*** NT Authentication Sequence !! ***

Frediano Ziglio freddyz77 at tin.it
Fri May 2 19:13:14 EDT 2003


Il dom, 2002-07-21 alle 17:47, Fernando ha scritto:
> Hello,
> 
>     I'm codify the login with NT Authentication(under TDS7) but still isn't terminated.
> I think that 80% of the proccess will mapped but I break in a point(by unknown and
> little time) and I want to share my work for found help to terminate the process. Does anybody has interested ? See following:

I'm interested too.
Time ago I watch also some samba code but I stopped...

> 
> -------------------------------------------------------------------------
> Login sequence based in SQL Server Authentication:
> >> 0x10 (login packet)
> << 0xAD + 0xFD
> 
> Login sequence based in NT Authentication:
> >> 0x10 (login packet) -- Negotiate
> << 0xED                -- Challenge
> >> 0x11                -- Authenticate
> << 0xAD + 0xFD
> -------------------------------------------------------------------------
> 
> Login packet to NT Authentication:
> ----------------------------------
> Header
> 10
> 01
> 00CC
> 00000100
> Payload
> C400
> 0000010000
> 71
> 00000000000000
> 075004000000000000 --magic
> E083 -- NtAuthenticate (if not NtAuthenticate is used E003)
> 0000B400000016040000 --magic

See also tds7.txt in doc directory for filling some blank.

> 5600 --Position of hostname (Little endian)
> 0000 --Length of hostname   (Little endian)
> 0000 --Position of username (Little endian)
> 0000 --Length of username   (Little endian)
> 0000 --Position of password (Little endian)
> 0000 --Length of password   (Little endian)
> 5600 --Position of appname  (Little endian)
> 1500 --Length of appname    (Little endian)
> 8000 --Position of servername (Little endian)
> 0600 --Length of servername (Little endian)
> 0000 --Position of unknow   (Little endian)
> 0000 --Length of unknow     (Little endian)
> 8C00 --Position of libname  (Little endian)
> 0400 --Length of libame     (Little endian)
> 9400 --Position of language (Little endian)
> 0000 --Length of language   (Little endian)
> 9400 --Position of dbname   (Little endian)
> 0000 --Length of dbame      (Little endian)
> 0050FC253F57 --magic2C253F57

MAC address

> 9400 --Partial packet size  (Little endian)
> 3000 --unknow               (Little endian)

Authentication (offset and length)

> C400 --Total packet size    (Little endian)
> 0000 --unknow

I think this is another (unknown) offset, length field

> 4D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A0065007200 -- MS Query Analyser
> 760074007300310030003000 --vts100
> 4F00440042004300         --ODBC
> 4E544C4D535350  -- NTLMSSP           -------
> 00                                          |

Padding to 32 bit

> 01 -- Message Type 1                        |
> 0000 -- unknow                              |
> 00

Message type is a 32 bit (from samba code)


> 07B2 -- unknow                              |
> 00A0 -- unknow                              |

This contain a bit flags with info (Unicode coding, support for NTLMv2,
and other). I don't know if this field is 16 or 32 bit...

> 0700 -- Domain length                       |
> 0700 -- Domain length                       |
> 2900 -- Domain offset                       | NTLMSSP Message Type-1 (Negotiate)
> 0000 -- unknow                              |

Offset are 32bit, not 16bit, this is the high word of offset (discovered
in samba code)

> 0900 -- Host length                         |
> 0900 -- Host length                         |
> 2000 -- Host offset                         |
> 0000 -- unknow                              |
> 534154454C4C495445 --SATELLITE              |
> 444F4DD64E494F     --DOMÍNIO         --------
> 
> 
>     This part named "NTLMSSP Message Type-1" is not necessarily in login packet
> based in SQL Server authenticate, only in NT Authenticate. After send this login
> packet to MSSQL Server, we receive the 0xED packet, described following:
> 
> 0xED packet:
> ------------
> Header
> 04
> 01
> 0049
> 00000000
> Payload
> ED
> 3E00
> 4E544C4D535350 --NTLMSSP               ----
> 00                                        |
> 02000000 --Message Type 2                 |

> 0E000E00 --unknow/constant                |
> 3000 --Message len                        |
> 0000 --unknow/constant                    |

size, size, position of domain name

> 05820100 --unknow/constant                |  NTLMSSP Message Type-2 (Challenge)

This is a bit field that specify field of authentication (such as domain
in unicode and other)

> 2DCF9C3F554646FD --Server nonce           |

small correction

> 0000000000000000
> 000000003E000000      |

Another strange size,size,length field ???

> 44004F004D00CD004E0049004F00 --DOMÍNIO ----
> 
>   After receive this packet we has build the 0x11 packet. This is the part more
> hard (or less easy). The 0x11 is the last packet in process of authenticate,
> after it we receive the packets 0xAD and 0xFD, then the proccess is finished.
> See description of 0x11 packet:
> 
> 0x11 packet:
> ------------
> Header
> 11
> 01
> 00B2
> 00000100
> Payload
> 4E544C4D535350 --NTLMSSP                                        ---------
> 00                                                                   |
> 03000000 -- unknow/constant                                          |

Message type 3

> 1800 -- LM-resp len                                                     |
> 1800 -- LM-resp len                                                     |
> 7A00 -- LM-resp offset                                                  |
> 0000 -- unknow/constant                                                 |
> 1800 -- NT-resp len                                                     |
> 1800 -- NT-resp len                                                     |
> 9200 -- NT-resp offset                                                  |
> 0000 -- unknow/constant                                                 |
> 0E00 -- Domain len                                                      |
> 0E00 -- Domain len                                                      |
> 4000 -- Domain offset                                                   |
> 0000 -- unknow/constant                                                 |
> 1A00 -- User len                                                        |
> 1A00 -- User len                                                        |  NTLMSSP Message Type-3 (Authenticate)
> 4E00 -- User offset                                                     |
> 0000 -- unknow/constant                                                 |
> 1200 -- Host len                                                        |
> 1200 -- Host len                                                        |
> 6800 -- Host offset                                                     |
> 000000000000 -- unknow/constant                                         |
> AA00 -- Message len                                                     |
> 0000 -- Fixo                                                            |
> 0582 -- Fixo (0x0182)                                                   |
> 0000 -- Fixo                                                            |
> 44004F004D00CD004E0049004F00 --DOMÍNIO                                  |
> 410064006D0069006E006900730074007200610064006F007200 --Administrador    |
> 53004100540045004C004C00490054004500 --SATELLITE                        |
> 999A24312075654311A9967A04ADF2B1C1BBE9AE93637252 --LM manager           |
> 8152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27 --NT manager    --------
> 
>   My problem is get the "server nonce" of 0xED packet and build the LM manager
> and NT manager to send in 0x11 packet. See the texts following:
> 
> --------------------------------------------------------------------------------
> "The nonce is used by the client to create the LanManager and NT responses
> (see Password Hashes). It is an array of 8 arbitrary bytes. The message length
> field contains the length of the complete message, which in this case is
> always 40"
> 
> "Password Hashes
> To calculate the two response strings two password hashes are used: the LanManager
> password hash and the NT password hash. These are described in detail in the
> Samba ENCRYPTION.txt document. However, a few things are not clear (such as what
> the magic constant for the LanManager hash is), so here is some almost-C code
> which calculates the two responses. Inputs are passw and nonce, the results are
> in lm_resp and nt_resp."
> 
> http://www.innovation.ch/java/ntlm.html
> ftp://ftp.samba.org/pub/samba/docs/textdocs/ENCRYPTION.txt
> --------------------------------------------------------------------------------
> "11.2.7    Response Message Algorithm
> This section describes the calculation of the response message from the challenge
> message. The purpose of the response message is to prove to the server that the
> client has access to a shared secret, the user password. To protect that password
> from eavesdroppers, it is not sent across the wire. The client must take the
> challenge and encrypt the challenge with the user password. It can then send this
> signature across the wire without fear of compromising the user password.
> For NTLM, the Data Encryption Standard is used to create a digital signature of
> the challenge.
> 
> To calculate a digital signature, we need the challenge which is 8 bytes
> (challenge - server nonce), the LanMan password which is 16 bytes (LMPW), and we
> generate three 8-byte signatures (LMResp)."
> 
> http://www.opengroup.org/comsource/techref2/NCH1222X.HTM

Very interesting !!

> --------------------------------------------------------------------------------
> 
>   After I read and study this texts I have any questions, then I publishe this
> informations to with the freeTDS project, try to complete the processe. My
> intention did is publishe only when the proccess is completed, but I'm not with
> very time to pesquise.
>   My big question is: In NTAuthenticate we have that know the password of user ?

Yes... and no.
I think even windows code clear text password using LN and NT scheme and
store just those crypted password.
Anyone know the method to obtain those crypted passwords from windows?



More information about the FreeTDS mailing list