡ gS tƒ }|j|_|j|_|j|_tƒ |_|jj|j_| ¡ | ¡ gS )NÚ	netNTLMv2ú%s::%s:%s:%s:%s©r   r   r   Ú )Ú
isinstanceÚNTChallengeÚNTLMv2Responser   ÚUserNameÚ
DomainNameÚServerChallengeÚhexÚResponseÚChallengeFromClinetÚto_bytesÚnetlmv2r   r   ÚLMChallengeÚClientResponseÚto_credentialr	   r   ÚNTr   Ú"NEGOTIATE_EXTENDED_SESSIONSECURITYÚnetntlm_essÚcredentialsÚ
LMResponseÚNTLMv1ResponseÚ
NTResponseÚnetntlmÚnetlm)r   r   r    ÚcredsÚcreds2Úbasecredr   r   r   Ú	construct    sb   
ûü



zNTLMCredentials.constructN)r   r   r   Ústaticmethodr   r   r
   r?   r   r   r   r   r      s    r   c                   @   ó&   e Zd Zdd„ Zdd„ Zd	dd„ZdS )
r;   c                 C   s   d | _ d | _d | _d | _d S r   )r   r   r*   r1   r   r   r   r   r   o   s   
znetlm.__init__c                 C   s$   t d| jd| j| j| jf d�}|S )NÚnetLMz%s:$NETLM$%s$%s©r   r   )r   r   r*   r1   ©r   Úcredr   r   r   r2   y   s
   þznetlm.to_credentialÚplainc                 C   sŽ   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j ƒ}n|dkr6t || j  | j ¡}ntdƒ‚t|| jƒ}| j| 	¡ kS )a@  
		Verifies the authentication data against the user credentials
		Be careful! If the credtype is 'hash' then LM hash is expected!
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform
		:return: bool
		NTFrF   ÚhashúUnknown cred type!)
r   r   ÚLMOWFv1ÚbytesÚfromhexÚ	ExceptionÚDESLr*   r1   r+   )r   r<   ÚcredtypeÚlm_hashÚcalc_responser   r   r   Úverify€   s   

znetlm.verifyN©rF   ©r   r   r   r   r2   rQ   r   r   r   r   r;   m   s    
r;   c                   @   rA   )
r/   c                 C   ó"   d | _ d | _d | _d | _d | _d S r   )r   r   r*   r1   r-   r   r   r   r   r       s
   
znetlmv2.__init__c                 C   s(   t d| jd| j| j| j| jf d�}|S )NÚnetLMv2z$NETLMv2$%s$%s$%s$%srC   )r   r   r*   r1   r-   rD   r   r   r   r2   «   s   ýznetlmv2.to_credentialrF   c                 C   óÊ   |du rdS | j |vrdS | j|| j  vrdS |dkr*t|| j  | j | j| j ƒ}n|dkrAtd| j| j t || j  | j ¡ƒ}ntdƒ‚tj|dd�}| t | j	¡¡ | t | j
¡¡ | j| ¡ kS )	úþ
		Verifies the authentication data against the user credentials
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform
		:return: bool
		NTFrF   rG   rH   Úmd5©Ú	digestmod)r   r   ÚLMOWFv2rJ   rK   rL   r   ÚnewÚupdater*   r-   r1   Ú	hexdigest)r   r<   rN   rO   Úhmr   r   r   rQ   ³   s   	
&znetlmv2.verifyNrR   rS   r   r   r   r   r/   ž   s    r/   c                   @   sJ   e Zd Zdd„ Zdd„ Zedefdd„ƒZdd	„ Zddd„Z	ddd„Z
dS )r5   c                 C   rT   r   ©r6   r*   r7   r9   ÚSessionBaseKeyr   r   r   r   r   Ó   s
   
znetntlm_ess.__init__c                 C   sz   | j jtjkrt| j jƒ}n| j jtjtjfv rt 	| j j¡}t
j| jdd�}| | j¡ | | j ¡ d d… ¡ | ¡ S )NrX   rY   é   )r6   Ústyper   ÚPASSWORDÚNTOWFv1Úsecretr3   ÚRC4rJ   rK   r   r\   ra   r]   r*   r7   r.   Údigest)r   Únt_hashr_   r   r   r   Úcalc_key_exchange_keyà   s   z!netntlm_ess.calc_key_exchange_keyr6   c                 C   s¬   t ƒ }||_| |_|jtjkrt|jƒ}n|jtjtj	fv r$t
 |j¡}tƒ |_|d |j_t | |d d…  ¡ ¡ }t||d d… ƒ}tƒ |_||j_t |¡ ¡ |_|S )Ns                   rb   )r5   r6   r*   rc   r   rd   re   rf   r3   rg   rJ   rK   ri   r7   r,   r   rX   rh   rM   r8   r9   Úmd4ra   )Úserver_challengeÚclient_challenger6   Ú
ntlm_credsri   Útemp_1Údatar   r   r   r?   ì   s   znetntlm_ess.constructc              
   C   sš   | j j}|d u r
d}| j j}|d u rd}| jj}|d u rd}t|tƒr'| ¡ }| jj}|d u r1d}t|tƒr:| ¡ }t	d|d||||| j
 ¡ f d�}|S )Nr$   ó    znetNTLMv1-ESSr"   rC   )r6   r   r   r7   r,   r%   rJ   r+   r9   r   r*   )r   r   r   Ú
lmresponseÚ
ntresponserE   r   r   r   r2     s,   

ýznetntlm_ess.to_credentialrF   c                 C   óX   |dkrt || j | j ƒ}n|dkrt || j | j ¡}ntdƒ‚t |¡ ¡ }|S ©NrF   rG   rH   ©	re   r   r   rJ   rK   rL   r   rk   rh   ©r   r<   rN   ri   Úsession_base_keyr   r   r   Úcalc_session_base_key$  ó   z!netntlm_ess.calc_session_base_keyc                 C   sÀ   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j ƒ}n|dkr6t || j  | j ¡}ntdƒ‚t t | j¡t | j	¡dd…  ¡ 
¡ }t||dd… ƒ}|t | j¡kS )rW   NTFrF   rG   rH   rb   )r   r   re   rJ   rK   rL   r   rX   r*   r-   rh   rM   r1   )r   r<   rN   ri   ro   rP   r   r   r   rQ   /  s   
*znetntlm_ess.verifyNrR   )r   r   r   r   rj   r@   r	   r?   r2   ry   rQ   r   r   r   r   r5   Ò   s    
r5   c                   @   sF   e Zd Zdd„ Zddd„Zedd„ ƒZdd	„ Zddd„Zddd„Z	dS )r:   c                 C   rT   r   r`   r   r   r   r   r   Q  s
   
znetntlm.__init__Fc                 C   sœ   | j jrt| j jƒ}n| j j}|r=t|d d… ƒ | j ¡ d d… ¡}t|dd… d ƒ | j ¡ d d… ¡}|| }|S |rI|d d… d }|S | j}|S )Né   rb   s   ½½½½½½s           )	r6   ÚpasswordrI   rO   r   Úencryptr7   r.   ra   )r   Úwith_lmÚnon_nt_session_keyrO   Útemp1Útemp2Úkexr   r   r   rj   ]  s   $(ûþznetntlm.calc_key_exchange_keyc                 C   s¢   t ƒ }||_| |_d }|jtjkrt|jƒ}t|jƒ}n|jtj	tj
fv r+t |j¡}tƒ |_t|| ƒ|j_|rDtƒ |_t|| ƒ|j_nt|_t |¡ ¡ |_|S r   )r:   r6   r*   rc   r   rd   re   rf   rI   r3   rg   rJ   rK   r8   r9   rM   r,   r7   rs   r   rk   rh   ra   )rl   r6   rn   rO   ri   r   r   r   r?   q  s"   
znetntlm.constructc                 C   s&   t d| jd| j| j| jjf d�}|S )NÚ	netNTLMv1z%s:$NETNTLM$%s$%srC   )r   r   r*   r9   r,   rD   r   r   r   r2   Œ  s
   þznetntlm.to_credentialrF   c                 C   rt   ru   rv   rw   r   r   r   ry   ”  rz   znetntlm.calc_session_base_keyc                 C   sŒ   |du rdS | j |vrdS | j|| j  vrdS |dkr&t|| j  | j ƒ}n|dkr6t || j  | j ¡}ntdƒ‚t|| jƒt | j¡kS )rW   NTFrF   rG   rH   )	r   r   re   rJ   rK   rL   rM   r*   r1   )r   r<   rN   ri   r   r   r   rQ   Ÿ  s   
znetntlm.verifyN)FFrR   )
r   r   r   r   rj   r@   r?   r2   ry   rQ   r   r   r   r   r:   O  s    


r:   c                   @   sD   e Zd Zdd„ Zdd„ Zdd„ Zeddd	„ƒZd
d„ Zddd„Z	dS )Ú	netntlmv2c                 C   rT   r   r`   r   r   r   r   r   ¸  s
   
znetntlmv2.__init__c                 C   s   | j S r   )ra   r   r   r   r   rj   É  s   znetntlmv2.calc_key_exchange_keyc                 C   sŒ   |j s
|js
tdƒ‚|jrt|j|j|jƒ}ntd |j|jt |j ¡ƒ}| jj	}t
| jj	tƒr6t | jj	¡}tj|dd�}| |¡ | ¡ S )Nz%Password or NT hash must be supplied!rX   rY   )ri   r|   rL   ÚNTOWFv2r   r   rJ   rK   r9   r,   r%   Ústrr   r\   r]   rh   )r   r6   Ú
nt_hash_v2Úresponser_   r   r   r   Úcalc_key_exhange_key_serverÌ  s   
z%netntlmv2.calc_key_exhange_key_serverNc                 C   s8  t ƒ }||_| |_|jtjkrt|j|j|j	ƒ}n|jtj
tjfv r0td |j|j	t |j¡ƒ}ntd|j ƒ‚|s>tj ¡ }t |||¡}| ¡ }tj|dd�}	|	 | ¡ |	 |¡ |	 ¡ }
tƒ |_|
|j_||j_tj|dd�}	|	 | ¡ |	 |¡ tƒ |_|	 ¡ |j_||j_tj|dd�}	|	 |
¡ |	 ¡ |_|S )NzUnsupported secret type "%s"rX   rY   )r„   r6   r*   rc   r   rd   r…   rf   r   r   r3   rg   rJ   rK   rL   ÚdatetimeÚutcnowÚNTLMv2ClientChallenger?   r.   r   r\   r]   rh   r'   r9   r,   r-   ÚLMv2Responser7   ra   )rl   rm   Úserver_detailsr6   Ú	timestamprn   r‡   ÚccÚtempr_   Ú
NTProofStrr   r   r   r?   Ý  s:   






znetntlmv2.constructc              
   C   s8   t d| j| jd| jj| jj| j| jj| jjf d�}|S )Nr!   r"   r#   )r   r   r   r6   r*   r9   r,   r-   rD   r   r   r   r2   	  s   "üznetntlmv2.to_credentialrF   c                 C   rV   )	zÿ
		Verifies the authentication data against the user credentials
		:param creds: dictionary containing the domain, user, hash/password
		:param credtype: can be 'plain' or 'hash' this indicates what type of credential lookup to perform 
		:return: bool
		NTFrF   rG   rH   rX   rY   )r   r   r…   rJ   rK   rL   r   r\   r]   r*   r-   r1   r^   )r   r<   rN   ri   r_   r   r   r   rQ     s   	
&	znetntlmv2.verifyr   rR   )
r   r   r   r   rj   r‰   r@   r?   r2   rQ   r   r   r   r   r„   ·  s    +	r„   c                 C   sd   d}| d d…   dd¡ ¡ }t|d d…  d¡ƒ}| |¡}t|dd …  d¡ƒ}| |¡}|| S )Ns   KGS!@#$%é   ú r{   Úascii)ÚljustÚupperr   Úencoder}   )r|   Ú	LM_SECRETÚt1ÚdÚr1Úr2r   r   r   rI   ;  s   

rI   c                 C   s&   t | tƒdu r|  d¡} t | ¡ ¡ S )NTúutf-16le)r%   r†   r˜   r   rk   rh   )r|   r   r   r   re   F  s   
re   c                 C   s   |d u rd}t | |||ƒS )Nr$   )r…   )ÚPasswdÚUserÚUserDomÚ
PasswdHashr   r   r   r[   L  s   r[   c                 C   sV   |d u rd}|d urt j|dd�}n	t jt| ƒdd�}| | ¡ |  d¡¡ | ¡ S )Nr$   rX   rY   rž   )r   r\   re   r]   r—   r˜   rh   )rŸ   r    r¡   r¢   Úfpr   r   r   r…   R  s   r…   c                 C   s‚   t | ƒdkr
tdƒ‚t |ƒdkrtdƒ‚d}|t| dd… ƒ |¡7 }|t| dd… ƒ |¡7 }|t| dd… d	 ƒ |¡7 }|S )
zÊ
	Indicates the encryption of an 8-byte data item D with the 16-byte key K
	using the Data Encryption Standard Long (DESL) algorithm.
	The result is 24 bytes in length.
	:param K:
	:param D:
	:return:
	é   zK MUST be 16 bytes longrb   zD MUST be 8 bytes longrq   Nr{   r“   s        )ÚlenrL   r   r}   )ÚKÚDÚresr   r   r   rM   ]  s   	rM   r   )rŠ   Úunicrypto.symmetricr   Ú	unicryptor   r   Úcommon.constantsr   Ú4asyauth.protocols.ntlm.structures.challenge_responseÚ1asyauth.protocols.ntlm.structures.negotiate_flagsr   Úasyauth.common.credentials.ntlmr	   Ú,asyauth.protocols.ntlm.messages.authenticater
   Ú)asyauth.protocols.ntlm.messages.challenger   Ú)asyauth.protocols.ntlm.messages.negotiater   r   r   r;   r/   r5   r:   r„   rI   re   r[   r…   rM   r   r   r   r   Ú<module>   s0    N14}h 

