o
    �õ±jfM  ã                   @   sZ  d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z- d dl.m/Z/ d dlm0Z0 d dl1m1Z1 G dd„ dƒZ2ddede2fdd„Z3dS )é    N)ÚcastÚCallable)ÚISC_REQ)ÚasyauthSecretÚasyauthProtocolÚasyauthSubProtocol)Úhmac)Úhashlib)ÚRC4)Úlogger)ÚNTLMCredential)ÚNTLMServerInfo)ÚNegotiateFlags)ÚNTLMSSP_MESSAGE_SIGNATURE)ÚNTLMSSP_MESSAGE_SIGNATURE_NOEXT)ÚNTLMNegotiate)ÚNTLMChallenge)ÚNTLMAuthenticate)Ú	netntlmv2Ú
AVPAIRTypeÚ
LMResponseÚnetntlmÚnetntlm_ess)ÚChannelBindingsStruct)ÚAVPairsÚ
MsvAvFlags)ÚVersion)ÚFILETIME)Údatetimec                   @   s  e Zd Zdefdd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dAdd„ZdAdd„ZdAdd„Zdd„ Zdd„ Zdd„ Zdd„ ZdBd!d"„ZdCd$d%„Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ ZdDd1d2„ZdDd3d4„Zd5d6„ ZdDd7d8„ZdDd9d:„ZdEd;d<„Zd=d>„ ZdFd?d@„Z d S )GÚNTLMServerNativeÚ
credentialc                 C   s¼   || _ |jd ur|jnt d¡| _d | _d | _d | _d | _d | _d | _	d | _
|jd ur.|jnt d¡| _d | _d | _d | _d | _d | _d | _d | _d | _d| _d| _d | _|j| _d | _d S )Né   é   r   )r    Ú	challengeÚosÚurandomÚntlmNegotiateÚntlmChallengeÚntlmAuthenticateÚntlmNegotiate_rawÚntlmChallenge_rawÚntlmAuthenticate_rawÚEncryptedRandomSessionKeyÚsession_keyÚRandomSessionKeyÚSessionBaseKeyÚKeyExchangeKeyÚSignKey_clientÚSealKey_clientÚSignKey_serverÚSealKey_serverÚcrypthandle_clientÚcrypthandle_serverÚ
seq_numberÚiteration_cntÚntlm_credentialsÚ	timestampÚ
extra_info)Úselfr    © r=   ú—/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/asyauth/protocols/ntlm/server/native.pyÚ__init__   s.   
zNTLMServerNative.__init__c                 C   ó   t  d¡ t |¡| _d S )NzLoading negotiate message)r   Údebugr   Ú
from_bytesr&   ©r<   Údatar=   r=   r>   Úload_negotiate?   ó   
zNTLMServerNative.load_negotiatec                 C   r@   )NzLoading challenge message)r   rA   r   rB   r'   rC   r=   r=   r>   Úload_challengeC   rF   zNTLMServerNative.load_challengec                 C   r@   )NzLoading authenticate message)r   rA   r   rB   r(   rC   r=   r=   r>   Úload_authenticateG   rF   z"NTLMServerNative.load_authenticatec                 C   s   t  d¡ || _|  d¡ d S )NzLoading sessionkeyT)r   rA   r.   Úsetup_cryptorC   r=   r=   r>   Úload_sessionkeyK   s   
z NTLMServerNative.load_sessionkeyc                 C   s   | j jS ©N)r    Úis_guest©r<   r=   r=   r>   rL   P   s   zNTLMServerNative.is_guestc                 C   ó   | j S rK   )r7   rM   r=   r=   r>   Úget_seq_numberS   ó   zNTLMServerNative.get_seq_numberTc                 C   ó6   |dkr| j  jtjO  _d S | j  jtj M  _d S ©NT)r    Úflagsr   ÚNEGOTIATE_SIGN©r<   Útfr=   r=   r>   Úset_signV   ó   zNTLMServerNative.set_signc                 C   rQ   rR   )r    rS   r   ÚNEGOTIATE_SEALrU   r=   r=   r>   Úset_seal\   rX   zNTLMServerNative.set_sealc                 C   rQ   rR   )r    rS   r   ÚNEGOTIATE_VERSIONrU   r=   r=   r>   Úset_versionb   rX   zNTLMServerNative.set_versionc                 C   ó   t j| jj v S rK   )r   Ú"NEGOTIATE_EXTENDED_SESSIONSECURITYr'   rM   r=   r=   r>   Úis_extended_securityh   ó   z%NTLMServerNative.is_extended_securityc                 C   s   t  | j¡| _| jS rK   )r   Úfrom_challenger'   r;   rM   r=   r=   r>   Úget_extra_infok   s   zNTLMServerNative.get_extra_infoc                 C   sÈ   |   ¡ dkr`tƒ }tj| jjv r:t d|¡| }tj|dd�}| 	|¡ || 
¡ d d… ƒ|_||_|d7 }| ¡ S tj|dd�}| 	t d|¡| ¡ | 
¡ d d… |_||_|d7 }| ¡ S tdƒ‚)NTz<iÚmd5)Ú	digestmodr!   é   zNot implemented!)r_   r   r   ÚNEGOTIATE_KEY_EXCHr'   ÚstructÚpackr   ÚnewÚupdateÚdigestÚChecksumÚSeqNumÚ	ExceptionÚto_bytes)r<   ÚhandleÚ
signingKeyÚseqNumÚmessageÚmsgÚttÚtr=   r=   r>   ÚMACo   s"   
ò
ùzNTLMServerNative.MACc                 Ã   s"   �|   | j| j|||| jj¡}|S )z2
		This function is to support SSPI encryption.
		)ÚSEALr1   r2   r5   Úencrypt)r<   rD   Úsequence_nor=   r=   r>   ry   ‹   s   €úzNTLMServerNative.encryptÚinitNc           	      Ã   sL   �|dd… }t  |dd… ¡}| j |¡}|  | jj| j|j|¡}|dfS )z2
		This function is to support SSPI decryption.
		r"   N)r   rB   r6   ry   rw   r3   rm   )	r<   rD   rz   Ú	directionÚ	auth_dataÚedataÚsrv_sigÚsealedMessageÚ	signaturer=   r=   r>   Údecrypt™   s   €zNTLMServerNative.decryptFc                 Ã   sJ   �|   | jj| j||¡}|du rt| jƒ| _t| jƒ| _|  jd7  _|S )zc
		Singing outgoing messages. The reset_cipher parameter is needed for calculating mechListMIC. 
		Tre   )	rw   r5   ry   r1   r
   r2   r4   r6   r7   )r<   rD   Ú
message_nor|   Úreset_cipherr�   r=   r=   r>   Úsign§   s   €zNTLMServerNative.signc                 Ã   s,   �t  |¡}|  | jj| j|j|¡}||kS )z'
		Verifying incoming server message
		)r   rB   rw   r6   ry   r3   rm   )r<   rD   r�   Úsignature_structÚcalc_sigr=   r=   r>   Úverifyµ   s   €
zNTLMServerNative.verifyc           	      C   s    ||ƒ}|   ||||¡}||fS )z)
		This is the official SEAL function.
		©rw   )	r<   rq   Ú
sealingKeyÚmessageToSignÚmessageToEncryptrr   Úcipher_encryptr€   r�   r=   r=   r>   rx   ¿   s   zNTLMServerNative.SEALc                 C   s   |   ||||¡S )z)
		This is the official SIGN function.
		r‰   )r<   rq   rs   rr   r�   r=   r=   r>   ÚSIGNÇ   s   zNTLMServerNative.SIGNc                 C   s   t j| jj v pt j| jj v S rK   )r   rT   r'   rY   rM   r=   r=   r>   Úsigning_neededÍ   s   þzNTLMServerNative.signing_neededc                 C   r]   rK   )r   rY   r'   rM   r=   r=   r>   Úencryption_neededÓ   r`   z"NTLMServerNative.encryption_neededÚClientc                 C   s0  t j| jj v rNt j| jj v r| j}nt j| jj v r!| jd d… }n| jd d… }|dkr=t d¡}| |d ¡ | 	¡ }n+t d¡}| |d ¡ | 	¡ }nt j| jj v r_| jd d… d }n	| jd d… d }|dkrz|| _
|d uryt| j
ƒ| _n|| _|d ur‡t| jƒ| _|d ur–t d	|| ¡ f ¡ |S )
Né   é   r‘   rc   s;   session key to client-to-server sealing key magic constant s;   session key to server-to-client sealing key magic constant ó    s   å8°zSetting %s sealkey to %s)r   r^   r'   ÚNEGOTIATE_128r.   ÚNEGOTIATE_56r	   ri   rj   rk   r2   r
   r5   r4   r6   r   rA   Úhex)r<   ÚmodeÚsealkeyrc   r=   r=   r>   Úcalc_sealkeyÖ   s6   



€zNTLMServerNative.calc_sealkeyc                 C   s²   t j| jj v r/|dkrt d¡}| | jd ¡ | ¡ }nt d¡}| | jd ¡ | ¡ }nd }|dkrG|d urBt 	d| 
¡  ¡ || _|S |d urTt 	d| 
¡  ¡ || _|S )Nr‘   rc   s;   session key to client-to-server signing key magic constant s;   session key to server-to-client signing key magic constant zSetting client signkey to %szSetting server signkey to %s)r   r^   r'   r	   ri   rj   r.   rk   r   rA   r—   r1   r3   )r<   r˜   rc   Úsignkeyr=   r=   r>   Úcalc_signkeyú   s$   



üzNTLMServerNative.calc_signkeyc                 C   rN   rK   )r.   rM   r=   r=   r>   Úget_session_key  rP   z NTLMServerNative.get_session_keyc                 C   ó   |dkr| j S | jS ©Nr‘   )r2   r4   ©r<   r˜   r=   r=   r>   Úget_sealkey  ó   zNTLMServerNative.get_sealkeyc                 C   rž   rŸ   )r1   r3   r    r=   r=   r>   Úget_signkey  r¢   zNTLMServerNative.get_signkeyc                 C   sà   t  d¡ | jst d¡| _t  d| j ¡  ¡ | jjdkr;d| _d| _	t
| j	ƒ}| | j¡| _t  d| j ¡  ¡ n|du rZ| jj| _t
| j	ƒ}| | j¡| _t  d| j ¡  ¡ |  d¡ |  d	¡ |  d¡ |  d	¡ d S )
NzSetting up cryptor"   zRandomSessionKey: %sTs                   zEncryptedRandomSessionKey: %sFr‘   ÚServer)r   rA   r.   r$   r%   r—   r    rL   r/   r0   r
   ry   r,   r9   rš   rœ   )r<   Ú	is_remoteÚrc4r=   r=   r>   rI   "  s&   






zNTLMServerNative.setup_cryptoc                 C   sê   t |tƒdu r	|S |d u r| jjS t | jj¡}|tjO }|tjO }|tjO }|tj	O }|tj
O }|tjO }|tjO }|tjO }|tjO }|tjO }|tj M }tj|v r[|tjO }n|tj M }tj|v rm|tjO }|S |tj M }|S rR   )Ú
isinstancer   r    rS   ÚcopyÚdeepcopyr–   rf   r•   r[   r^   ÚNEGOTIATE_NTLMÚNEGOTIATE_LM_KEYÚREQUEST_TARGETÚNTLM_NEGOTIATE_OEMÚNEGOTIATE_UNICODEÚTARGET_TYPE_SERVERr   Ú	INTEGRITYrT   ÚCONFIDENTIALITYrY   )r<   rS   Ú	ntlmflagsr=   r=   r>   Úisc_to_ntlm_flags@  s0   












þz"NTLMServerNative.isc_to_ntlm_flagsc                 Ë   sÌ  �d }zd|v rddl m} t||d ƒ}W n   Y |  |¡}t d| ¡ | jdkrÃ|d u r4tdƒ‚|  jd7  _t 	|¡| _
|| _tƒ }d|tj< d|tj< d	|tj< d	|tj< d	|tj< t t ¡ ¡ ¡ |tj< t | j
j¡}|tjO }|tjO }|tj M }|tj M }|tj  M }|tj! M }t"j#t$ %d
¡| j&j'd ur¥| j&j'nd|| j&j(|d�| _)t d| j
 ¡ | j) ¡ | _*| j*dd fS || _+t, 	|¡| _-t d| j- ¡ | j&j.dkrÜdS | j-jBdkrädS dS )NÚtargetr   )Ú	UniTargetz	Flags: %sz'First call as server MUST be with data!re   ÚTESTzTEST$z
TEST.localr!   Ú )r#   Ú
targetNameÚ
targetInfoÚversionrS   zNegotiate: %sTzAuthenticate: %s)NFN)QÚasysocks.unicomm.common.targetrµ   r   r³   r   rA   r8   rn   r   rB   r&   r)   r   r   ÚMsvAvNbDomainNameÚMsvAvNbComputerNameÚMsvAvDnsDomainNameÚMsvAvDnsComputerNameÚMsvAvDnsTreeNamer   Úfrom_datetimer   Únowro   ÚMsvAvTimestampr¨   r©   r   r[   ÚNEGOTIATE_TARGET_INFOÚNEGOTIATE_ALWAYS_SIGNrY   rT   r¯   r   Ú	constructr$   r%   r    Únegotiate_domainÚnegotiate_versionr'   r*   r+   r   r(   Úntlm_versionrL   r   r\   ÚResponser,   Úhostnamer^   r   ÚServerChallenger#   r9   Úcalc_key_exchange_keyr0   rI   Ú
NTResponser   r   r«   ÚREQUEST_NON_NT_SESSION_KEYÚUserNameÚ
TargetInfoÚMsvAvTargetNamer   Úapplication_datar	   ri   rj   rk   ÚMsvChannelBindingsr   r:   r—   ÚdomainÚusername)r<   ÚauthDatarS   Úcb_dataÚspnÚkwargsr´   rµ   Ú
targetinfoÚlmrespÚtiÚ	cb_structÚmd5_ctxÚmicr=   r=   r>   Úauthenticate_servera  sb   €€








û9z$NTLMServerNative.authenticate_server)T)r{   N)NF)r‘   )F)NNN)!Ú__name__Ú
__module__Ú__qualname__r   r?   rE   rG   rH   rJ   rL   rO   rW   rZ   r\   r_   rb   rw   ry   r‚   r…   rˆ   rx   rŽ   r�   r�   rš   rœ   r�   r¡   r£   rI   r³   rá   r=   r=   r=   r>   r      s<     







$


!r   Úntlm_credential_factoryÚreturnc                 C   s.   | d u rt dddtjd�}n| ƒ }t|ƒ}|S )NÚtest)Ústype)r   r   ÚPASSWORDr   )rå   Úntlm_settingsÚntlm_ctxr=   r=   r>   Úntlmserver_factory  s   ürì   rK   )4r¨   r$   rg   Útypingr   r   Úasyauth.common.winapi.constantsr   Úasyauth.common.constantsr   r   r   Ú	unicryptor   r	   Úunicrypto.symmetricr
   Úasyauth.protocols.ntlmr   Úasyauth.common.credentials.ntlmr   Ú,asyauth.protocols.ntlm.structures.serverinfor   Ú1asyauth.protocols.ntlm.structures.negotiate_flagsr   Ú;asyauth.protocols.ntlm.structures.ntlmssp_message_signaturer   ÚAasyauth.protocols.ntlm.structures.ntlmssp_message_signature_noextr   Ú)asyauth.protocols.ntlm.messages.negotiater   Ú)asyauth.protocols.ntlm.messages.challenger   Ú,asyauth.protocols.ntlm.messages.authenticater   Ú!asyauth.protocols.ntlm.creds_calcr   r   r   r   r   Ú#minikerberos.gssapi.channelbindingsr   Ú(asyauth.protocols.ntlm.structures.avpairr   r   Ú)asyauth.protocols.ntlm.structures.versionr   r   r   r   rì   r=   r=   r=   r>   Ú<module>   s:       t