1# Copyright: (c) 2018, Jordan Borean (@jborean93) <jborean93@gmail.com>
2# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
3
4
5# [MS-NLMP] 2.2 Message Syntax - The signature field used in NTLM messages
6NTLM_SIGNATURE = b'NTLMSSP\x00'
7
8
9class MessageTypes(object):
10 """
11 [MS-NLMP] v28.0 2016-07-14
12
13 2.2 Message Syntax
14 The 3 message type options you can have in a message.
15 """
16 NTLM_NEGOTIATE = 0x1
17 NTLM_CHALLENGE = 0x2
18 NTLM_AUTHENTICATE = 0x3
19
20
21class AvId(object):
22 """
23 [MS-NLMP] 2.2.2.1 AV_PAIR AvId
24 https://msdn.microsoft.com/en-us/library/cc236646.aspx
25
26 16-bit unsigned integer that defines the information type in the value
27 field for an AV_PAIR.
28 """
29 MSV_AV_EOL = 0x00
30 MSV_AV_NB_COMPUTER_NAME = 0x01
31 MSV_AV_NB_DOMAIN_NAME = 0x02
32 MSV_AV_DNS_COMPUTER_NAME = 0x03
33 MSV_AV_DNS_DOMAIN_NAME = 0x04
34 MSV_AV_DNS_TREE_NAME = 0x05
35 MSV_AV_FLAGS = 0x06
36 MSV_AV_TIMESTAMP = 0x07
37 MSV_AV_SINGLE_HOST = 0x08
38 MSV_AV_TARGET_NAME = 0x09
39 MSV_AV_CHANNEL_BINDINGS = 0x0a
40
41
42class AvFlags(object):
43 """
44 [MS-NLMP] v28.0 2016-07-14
45
46 2.2.2.1 AV_PAIR (MsvAvFlags)
47 A 32-bit value indicated server or client configuration
48 """
49 AUTHENTICATION_CONSTRAINED = 0x1
50 MIC_PROVIDED = 0x2
51 UNTRUSTED_SPN_SOURCE = 0x4
52
53
54class NegotiateFlags(object):
55 """
56 [MS-NLMP] v28.0 2016-07-14
57
58 2.2.2.5 NEGOTIATE
59 During NTLM authentication, each of the following flags is a possible value
60 of the NegotiateFlags field of the NEGOTIATE_MESSAGE, CHALLENGE_MESSAGE and
61 AUTHENTICATE_MESSAGE, unless otherwise noted. These flags define client or
62 server NTLM capabilities supported by the sender.
63 """
64 NTLMSSP_NEGOTIATE_56 = 0x80000000
65 NTLMSSP_NEGOTIATE_KEY_EXCH = 0x40000000
66 NTLMSSP_NEGOTIATE_128 = 0x20000000
67 NTLMSSP_RESERVED_R1 = 0x10000000
68 NTLMSSP_RESERVED_R2 = 0x08000000
69 NTLMSSP_RESERVED_R3 = 0x04000000
70 NTLMSSP_NEGOTIATE_VERSION = 0x02000000
71 NTLMSSP_RESERVED_R4 = 0x01000000
72 NTLMSSP_NEGOTIATE_TARGET_INFO = 0x00800000
73 NTLMSSP_REQUEST_NON_NT_SESSION_KEY = 0x00400000
74 NTLMSSP_RESERVED_R5 = 0x00200000
75 NTLMSSP_NEGOTIATE_IDENTITY = 0x00100000
76 NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY = 0x00080000
77 NTLMSSP_RESERVED_R6 = 0x00040000
78 NTLMSSP_TARGET_TYPE_SERVER = 0x00020000
79 NTLMSSP_TARGET_TYPE_DOMAIN = 0x00010000
80 NTLMSSP_NEGOTIATE_ALWAYS_SIGN = 0x00008000
81 NTLMSSP_RESERVED_R7 = 0x00004000
82 NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED = 0x00002000
83 NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED = 0x00001000
84 NTLMSSP_ANOYNMOUS = 0x00000800
85 NTLMSSP_RESERVED_R8 = 0x00000400
86 NTLMSSP_NEGOTIATE_NTLM = 0x00000200
87 NTLMSSP_RESERVED_R9 = 0x00000100
88 NTLMSSP_NEGOTIATE_LM_KEY = 0x00000080
89 NTLMSSP_NEGOTIATE_DATAGRAM = 0x00000040
90 NTLMSSP_NEGOTIATE_SEAL = 0x00000020
91 NTLMSSP_NEGOTIATE_SIGN = 0x00000010
92 NTLMSSP_RESERVED_R10 = 0x00000008
93 NTLMSSP_REQUEST_TARGET = 0x00000004
94 NTLMSSP_NEGOTIATE_OEM = 0x00000002
95 NTLMSSP_NEGOTIATE_UNICODE = 0x00000001
96
97
98class SignSealConstants(object):
99 # Magic Contants used to get the signing and sealing key for
100 # Extended Session Security
101 CLIENT_SIGNING = b"session key to client-to-server signing key magic " \
102 b"constant\x00"
103 SERVER_SIGNING = b"session key to server-to-client signing key magic " \
104 b"constant\x00"
105 CLIENT_SEALING = b"session key to client-to-server sealing key magic " \
106 b"constant\x00"
107 SERVER_SEALING = b"session key to server-to-client sealing key magic " \
108 b"constant\x00"