Documentation
¶
Index ¶
- Constants
- func GenLMOWFv2(user string, domain string, password string, ntlmhash []byte) ([]byte, error)
- func GenNTOWFv2(user string, domain string, password string, ntlmhash []byte) ([]byte, error)
- func GenerateNTLMv2ChallengeProof(challenge []byte, password string, ntlmhash []byte, username string, ...) ([]byte, error)
- func PrintNTLMSSPStruc(a interface{})
- func ToNTHash(in string) []byte
- func ToNTHashString(password string) string
- type AVID
- type NTLMMessageType
- type NTLMSSP_Auth
- type NTLMSSP_Challenge
- type NTLMv2_CLIENT_CHALLENGE
- type NTLMv2_Responce
- type VersionStruct
Constants ¶
View Source
const ( NEGOTIATE_MESSAGE = iota + 1 CHALLENGE_MESSAGE AUTHENTICATE_MESSAGE )
Variables ¶
This section is empty.
Functions ¶
func GenLMOWFv2 ¶
LOL I know its the same as GenNTOWFv2 but shutup https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3
func GenNTOWFv2 ¶
func GenerateNTLMv2ChallengeProof ¶
func GenerateNTLMv2ChallengeProof(challenge []byte, password string, ntlmhash []byte, username string, domain string, blob []byte) ([]byte, error)
ntProofStr Hash or Password
func PrintNTLMSSPStruc ¶
func PrintNTLMSSPStruc(a interface{})
func ToNTHashString ¶
ToNTHash will turn a string into a hex string representation of a NTLM hash. Useful for pass the hash attacks
Types ¶
type AVID ¶
type AVID struct {
MsvAvEOL []byte `ntlmssp:"void"` // 0x0000 Signify end of AVID
MsvAvNbComputerName []byte `ntlmssp:"utf16lestring"` // 0x0001
MsvAvNbDomainName []byte `ntlmssp:"utf16lestring"` // 0x0002
MsvAvDnsComputerName []byte `ntlmssp:"utf16lestring"` // 0x0003
MsvAvDnsDomainName []byte `ntlmssp:"utf16lestring"` // 0x0004
MsvAvDnsTreeName []byte `ntlmssp:"utf16lestring"` // 0x0005
MsvAvFlags []byte `ntlmssp:"avFlags"` // 0x0006
MsvAvTimestamp []byte `ntlmssp:"time"` // 0x0007
MsvAvSingleHost []byte `ntlmssp:"tbd"` // 0x0008
MsvAvTargetName []byte `ntlmssp:"utf16lestring"` // 0x0009 CIFS/Targetname
MsvAvChannelBindings []byte `ntlmssp:"tbd"` // 0x000A
}
type NTLMMessageType ¶
type NTLMMessageType uint32
type NTLMSSP_Auth ¶
type NTLMSSP_Auth struct {
Signature []byte `ntlmssp:"identifyer"` // 8 bytes, offset 0
MessageType []byte `ntlmssp:"MessageType"` // 4 bytes, offset 8
LmChallengeResponse []byte `ntlmssp:"hexstring"` // 8 bytes, offset 12
NtChallengeResponse []byte `ntlmssp:"hexstring"` // 8 bytes, offset 20
DomainName []byte `ntlmssp:"utf16lestring"` // 8 bytes, offset 28
UserName []byte `ntlmssp:"utf16lestring"` // 8 bytes, offset 36
Workstation []byte `ntlmssp:"utf16lestring"` // 8 bytes, offset 44
EncryptedRandomSessionKey []byte `ntlmssp:"hexstring"` // 8 bytes, offset 52
NegotiateFlags []byte `ntlmssp:"NegotiateFlags"` // 4 bytes, offset 60
Version []byte `ntlmssp:"version"` // 8 bytes, Variable Offset //that SHOULD be populated only when the NTLMSSP_NEGOTIATE_VERSION flag is set in the NegotiateFlags field
MIC []byte `ntlmssp:"hexstring"` // 8 bytes, Variable Offset
}
func ParseNTLMSSP_Auth ¶
func ParseNTLMSSP_Auth(NTLMSSP_Auth_Bytes []byte) (NTLMSSP_Auth, error)
func (*NTLMSSP_Auth) Readable ¶
func (a *NTLMSSP_Auth) Readable()
type NTLMSSP_Challenge ¶
type NTLMSSP_Challenge struct {
Signature []byte `ntlmssp:"identifyer"` // 8 bytes offset 0
MessageType []byte `ntlmssp:"MessageType"` // 4 bytes, offset 8
TargetName []byte `ntlmssp:"utf16lestring"` // 8 bytes, offset 12
NegotiateFlags []byte `ntlmssp:"NegotiateFlags"` // 4 bytes, offset 20
ServerChallenge []byte `ntlmssp:"hexstring"` // 8 bytes, offset 24
Reserved []byte `ntlmssp:"hexstring"` // 8 bytes, offset 32
TargetInfo []byte `ntlmssp:"AV_Pair"` // 8 bytes, offset 40 //AVID
Version []byte `ntlmssp:"version"` // 8 bytes, offset 48
}
Rename these to follow the offical whitepaper name
func ParseNTLMSSP_Challenge ¶
func ParseNTLMSSP_Challenge(NTLMSSP_Challenge_Bytes []byte) (NTLMSSP_Challenge, error)
Parses the NTLMSSP_Challenge to a NTLMSSP_Challenge struct
func (*NTLMSSP_Challenge) Readable ¶
func (a *NTLMSSP_Challenge) Readable()
Prints a human readble verson of the NTLMSSP_Challenge to the console
type NTLMv2_CLIENT_CHALLENGE ¶
type NTLMv2_CLIENT_CHALLENGE struct {
RespType []byte `ntlmssp:"hexstring"` // 1 bytes, offset 0
HiRespType []byte `ntlmssp:"hexstring"` // 1 bytes, offset 1
Reserved1 []byte `ntlmssp:"hexstring"` // 2 bytes, offset 2 // Needs to be 00 00
Reserved2 []byte `ntlmssp:"hexstring"` // 4 bytes, offset 4 // Needs to be 00 00 00 00
TimeStamp []byte `ntlmssp:"time"` // 8 bytes offset 8
ChallengeFromClient []byte `ntlmssp:"hexstring"` // 8 bytes offset 16
Reserved3 []byte `ntlmssp:"hexstring"` // 4 bytes offset 24 // Needs to be 00 00 00 00
AvPairs []byte `ntlmssp:"hexstring"` // Variable bytes, offset 28
}
func (*NTLMv2_CLIENT_CHALLENGE) Readable ¶
func (a *NTLMv2_CLIENT_CHALLENGE) Readable()
type NTLMv2_Responce ¶
type NTLMv2_Responce struct {
Responce []byte `ntlmssp:"hexstring"` // 16 bytes, offset 0 // Result of GenerateNTLMv2ChallengeProof
Challenge []byte `ntlmssp:"hexstring"` // Variable, offset 16 // Direct copy from NTLMv2_CLIENT_CHALLENGE
}
func (*NTLMv2_Responce) Readable ¶
func (a *NTLMv2_Responce) Readable()
type VersionStruct ¶
type VersionStruct struct {
ProductMajor byte //1 bytes, offset 0
ProductMinor byte //1 bytes, offset 1
ProductBuild []byte //2 bytes, offset 2
Reserved []byte //3 bytes, offset 4
NTLMVersion byte //1 bytes, offset 7 ?
}
func (*VersionStruct) HumanString ¶
func (v *VersionStruct) HumanString() string
Move this to the PrintNTLMSSPStruc Returns a version string
Source Files
Click to show internal directories.
Click to hide internal directories.