kerberos_func.inc

漏洞扫描源码,可以扫描linux,windows,交换机路由器

#---------------------------------------------------------#
# Function    : der_encode_time                           #
# Description : Return der encoded KerberosTime           #
#---------------------------------------------------------#

function der_encode_time (time)
{
 if (isnull (time))
   return NULL;
   
 return der_encode (tag:0x18, data:time);
}


#---------------------------------------------------------#
# Function    : der_parse_data                            #
# Description : Return der decoded data                   #
#---------------------------------------------------------#

function der_parse_data (tag,data)
{
 local_var tmp;

 tmp = der_decode (data:data);
 if (isnull (tmp) || (tmp[0] != tag))
   return NULL;

 return tmp[1];
}


#---------------------------------------------------------#
# Function    : der_parse_list                            #
# Description : Return der decoded list                   #
#---------------------------------------------------------#

function der_parse_list (list)
{
 local_var tmp,pos,i,ret;

 if (!list)
   return NULL;
 
 tmp = NULL;
 tmp[0] = 0;
 
 pos = 0;
 i = 1;
 while (pos < strlen(list))
 {
  ret = der_decode (data:list,pos:pos);
  if (isnull(ret))
    return NULL;
  
  tmp[i] = substr (list, pos, ret[2]);
  tmp[0] = tmp[0] + 1;
  pos = ret[2];
  i++;
 }

 return tmp;
}


#---------------------------------------------------------#
# Function    : der_parse_sequence                        #
# Description : Return der decoded sequence               #
#---------------------------------------------------------#

function der_parse_sequence (seq,num,list)
{
 local_var tmp, dseq, val, i, pos, ret;
 
 dseq = der_decode (data:seq);
 if (isnull(dseq) || (dseq[0] != 0x30))
   return NULL;

 if (!isnull(list) && (list == TRUE))
   return der_parse_list (list:dseq[1]);
 
 tmp = NULL;
 for (i=0; i < num; i++)
   tmp[i] = NULL;
 
 pos = i = 0;
 while (pos < strlen(dseq[1]))
 {
  ret = der_decode (data:dseq[1],pos:pos);
  if (isnull(ret))
    return NULL;
  
  val = ret[0] - 0xA0;
  if (val < 0)
    return NULL;
  
  tmp[val] = ret [1];
  pos = ret[2];
 }
 
 return tmp;
}


#---------------------------------------------------------#
# Function    : der_parse_int                             #
# Description : Return der decoded integer                #
#---------------------------------------------------------#

function der_parse_int (i)
{
 local_var tmp;

 tmp = der_parse_data (tag:0x02, data:i);
 if (!tmp)
   return NULL;

 tmp = integer (i:tmp);
 if (isnull(tmp))
   return NULL;

 return tmp;
}


#---------------------------------------------------------#
# Function    : der_parse_octet_string                    #
# Description : Return der decoded octet string           #
#---------------------------------------------------------#

function der_parse_octet_string (string)
{
 return der_parse_data (tag:0x04, data:string);
}


#---------------------------------------------------------#
# Function    : der_parse_oid                             #
# Description : Return der decoded oid                    #
#---------------------------------------------------------#

function der_parse_oid (oid)
{
 local_var tmp;

 tmp = der_parse_data (tag:0x06, data:oid);
 if (!tmp)
   return NULL;

 tmp = der_decode_oid (oid:tmp);
 if (!tmp)
   return NULL;

 return tmp;
}


#---------------------------------------------------------#
# Function    : der_parse_list_oid                        #
# Description : Return der decoded oid list               #
#               "oid1 oid2 ..."                           #
#---------------------------------------------------------#

function der_parse_list_oid (list)
{
 local_var tmp, seq, i;

 tmp = NULL;

 seq = der_parse_sequence (seq:list,list:TRUE);
 if (isnull(seq))
   return NULL;
 
 for (i=0;i < seq[0];i++)
 {
  tmp += der_parse_oid (oid:seq[i+1]) + " ";
 }

 return tmp;
}


#---------------------------------------------------------#
# Function    : der_encode_paenc                          #
# Description : Return der encoded PA-ENC                 #
#---------------------------------------------------------#
#                                                         #
# PA-ENC-TS-ENC ::= SEQUENCE {                            #
#   patimestamp [0] KerberosTime, -- client's time        #
#   pausec      [1] INTEGER OPTIONAL                      #
# }                                                       #
#                                                         #
#---------------------------------------------------------#

function der_encode_paenc(time)
{
 local_var paenc;

 paenc = NULL;
 paenc[0] = der_encode_time (time:time);
 paenc[1] = NULL;

 return der_encode_sequence (seq:paenc);
}


#---------------------------------------------------------#
# Function    : der_encode_octet_string                   #
# Description : Return der encoded OCTET STRING           #
#---------------------------------------------------------#

function der_encode_octet_string (string)
{
 return der_encode (tag:0x04, data:string);
}


#---------------------------------------------------------#
# Function    : der_encode_padata                         #
# Description : Return der encoded PA-DATA                #
#---------------------------------------------------------#
#                                                         #
# PA-DATA ::= SEQUENCE {                                  #
#   padata-type  [1] INTEGER,                             #
#   padata-value [2] OCTET STRING,                        #
# }                                                       #
#                                                         #
#---------------------------------------------------------#

function der_encode_padata (type,value)
{
 local_var pa_data;

 pa_data = NULL;

 pa_data[0] = NULL;
 pa_data[1] = der_encode_int (i:type);
 pa_data[2] = der_encode_octet_string (string:value);

 return der_encode_sequence (seq:pa_data);
}


#---------------------------------------------------------#
# Function    : der_encode_crypt                          #
# Description : Return der encoded/crypted structure      #
#---------------------------------------------------------#

function der_encode_crypt (data, key, type, enc_type, real_key, realm, principal)
{
 local_var crypted, encrypted_data;

 encrypted_data = kerberos_encrypt (key:key, type:raw_dword (d:type), data:data, real_key:real_key, enc_type:enc_type, realm:realm, principal:principal);

 crypted = NULL;
 crypted[0] = der_encode_int (i:enc_type);
 crypted[1] = NULL;
 crypted[2] = der_encode_octet_string (string:encrypted_data);

 return der_encode_sequence (seq:crypted);
}


#---------------------------------------------------------#
# Function    : der_encode_list                           #
# Description : Return der encoded list                   #
#---------------------------------------------------------#

function der_encode_list (list)
{
 return der_encode (tag:0x30, data:list);
}


#---------------------------------------------------------#
# Function    : der_encode_kdcreq                         #
# Description : Return der encoded KDC-REQ                #
#---------------------------------------------------------#
#                                                         #
# KDC-REQ ::= SEQUENCE {                                  #
#   pvno     [1] INTEGER,                                 #
#   msg-type [2] INTEGER,                                 #
#   padata   [3] SEQUENCE OF PA-DATA OPTIONAL,            #
#   req-body [4] KDC-REQ-BODY                             #
# }                                                       #
#                                                         #
#---------------------------------------------------------#

function der_encode_kdcreq (pvno, msg_type, list, req_body)
{
 local_var l;

 l = NULL;

 l[0] = NULL;
 l[1] = der_encode_int (i:pvno);
 l[2] = der_encode_int (i:msg_type);
 l[3] = der_encode_list (list:list);
 l[4] = req_body;

 return der_encode_sequence (seq:l);
}


function der_encode_request (req)
{
 local_var request;
 
 request = NULL;
 request[0] = der_encode (tag:0x01, data:req); 
 
 return der_encode_sequence(seq:request);
}



#---------------------------------------------------------#
# Function    : der_encode_kdc_req_body                   #
# Description : Return der encoded KDC-REQ-BODY           #
#---------------------------------------------------------#
#                                                         #
# KDC-REQ-BODY ::= SEQUENCE {                             #
#   kdc-options [0] KDCOptions,                           #
#   cname       [1] PrincipalName OPTIONAL,               #
#   realm       [2] Realm, -- Server's realm              #
#   sname       [3] PrincipalName OPTIONAL,               #
#   from        [4] KerberosTime OPTIONAL,                #
#   till        [5] KerberosTime,                         #
#   rtime       [6] KerberosTime OPTIONAL,                #
#   nonce       [7] INTEGER,                              #
#   etype       [8] SEQUENCE OF INTEGER, -- EncType       #
#   addresses   [9] HostAddresses OPTIONAL,               #
#   enc-authorization-data [10]  EncryptedData OPTIONAL,  #
#   additional-tickets     [11]  SEQUENCE OF Ticket OPT   #
# }                                                       #
#                                                         #
#---------------------------------------------------------#

function der_encode_kdc_req_body (principal,realm,service,hosts)
{
 local_var list, options;

 list = options = NULL;

 options = der_encode (tag:0x03, data:raw_string (0x00,0x00,0x00,0x00,0x00));
 
 list[0] = options;
 if (!isnull(principal))
   list[1] = der_encode_name (type:1, name1:principal, name2:NULL);
 else
   list[1] = NULL;
 list[2] = der_encode_string (string:realm);
 list[3] = service;
 list[4] = NULL;
 list[5] = der_encode_time (time:"20370913024805Z");
 list[6] = der_encode_time (time:"20370913024805Z");
 list[7] = der_encode_int (i:rand());
 # rc4-hmac-md5 , des-cbc-md5
 list[8] = der_encode_list (list:der_encode_int (i:23)+der_encode_int(i:3));
 if (!isnull(hosts))
   list[9] = der_encode_list (list:hosts);
 else
   list[9] = NULL;

 return der_encode_sequence (seq:list);
}


#---------------------------------------------------------#
# Function    : kerberostime                              #
# Description : Return KerberosTime Format                #
#               YYYYMMDDHHMMSSZ (Z = UTC time)            #
#---------------------------------------------------------#

function kerberostime()
{
 local_var tmp,time,conv,field;

 time = localtime(unixtime(),utc:TRUE);
 tmp = string (time["year"]);
 foreach field (make_list("mon", "mday", "hour", "min", "sec"))
 {
  conv = string (time[field]);
  if (strlen (conv) == 1)
    conv = "0" + conv;
  tmp += conv;
 }
 tmp += "Z";
 
 return tmp;
}

#---------------------------------------------------------#
# Function    : der_encode_asreq                          #
# Description : Return der encoded AS-REQ                 #
#---------------------------------------------------------#
#                                                         #
# AS-REQ ::= [APPLICATION 10] KDC-REQ                     #
#                                                         #
# KDC-REQ ::= SEQUENCE {                                  #
#   pvno     [1] INTEGER,                                 #
#   msg-type [2] INTEGER,                                 #
#   padata   [3] SEQUENCE OF PA-DATA OPTIONAL,            #
#   req-body [4] KDC-REQ-BODY                             #
# }                                                       #
#                                                         #
# PA-DATA ::= SEQUENCE {                                  #
#   padata-type  [1] INTEGER,                             #
#   padata-value [2] OCTET STRING,                        #
# }                                                       #
#                                                         #
# padata-type     ::= PA-ENC-TIMESTAMP                    #
# padata-value    ::= EncryptedData -- PA-ENC-TS-ENC      #
#                                                         #
# PA-ENC-TS-ENC ::= SEQUENCE {                            #
#   patimestamp [0] KerberosTime, -- client's time        #
#   pausec      [1] INTEGER OPTIONAL                      #
# }                                                       #
#                                                         #	    
#---------------------------------------------------------#

function der_encode_asreq (principal,realm,enc_type,password)
{
 local_var req_body, encoded, host, pa_enc, padata_enc, padata, pa_pac, request, service;
 
 pa_pac = request = service = NULL;

 pa_enc = der_encode_paenc (time:kerberostime());
 padata_enc = der_encode_crypt (data:pa_enc, key:password, type:1, enc_type:enc_type, real_key:FALSE, realm:realm, principal:principal);
 padata = der_encode_padata (type:2, value:padata_enc);

 request = der_encode_request (req:raw_string (0xFF));
 pa_pac = der_encode_padata (type:128, value:request);
 
 service = der_encode_name (type:2, name1:"krbtgt", name2:realm);
 req_body = der_encode_kdc_req_body (principal:principal, realm:realm, service:service);
 
 encoded = der_encode_kdcreq (pvno:5, msg_type:0x0A, list:padata+pa_pac, req_body:req_body);

 return der_encode (tag:0x6A, data:encoded);
}



#---------------------------------------------------------#
# Function    : der_decode_kdcrep                         #
# Description : Return der session key and Ticket         #
#---------------------------------------------------------#
#                                                         #
# AS-REP ::=    [APPLICATION 11] KDC-REP                  #
# KDC-REP ::=   SEQUENCE {                                #
#   pvno            [0]   INTEGER,                        #
#   msg-type        [1]   INTEGER,                        #
#   padata          [2]   SEQUENCE OF PA-DATA OPTIONAL,   #
#   crealm          [3]   Realm,                          #
#   cname           [4]   PrincipalName,                  #
#   ticket          [5]   Ticket,                         #
#   enc-part        [6]   EncryptedData                   #
# }                                                       #
#                                                         #
# EncryptedData ::=   SEQUENCE {                          #
#   etype           [0]   INTEGER, -- EncryptionType      #
#   kvno            [1]   INTEGER OPTIONAL,               #
#   cipher          [2]   OCTET STRING -- ciphertext      #
# }                                                       #
#                                                         #
# EncASRepPart ::=    [APPLICATION 25] EncKDCRepPart      #
# EncKDCRepPart ::=   SEQUENCE {                          #
#   key             [0]   EncryptionKey,                  #
#   last-req        [1]   LastReq,                        #
#   nonce           [2]   INTEGER,                        #
#   key-expiration  [3]   KerberosTime OPTIONAL,          #
#   flags           [4]   TicketFlags,                    #
#   authtime        [5]   KerberosTime,                   #
#   starttime       [6]   KerberosTime OPTIONAL,          #
#   endtime         [7]   KerberosTime,                   #
#   renew-till      [8]   KerberosTime OPTIONAL,          #
#   srealm          [9]   Realm,                          #
#   sname           [10]  PrincipalName,                  #
#   caddr           [11]  HostAddresses OPTIONAL          #
# }                                                       #
#                                                         #
#---------------------------------------------------------#

function der_decode_kdcrep (type,password, data, real_key)
{
 local_var buf,pvno,msg_type,pa_data,crealm,cname,ticket,enc_part,kvno,seq,enc_type,encrypted;
 local_var decrypted, enc_key;
 local_var resp, realm, principal;
 
 resp = NULL;

 buf = der_decode (data:data);
 if (isnull(buf) || ((buf[0] != 0x6B) && (buf[0] != 0x6D)))
   return NULL;
 
 # Data are in SEQUENCE
 seq = der_parse_sequence (seq:buf[1], num:7, list:FALSE);
 if (isnull(seq))
   return NULL;

 # PVNO == 5
 pvno = der_parse_int (i:seq[0]);
 if (isnull(pvno) || (pvno != 5))
   return NULL;

 # MSG-Type == AS-REP
 msg_type = der_parse_int (i:seq[1]);
 if (isnull(msg_type) || (msg_type != type))
   return NULL;

 # crealm
 crealm = seq[3];
 if (!crealm) return NULL;
 resp[2] = crealm;

 # cname 
 cname = seq[4];
 if (!cname) return NULL;
 resp[3] = cname;

 # TGT 
 ticket = seq[5];
 if (!ticket) return NULL;
 resp[0] = ticket;

 # enc-part