FreeTDS Development Group

["Fernando" <nulll AT bol.com.br>]

Hello,

    I'm codify the login with NT Authentication(under TDS7) but still isn't 
terminated.
I think that 80% of the proccess will mapped but I break in a point(by 
unknown and
little time) and I want to share my work for found help to terminate the 
process. Does anybody has interested ? See following:

-------------------------------------------------------------------------
Login sequence based in SQL Server Authentication:
>> 0x10 (login packet)
<< 0xAD + 0xFD

Login sequence based in NT Authentication:
>> 0x10 (login packet) -- Negotiate
<< 0xED                -- Challenge
>> 0x11                -- Authenticate
<< 0xAD + 0xFD
-------------------------------------------------------------------------

Login packet to NT Authentication:
----------------------------------
Header
10
01
00CC
00000100
Payload
C400
0000010000
71
00000000000000
075004000000000000 --magic
E083 -- NtAuthenticate (if not NtAuthenticate is used E003)
0000B400000016040000 --magic
5600 --Position of hostname (Little endian)
0000 --Length of hostname   (Little endian)
0000 --Position of username (Little endian)
0000 --Length of username   (Little endian)
0000 --Position of password (Little endian)
0000 --Length of password   (Little endian)
5600 --Position of appname  (Little endian)
1500 --Length of appname    (Little endian)
8000 --Position of servername (Little endian)
0600 --Length of servername (Little endian)
0000 --Position of unknow   (Little endian)
0000 --Length of unknow     (Little endian)
8C00 --Position of libname  (Little endian)
0400 --Length of libame     (Little endian)
9400 --Position of language (Little endian)
0000 --Length of language   (Little endian)
9400 --Position of dbname   (Little endian)
0000 --Length of dbame      (Little endian)
0050FC253F57 --magic2C253F57
9400 --Partial packet size  (Little endian)
3000 --unknow               (Little endian)
C400 --Total packet size    (Little endian)
0000 --unknow
4D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A0065007200
 -- MS Query Analyser
760074007300310030003000 --vts100
4F00440042004300         --ODBC
4E544C4D535350  -- NTLMSSP           -------
0001 -- Message Type 1                      |
0000 -- unknow                              |
0007 -- unknow                              |
B2   -- unknow                              |
00A0 -- unknow                              |
0700 -- Domain length                       |
0700 -- Domain length                       |
2900 -- Domain offset                       | NTLMSSP Message Type-1 
(Negotiate)
0000 -- unknow                              |
0900 -- Host length                         |
0900 -- Host length                         |
2000 -- Host offset                         |
0000 -- unknow                              |
534154454C4C495445 --SATELLITE              |
444F4DD64E494F     --DOMÍNIO         --------


    This part named "NTLMSSP Message Type-1" is not necessarily in login 
packet
based in SQL Server authenticate, only in NT Authenticate. After send this 
login
packet to MSSQL Server, we receive the 0xED packet, described following:

0xED packet:
------------
Header
04
01
0049
00000000
Payload
ED
3E00
4E544C4D535350 --NTLMSSP               ----
0002 --Message Type 2                     |
0000000E000E00 --unknow/constant          |
3000 --Message len                        |
0000 --unknow/constant                    |
0582 --unknow/constant                    |  NTLMSSP Message Type-2 
(Challenge)
01002DCF9C3F5546 --Server nonce           |
46FD0000000000000000000000003E000000      |
44004F004D00CD004E0049004F00 --DOMÍNIO ----

  After receive this packet we has build the 0x11 packet. This is the part 
more
hard (or less easy). The 0x11 is the last packet in process of authenticate,
after it we receive the packets 0xAD and 0xFD, then the proccess is finished.
See description of 0x11 packet:

0x11 packet:
------------
Header
11
01
00B2
00000100
Payload
4E544C4D535350 --NTLMSSP                                        ---------
0003 -- unknow/constant                                                 |
000000 -- unknow/constant                                               |
1800 -- LM-resp len                                                     |
1800 -- LM-resp len                                                     |
7A00 -- LM-resp offset                                                  |
0000 -- unknow/constant                                                 |
1800 -- NT-resp len                                                     |
1800 -- NT-resp len                                                     |
9200 -- NT-resp offset                                                  |
0000 -- unknow/constant                                                 |
0E00 -- Domain len                                                      |
0E00 -- Domain len                                                      |
4000 -- Domain offset                                                   |
0000 -- unknow/constant                                                 |
1A00 -- User len                                                        |
1A00 -- User len                                                        |  
NTLMSSP Message Type-3 (Authenticate)
4E00 -- User offset                                                     |
0000 -- unknow/constant                                                 |
1200 -- Host len                                                        |
1200 -- Host len                                                        |
6800 -- Host offset                                                     |
000000000000 -- unknow/constant                                         |
AA00 -- Message len                                                     |
0000 -- Fixo                                                            |
0582 -- Fixo (0x0182)                                                   |
0000 -- Fixo                                                            |
44004F004D00CD004E0049004F00 --DOMÍNIO                                  |
410064006D0069006E006900730074007200610064006F007200 --Administrador    |
53004100540045004C004C00490054004500 --SATELLITE                        |
999A24312075654311A9967A04ADF2B1C1BBE9AE93637252 --LM manager           |
8152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27 --NT manager    --------

  My problem is get the "server nonce" of 0xED packet and build the LM manager
and NT manager to send in 0x11 packet. See the texts following:

--------------------------------------------------------------------------------
"The nonce is used by the client to create the LanManager and NT responses
(see Password Hashes). It is an array of 8 arbitrary bytes. The message length
field contains the length of the complete message, which in this case is
always 40"

"Password Hashes
To calculate the two response strings two password hashes are used: the 
LanManager
password hash and the NT password hash. These are described in detail in the
Samba ENCRYPTION.txt document. However, a few things are not clear (such as 
what
the magic constant for the LanManager hash is), so here is some almost-C code
which calculates the two responses. Inputs are passw and nonce, the results 
are
in lm_resp and nt_resp."

http://www.innovation.ch/java/ntlm.html
ftp://ftp.samba.org/pub/samba/docs/textdocs/ENCRYPTION.txt
--------------------------------------------------------------------------------
"11.2.7    Response Message Algorithm
This section describes the calculation of the response message from the 
challenge
message. The purpose of the response message is to prove to the server that 
the
client has access to a shared secret, the user password. To protect that 
password
from eavesdroppers, it is not sent across the wire. The client must take the
challenge and encrypt the challenge with the user password. It can then send 
this
signature across the wire without fear of compromising the user password.
For NTLM, the Data Encryption Standard is used to create a digital signature 
of
the challenge.

To calculate a digital signature, we need the challenge which is 8 bytes
(challenge - server nonce), the LanMan password which is 16 bytes (LMPW), and 
we
generate three 8-byte signatures (LMResp)."

http://www.opengroup.org/comsource/techref2/NCH1222X.HTM
--------------------------------------------------------------------------------

  After I read and study this texts I have any questions, then I publishe this
informations to with the freeTDS project, try to complete the processe. My
intention did is publishe only when the proccess is completed, but I'm not 
with
very time to pesquise.
  My big question is: In NTAuthenticate we have that know the password of 
user ?
For me this is strange, but all texts suggests the use of password of user to
encrypt the servernonce for build the last packet (0x11). And if it don't is
used, what we have use ?


Sample of MS Query Analyser:
>>100100CC00000100C40000000100007100000000000000075004000000000000E0830000B4000000160400005600000000000000000000005600150080000600000000008C00040094000000940000000050FC253F5794003000C40000004D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A00650072007600740073003100300030004F004400420043004E544C4D535350000100000007B200A007000700290000000900090020000000534154454C4C495445444F4DD64E494F

<<0401004900000000ED3E004E544C4D53535000020000000E000E0030000000058201002DCF9C3F554646FD0000000000000000000000003E00000044004F004D00CD004E0049004F00

>>110100B2000001004E544C4D5353500003000000180018007A00000018001800920000000E000E00400000001A001A004E000000120012006800000000000000AA0000000582000044004F004D00CD004E0049004F00410064006D0069006E006900730074007200610064006F00720053004100540045004C004C00490054004500999A24312075654311A9967A04ADF2B1C1BBE9AE936372528152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27

<<0401019800000000E31B0001066D0061007300740065007200066D0061007300740065007200AB620045160000020025004300680061006E00670065006400200064006100740061006200610073006500200063006F006E007400650078007400200074006F00200027006D006100730074006500720027002E0006560054005300310030003000000000E31700020A750073005F0065006E0067006C0069007300680000AB660047160000010027004300680061006E0067006500640020006C0061006E00670075006100670065002000730065007400740069006E006700200074006F002000750073005F0065006E0067006C006900730068002E0006560054005300310030003000000000E30F000305690073006F005F003100010000E30B000504310030003300330000E30F00060631003900360036003100310000AD36000107000000164D006900630072006F0073006F00660074002000530051004C002000530065007200760065007200000000000700034AE3130004043400300039003600043400300039003600FD0000000000000000

I can easily simulate and capture the comunications of MSSQL Server with
ethereal in the enterprise that I work.


Regards,
Fernando !!