Skip to Content.
Sympa Menu

freetds - Re: [freetds] SPNEGO+NTLM

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: "FreeTDS Development Group" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] SPNEGO+NTLM
  • Date: Wed, 28 Jun 2006 12:02:30 +0200

>
> Hi Frediano,
>
> I attach captured packets by using latest Ethereal.
>
> Here is legend:
> 192.168.15.22 is client computer - Windows XP. Here is Query Analyzer.
> 192.168.15.27 is computer, on which my "proxy" program is
> started - RedHat
> Linux.
> 192.168.15.3 is computer, on which is started MS SQL 2000
> Standard edition.
> OS - Windows 2003.
> 192.168.15.19 is another computer, on which is started MS SQL
> 2000 Standard
> edition. OS - Windows 2003.
>
> Start Ethereal, load attached file, filter packets by TDS and
> take a look on
> packet 34. Here Query Analyzer sends login packet to the
> "proxy" program.
> "Proxy" forwards this packet to MS SQL servers (192.168.15.3 and
> 192.168.15.19). These are packets 35 and 36.
>
> Next, in packet 37 MS SQL 2000 returns Type 2 message with
> challenge (0xFC,
> 0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88).
> In packet 39 the other server, 192.168.15.19 also returns challenge.
>
> Packet 41 - my "proxy" program forwards result to Query Analyzer - the
> result is returned packet from the first MS SQL server (
> 192.168.15.3).
>
> Packet 43 - Query Analyzer sends Type 3 message, which is
> being forwarded to
> 192.168.15.3 (packet 44) and server accepts it - packet 45.
>
> What is wrong is conversation with 192.168.15.19 - just
> follow packets 47
> and 48.
>
>
> Here is the problem - when I try to calculate LM Response and
> NTLM response
> as described here:
> http://davenport.sourceforge.net/ntlm.html#respondingToTheChallenge
>
> I always get wrong data. In practice - the password used in the above
> examples is "test123".
> Try to calculate LM response and NTLM response by using the
> challenge, sent
> by 192.168.15.3 - 0xFC, 0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88 and
> password "test123" and compare the results with these, sent by Query
> Analyzer in packet 41.
>
> As I wrote, the algorithm is not wrong, because I get correct
> results with
> "raw" NTLM messages - not like these in the attached file,
> analyzed above.
>
> That is the problem. Any idea will be useful!
>
> Iliyan Peychev
>

Well,

>From capture we have all 3 message types

00000104 86 48 86 f7 12 01 02 02 a2 32 04 30 4e 54 4c 4d .H......
.2.0NTLM
00000114 53 53 50 00 01 00 00 00 07 b2 08 a2 03 00 03 00 SSP.....
........
00000124 2d 00 00 00 05 00 05 00 28 00 00 00 05 01 28 0a -.......
(.....(.
00000134 00 00 00 0f 50 41 56 45 4c 49 53 53 ....PAVE LISS

00000045 37 02 02 0a a2 81 dd 04 81 da 4e 54 4c 4d 53 53 7.......
..NTLMSS
00000055 50 00 02 00 00 00 0e 00 0e 00 38 00 00 00 05 82 P.......
..8.....
00000065 8a a2 fc dd a9 f8 88 77 0e 88 00 00 00 00 00 00 .......w
........
00000075 00 00 94 00 94 00 46 00 00 00 05 02 ce 0e 00 00 ......F.
........
00000085 00 0f 57 00 49 00 4e 00 32 00 30 00 30 00 33 00 ..W.I.N.
2.0.0.3.
00000095 02 00 0e 00 57 00 49 00 4e 00 32 00 30 00 30 00 ....W.I.
N.2.0.0.
000000A5 33 00 01 00 0e 00 57 00 49 00 4e 00 32 00 30 00 3.....W.
I.N.2.0.
000000B5 30 00 33 00 04 00 32 00 77 00 69 00 6e 00 32 00 0.3...2.
w.i.n.2.
000000C5 30 00 30 00 33 00 2e 00 69 00 73 00 73 00 77 00 0.0.3...
i.s.s.w.
000000D5 69 00 6e 00 2e 00 69 00 73 00 73 00 2d 00 62 00 i.n...i.
s.s.-.b.
000000E5 67 00 2e 00 63 00 6f 00 6d 00 03 00 32 00 77 00 g...c.o.
m...2.w.
000000F5 69 00 6e 00 32 00 30 00 30 00 33 00 2e 00 69 00 i.n.2.0.
0.3...i.
00000105 73 00 73 00 77 00 69 00 6e 00 2e 00 69 00 73 00 s.s.w.i.
n...i.s.
00000115 73 00 2d 00 62 00 67 00 2e 00 63 00 6f 00 6d 00 s.-.b.g.
..c.o.m.
00000125 00 00 00 00 ....

00000150 9d 04 81 9a 4e 54 4c 4d 53 53 50 00 03 00 00 00 ....NTLM
SSP.....
00000160 18 00 18 00 6a 00 00 00 18 00 18 00 82 00 00 00 ....j...
........
00000170 0a 00 0a 00 48 00 00 00 0e 00 0e 00 52 00 00 00 ....H...
....R...
00000180 0a 00 0a 00 60 00 00 00 00 00 00 00 9a 00 00 00 ....`...
........
00000190 05 82 88 a2 05 01 28 0a 00 00 00 0f 50 00 41 00 ......(.
....P.A.
000001A0 56 00 45 00 4c 00 73 00 74 00 65 00 66 00 61 00 V.E.L.s.
t.e.f.a.
000001B0 6e 00 73 00 50 00 41 00 56 00 45 00 4c 00 75 a4 n.s.P.A.
V.E.L.u.
000001C0 50 b3 20 bc 43 de 00 00 00 00 00 00 00 00 00 00 P. .C...
........
000001D0 00 00 00 00 00 00 38 04 f5 f9 69 1f 46 46 88 af ......8.
..i.FF..
000001E0 78 64 6e 83 eb 8b 19 22 48 ae 91 6c 1f 3b xdn...."
H..l.;

I wrote this spnegontlm.java test

import java.security.Security;

import gnu.crypto.jce.GnuCrypto;

import Responses;

public class spnegontlm {

private static void printHex(byte[] data) {
for (int i = 0; i < data.length; ++i)
System.out.print(Integer.toHexString(data[i] |
0xff000000).substring(6)+" ");
System.out.println("");
}

public static void main(String[] args) throws java.lang.Exception {
Security.addProvider(new gnu.crypto.jce.GnuCrypto());

String pass = "test123";

byte[] challenge = new byte[] {
(byte) 0xfc, (byte) 0xdd, (byte) 0xa9, (byte) 0xf8,
(byte) 0x88, (byte) 0x77, (byte) 0x0e, (byte) 0x88
};
byte[] clientChallenge = new byte[] {
(byte) 0x75, (byte) 0xa4, (byte) 0x50, (byte) 0xb3,
(byte) 0x20, (byte) 0xbc, (byte) 0x43, (byte) 0xde
};
printHex(challenge);

printHex(Responses.getLMResponse(pass, challenge));
printHex(Responses.getNTLMResponse(pass, challenge));
printHex(Responses.getNTLM2SessionResponse(pass, challenge,
clientChallenge));
}

}

challenge is buffer you spot while clientChallenge came from message 3
(in LM response)

compiled (under Linux) with

gcj -C Responses.java -I/usr/share/java/gnu-crypto-2.0.1.jar
gcj -C spnegontlm.java -I/usr/share/java/gnu-crypto-2.0.1.jar

(Responses.java from davenport link)

Copied Responses.class and spnegontlm.class to a windows machine (where
I have sun java installed) with a lib directory from gnu-crypto and
executed with

java -cp lib\gnu-crypto.jar;. spnegontlm

output is

fc dd a9 f8 88 77 0e 88
91 95 49 1c c1 32 fb 5c 9b 30 1a 0f 43 c0 b6 b7 56 78 c4 c7 92 2b 76 09
8e d1 4f 19 fc 56 d8 96 28 cb 2d d0 ab b0 ab ad 20 82 b5 66 90 7f 1c 2b
38 04 f5 f9 69 1f 46 46 88 af 78 64 6e 83 eb 8b 19 22 48 ae 91 6c 1f 3b

As you can see NTLM2SessionResponse is the same as NTLM response from
type 3 ntlmssp packet.

freddy77





Archive powered by MHonArc 2.6.24.

Top of Page