Skip to content

Commit

Permalink
ntlmrelayx: support upn format + oem encoding
Browse files Browse the repository at this point in the history
  • Loading branch information
@rtpt-alexanderneumann
Lucas Vater authored and rtpt-alexanderneumann committed Oct 11, 2024
1 parent 65b774d commit 0838723
Show file tree
Hide file tree
Showing 5 changed files with 22 additions and 37 deletions.
16 changes: 2 additions & 14 deletions impacket/examples/ntlmrelayx/servers/httprelayserver.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -360,13 +360,7 @@ def do_local_auth(self, messageType, token, proxy):
elif messageType == 3:
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
authenticateMessage.fromString(token)

if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
else:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
authenticateMessage['user_name'].decode('ascii'))).upper()
self.authUser = authenticateMessage.getUserString()

self.target = self.server.config.target.getTarget(identity = self.authUser)
if self.target is None:
Expand Down Expand Up @@ -441,13 +435,7 @@ def do_relay(self, messageType, token, proxy, content = None):
authenticateMessage.fromString(token)

if self.server.config.disableMulti:
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
else:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
authenticateMessage['user_name'].decode('ascii'))).upper()

self.authUser = authenticateMessage.getUserString()
target = '%s://%s@%s' % (self.target.scheme, self.authUser.replace("/", '\\'), self.target.netloc)

if not self.do_ntlm_auth(token, authenticateMessage):
Expand Down
8 changes: 1 addition & 7 deletions impacket/examples/ntlmrelayx/servers/rawrelayserver.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -165,14 +165,8 @@ def do_ntlm_negotiate(self, token):
return True

def do_ntlm_auth(self, token, authenticateMessage):

# For some attacks it is important to know the authenticated username, so we store it
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
else:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
authenticateMessage['user_name'].decode('ascii'))).upper()
self.authUser = authenticateMessage.getUserString()

if authenticateMessage['user_name'] != '' or self.target.hostname == '127.0.0.1':
clientResponse, errorCode = self.client.sendAuth(token)
Expand Down
14 changes: 4 additions & 10 deletions impacket/examples/ntlmrelayx/servers/smbrelayserver.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -340,8 +340,7 @@ def SmbSessionSetup(self, connId, smbServer, recvPacket):
client = connData['SMBClient']
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
authenticateMessage.fromString(token)
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
self.authUser = authenticateMessage.getUserString()

if rawNTLM is True:
respToken2 = SPNEGO_NegTokenResp()
Expand Down Expand Up @@ -409,11 +408,8 @@ def SmbSessionSetup(self, connId, smbServer, recvPacket):

def smb2TreeConnect(self, connId, smbServer, recvPacket):
connData = smbServer.getConnectionData(connId)

authenticateMessage = connData['AUTHENTICATE_MESSAGE']

self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode ('utf-16le'),
authenticateMessage['user_name'].decode ('utf-16le'))).upper ()
self.authUser = authenticateMessage.getUserString()

if self.config.disableMulti:
return self.origsmb2TreeConnect(connId, smbServer, recvPacket)
Expand Down Expand Up @@ -631,8 +627,7 @@ def SmbSessionSetupAndX(self, connId, smbServer, SMBCommand, recvPacket):
client = connData['SMBClient']
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
authenticateMessage.fromString(token)
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
self.authUser = authenticateMessage.getUserString()

clientResponse, errorCode = self.do_ntlm_auth(client,sessionSetupData['SecurityBlob'],
connData['CHALLENGE_MESSAGE']['challenge'])
Expand Down Expand Up @@ -773,8 +768,7 @@ def smbComTreeConnectAndX(self, connId, smbServer, SMBCommand, recvPacket):
connData = smbServer.getConnectionData(connId)

authenticateMessage = connData['AUTHENTICATE_MESSAGE']
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode ('utf-16le'),
authenticateMessage['user_name'].decode ('utf-16le'))).upper ()
self.authUser = authenticateMessage.getUserString()

if self.config.disableMulti:
return self.smbComTreeConnectAndX(connId, smbServer, SMBCommand, recvPacket)
Expand Down
7 changes: 1 addition & 6 deletions impacket/examples/ntlmrelayx/servers/wcfrelayserver.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -306,12 +306,7 @@ def do_ntlm_negotiate(self, token):

def do_ntlm_auth(self, token, authenticateMessage):
# For some attacks it is important to know the authenticated username, so we store it
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
authenticateMessage['user_name'].decode('utf-16le'))).upper()
else:
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
authenticateMessage['user_name'].decode('ascii'))).upper()
self.authUser = authenticateMessage.getUserString()

if authenticateMessage['user_name'] != '' or self.target.hostname == '127.0.0.1':
clientResponse, errorCode = self.client.sendAuth(token)
Expand Down
14 changes: 14 additions & 0 deletions impacket/ntlm.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,20 @@ def fromString(self,data):
lanman_end = self['lanman_len'] + lanman_offset
self['lanman'] = data[ lanman_offset : lanman_end]

def getUserString(self):
if self['flags'] & NTLMSSP_NEGOTIATE_UNICODE:
user = self['user_name'].decode('utf-16le')
domain = self['domain_name'].decode('utf-16le')
else:
user = self['user_name'].decode('cp437')
domain = self['domain_name'].decode('cp437')

# user is in UPN format
if not domain and '@' in user:
user, _, domain = user.rpartition("@")

return ('%s/%s' % (domain, user)).upper()

class ImpacketStructure(Structure):
def set_parent(self, other):
self.parent = other
Expand Down

0 comments on commit 0838723

Please sign in to comment.