http-ntlm.c

一个从网络上自动下载文件的自由工具

    memset(ntbuffer+16, 0, 5);
  }

  calc_resp(ntbuffer, nonce, ntresp);
#endif
}

#define SHORTPAIR(x) ((x) & 0xff), ((x) >> 8)
#define LONGQUARTET(x) ((x) & 0xff), (((x) >> 8)&0xff), \
  (((x) >>16)&0xff), ((x)>>24)

/* this is for creating ntlm header output */
char *
ntlm_output (struct ntlmdata *ntlm, const char *user, const char *passwd,
             bool *ready)
{
  const char *domain=""; /* empty */
  const char *host=""; /* empty */
  int domlen=strlen(domain);
  int hostlen = strlen(host);
  int hostoff; /* host name offset */
  int domoff;  /* domain name offset */
  int size;
  char *base64;
  char ntlmbuf[256]; /* enough, unless the host/domain is very long */

  /* point to the address of the pointer that holds the string to sent to the
     server, which is for a plain host or for a HTTP proxy */
  char *output;

  *ready = false;

  /* not set means empty */
  if(!user)
    user="";

  if(!passwd)
    passwd="";
  
  switch(ntlm->state) {
  case NTLMSTATE_TYPE1:
  default: /* for the weird cases we (re)start here */
    hostoff = 32;
    domoff = hostoff + hostlen;

    DEBUGP (("Creating a type-1 NTLM message.\n"));
    
    /* Create and send a type-1 message:

    Index Description          Content
    0     NTLMSSP Signature    Null-terminated ASCII "NTLMSSP"
                               (0x4e544c4d53535000)
    8     NTLM Message Type    long (0x01000000)
    12    Flags                long
    16    Supplied Domain      security buffer(*)
    24    Supplied Workstation security buffer(*)
    32    start of data block

    */

    snprintf (ntlmbuf, sizeof(ntlmbuf), "NTLMSSP%c"
              "\x01%c%c%c" /* 32-bit type = 1 */
              "%c%c%c%c"   /* 32-bit NTLM flag field */
              "%c%c"  /* domain length */
              "%c%c"  /* domain allocated space */
              "%c%c"  /* domain name offset */
              "%c%c"  /* 2 zeroes */
              "%c%c"  /* host length */
              "%c%c"  /* host allocated space */
              "%c%c"  /* host name offset */
              "%c%c"  /* 2 zeroes */
              "%s"   /* host name */
              "%s",  /* domain string */
              0,     /* trailing zero */
              0,0,0, /* part of type-1 long */

              LONGQUARTET(
                NTLMFLAG_NEGOTIATE_OEM|      /*   2 */
                NTLMFLAG_NEGOTIATE_NTLM_KEY  /* 200 */
                /* equals 0x0202 */
                ),
              SHORTPAIR(domlen),
              SHORTPAIR(domlen),
              SHORTPAIR(domoff),
              0,0,
              SHORTPAIR(hostlen),
              SHORTPAIR(hostlen),
              SHORTPAIR(hostoff),
              0,0,
              host, domain);

    /* initial packet length */
    size = 32 + hostlen + domlen;

    base64 = (char *) alloca (BASE64_LENGTH (size) + 1);
    base64_encode (ntlmbuf, size, base64);

    output = concat_strings ("NTLM ", base64, (char *) 0);
    break;
    
  case NTLMSTATE_TYPE2:
    /* We received the type-2 already, create a type-3 message:

    Index   Description            Content
    0       NTLMSSP Signature      Null-terminated ASCII "NTLMSSP"
                                   (0x4e544c4d53535000)
    8       NTLM Message Type      long (0x03000000)
    12      LM/LMv2 Response       security buffer(*)
    20      NTLM/NTLMv2 Response   security buffer(*)
    28      Domain Name            security buffer(*)
    36      User Name              security buffer(*)
    44      Workstation Name       security buffer(*)
    (52)    Session Key (optional) security buffer(*)
    (60)    Flags (optional)       long
    52 (64) start of data block

    */
  
  {
    int lmrespoff;
    int ntrespoff;
    int useroff;
    unsigned char lmresp[0x18]; /* fixed-size */
#ifdef USE_NTRESPONSES
    unsigned char ntresp[0x18]; /* fixed-size */
#endif
    const char *usr;
    int userlen;

    DEBUGP (("Creating a type-3 NTLM message.\n"));

    usr = strchr(user, '\\');
    if(!usr)
      usr = strchr(user, '/');

    if (usr) {
      domain = user;
      domlen = usr - domain;
      usr++;
    }
    else
      usr = user;
    userlen = strlen(usr);

    mkhash(passwd, &ntlm->nonce[0], lmresp
#ifdef USE_NTRESPONSES
           , ntresp
#endif
      );

    domoff = 64; /* always */
    useroff = domoff + domlen;
    hostoff = useroff + userlen;
    lmrespoff = hostoff + hostlen;
    ntrespoff = lmrespoff + 0x18;

    /* Create the big type-3 message binary blob */

    size = snprintf (ntlmbuf, sizeof(ntlmbuf),
                     "NTLMSSP%c"
                     "\x03%c%c%c" /* type-3, 32 bits */

                     "%c%c%c%c" /* LanManager length + allocated space */
                     "%c%c" /* LanManager offset */
                     "%c%c" /* 2 zeroes */

                     "%c%c" /* NT-response length */
                     "%c%c" /* NT-response allocated space */
                     "%c%c" /* NT-response offset */
                     "%c%c" /* 2 zeroes */

                     "%c%c"  /* domain length */
                     "%c%c"  /* domain allocated space */
                     "%c%c"  /* domain name offset */
                     "%c%c"  /* 2 zeroes */
                    
                     "%c%c"  /* user length */
                     "%c%c"  /* user allocated space */
                     "%c%c"  /* user offset */
                     "%c%c"  /* 2 zeroes */
                    
                     "%c%c"  /* host length */
                     "%c%c"  /* host allocated space */
                     "%c%c"  /* host offset */
                     "%c%c%c%c%c%c"  /* 6 zeroes */
                    
                     "\xff\xff"  /* message length */
                     "%c%c"  /* 2 zeroes */
                    
                     "\x01\x82" /* flags */
                     "%c%c"  /* 2 zeroes */

                     /* domain string */
                     /* user string */
                     /* host string */
                     /* LanManager response */
                     /* NT response */
                     ,
                     0, /* zero termination */
                     0,0,0, /* type-3 long, the 24 upper bits */

                     SHORTPAIR(0x18),  /* LanManager response length, twice */
                     SHORTPAIR(0x18),
                     SHORTPAIR(lmrespoff),
                     0x0, 0x0,

#ifdef USE_NTRESPONSES
                     SHORTPAIR(0x18),  /* NT-response length, twice */
                     SHORTPAIR(0x18),
#else
                     0x0, 0x0,
                     0x0, 0x0,
#endif
                     SHORTPAIR(ntrespoff),
                     0x0, 0x0,

                     SHORTPAIR(domlen),
                     SHORTPAIR(domlen),
                     SHORTPAIR(domoff),
                     0x0, 0x0,

                     SHORTPAIR(userlen),
                     SHORTPAIR(userlen),
                     SHORTPAIR(useroff),
                     0x0, 0x0,

                     SHORTPAIR(hostlen),
                     SHORTPAIR(hostlen),
                     SHORTPAIR(hostoff),
                     0x0, 0x0, 0x0, 0x0, 0x0, 0x0,

                     0x0, 0x0,

                     0x0, 0x0);

    /* size is now 64 */
    size=64;
    ntlmbuf[62]=ntlmbuf[63]=0;

    /* Make sure that the user and domain strings fit in the target buffer
       before we copy them there. */
    if(size + userlen + domlen >= sizeof(ntlmbuf))
      return NULL;
    
    memcpy(&ntlmbuf[size], domain, domlen);
    size += domlen;

    memcpy(&ntlmbuf[size], usr, userlen);
    size += userlen;

    /* we append the binary hashes to the end of the blob */
    if(size < ((int)sizeof(ntlmbuf) - 0x18)) {
      memcpy(&ntlmbuf[size], lmresp, 0x18);
      size += 0x18;
    }

#ifdef USE_NTRESPONSES
    if(size < ((int)sizeof(ntlmbuf) - 0x18)) {      
      memcpy(&ntlmbuf[size], ntresp, 0x18);
      size += 0x18;
    }
#endif

    ntlmbuf[56] = size & 0xff;
    ntlmbuf[57] = size >> 8;

    /* convert the binary blob into base64 */
    base64 = (char *) alloca (BASE64_LENGTH (size) + 1);
    base64_encode (ntlmbuf, size, base64);

    output = concat_strings ("NTLM ", base64, (char *) 0);

    ntlm->state = NTLMSTATE_TYPE3; /* we sent a type-3 */
    *ready = true;
  }
  break;

  case NTLMSTATE_TYPE3:
    /* connection is already authenticated,
     * don't send a header in future requests */
    *ready = true;
    output = NULL;
    break;
  }

  return output;
}