Skip to Content.
Sympa Menu

freetds - Re: *** NT Authentication Sequence !! ***

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddyz77 AT tin.it>
  • To: TDS Development Group <freetds AT franklin.oit.unc.edu>
  • Subject: Re: *** NT Authentication Sequence !! ***
  • Date: 21 Jul 2002 19:22:43 +0200


Il dom, 2002-07-21 alle 17:47, Fernando ha scritto:
> Hello,
>
> I'm codify the login with NT Authentication(under TDS7) but still isn't
> terminated.
> I think that 80% of the proccess will mapped but I break in a point(by
> unknown and
> little time) and I want to share my work for found help to terminate the
> process. Does anybody has interested ? See following:

I'm interested too.
Time ago I watch also some samba code but I stopped...

>
> -------------------------------------------------------------------------
> Login sequence based in SQL Server Authentication:
> >> 0x10 (login packet)
> << 0xAD + 0xFD
>
> Login sequence based in NT Authentication:
> >> 0x10 (login packet) -- Negotiate
> << 0xED -- Challenge
> >> 0x11 -- Authenticate
> << 0xAD + 0xFD
> -------------------------------------------------------------------------
>
> Login packet to NT Authentication:
> ----------------------------------
> Header
> 10
> 01
> 00CC
> 00000100
> Payload
> C400
> 0000010000
> 71
> 00000000000000
> 075004000000000000 --magic
> E083 -- NtAuthenticate (if not NtAuthenticate is used E003)
> 0000B400000016040000 --magic

See also tds7.txt in doc directory for filling some blank.

> 5600 --Position of hostname (Little endian)
> 0000 --Length of hostname (Little endian)
> 0000 --Position of username (Little endian)
> 0000 --Length of username (Little endian)
> 0000 --Position of password (Little endian)
> 0000 --Length of password (Little endian)
> 5600 --Position of appname (Little endian)
> 1500 --Length of appname (Little endian)
> 8000 --Position of servername (Little endian)
> 0600 --Length of servername (Little endian)
> 0000 --Position of unknow (Little endian)
> 0000 --Length of unknow (Little endian)
> 8C00 --Position of libname (Little endian)
> 0400 --Length of libame (Little endian)
> 9400 --Position of language (Little endian)
> 0000 --Length of language (Little endian)
> 9400 --Position of dbname (Little endian)
> 0000 --Length of dbame (Little endian)
> 0050FC253F57 --magic2C253F57

MAC address

> 9400 --Partial packet size (Little endian)
> 3000 --unknow (Little endian)

Authentication (offset and length)

> C400 --Total packet size (Little endian)
> 0000 --unknow

I think this is another (unknown) offset, length field

> 4D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A0065007200
> -- MS Query Analyser
> 760074007300310030003000 --vts100
> 4F00440042004300 --ODBC
> 4E544C4D535350 -- NTLMSSP -------
> 00 |

Padding to 32 bit

> 01 -- Message Type 1 |
> 0000 -- unknow |
> 00

Message type is a 32 bit (from samba code)


> 07B2 -- unknow |
> 00A0 -- unknow |

This contain a bit flags with info (Unicode coding, support for NTLMv2,
and other). I don't know if this field is 16 or 32 bit...

> 0700 -- Domain length |
> 0700 -- Domain length |
> 2900 -- Domain offset | NTLMSSP Message Type-1
> (Negotiate)
> 0000 -- unknow |

Offset are 32bit, not 16bit, this is the high word of offset (discovered
in samba code)

> 0900 -- Host length |
> 0900 -- Host length |
> 2000 -- Host offset |
> 0000 -- unknow |
> 534154454C4C495445 --SATELLITE |
> 444F4DD64E494F --DOMÍNIO --------
>
>
> This part named "NTLMSSP Message Type-1" is not necessarily in login
> packet
> based in SQL Server authenticate, only in NT Authenticate. After send this
> login
> packet to MSSQL Server, we receive the 0xED packet, described following:
>
> 0xED packet:
> ------------
> Header
> 04
> 01
> 0049
> 00000000
> Payload
> ED
> 3E00
> 4E544C4D535350 --NTLMSSP ----
> 00 |
> 02000000 --Message Type 2 |

> 0E000E00 --unknow/constant |
> 3000 --Message len |
> 0000 --unknow/constant |

size, size, position of domain name

> 05820100 --unknow/constant | NTLMSSP Message Type-2
> (Challenge)

This is a bit field that specify field of authentication (such as domain
in unicode and other)

> 2DCF9C3F554646FD --Server nonce |

small correction

> 0000000000000000
> 000000003E000000 |

Another strange size,size,length field ???

> 44004F004D00CD004E0049004F00 --DOMÍNIO ----
>
> After receive this packet we has build the 0x11 packet. This is the part
> more
> hard (or less easy). The 0x11 is the last packet in process of authenticate,
> after it we receive the packets 0xAD and 0xFD, then the proccess is
> finished.
> See description of 0x11 packet:
>
> 0x11 packet:
> ------------
> Header
> 11
> 01
> 00B2
> 00000100
> Payload
> 4E544C4D535350 --NTLMSSP ---------
> 00 |
> 03000000 -- unknow/constant |

Message type 3

> 1800 -- LM-resp len |
> 1800 -- LM-resp len |
> 7A00 -- LM-resp offset |
> 0000 -- unknow/constant |
> 1800 -- NT-resp len |
> 1800 -- NT-resp len |
> 9200 -- NT-resp offset |
> 0000 -- unknow/constant |
> 0E00 -- Domain len |
> 0E00 -- Domain len |
> 4000 -- Domain offset |
> 0000 -- unknow/constant |
> 1A00 -- User len |
> 1A00 -- User len |
> NTLMSSP Message Type-3 (Authenticate)
> 4E00 -- User offset |
> 0000 -- unknow/constant |
> 1200 -- Host len |
> 1200 -- Host len |
> 6800 -- Host offset |
> 000000000000 -- unknow/constant |
> AA00 -- Message len |
> 0000 -- Fixo |
> 0582 -- Fixo (0x0182) |
> 0000 -- Fixo |
> 44004F004D00CD004E0049004F00 --DOMÍNIO |
> 410064006D0069006E006900730074007200610064006F007200 --Administrador |
> 53004100540045004C004C00490054004500 --SATELLITE |
> 999A24312075654311A9967A04ADF2B1C1BBE9AE93637252 --LM manager |
> 8152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27 --NT manager --------
>
> My problem is get the "server nonce" of 0xED packet and build the LM
> manager
> and NT manager to send in 0x11 packet. See the texts following:
>
> --------------------------------------------------------------------------------
> "The nonce is used by the client to create the LanManager and NT responses
> (see Password Hashes). It is an array of 8 arbitrary bytes. The message
> length
> field contains the length of the complete message, which in this case is
> always 40"
>
> "Password Hashes
> To calculate the two response strings two password hashes are used: the
> LanManager
> password hash and the NT password hash. These are described in detail in the
> Samba ENCRYPTION.txt document. However, a few things are not clear (such as
> what
> the magic constant for the LanManager hash is), so here is some almost-C
> code
> which calculates the two responses. Inputs are passw and nonce, the results
> are
> in lm_resp and nt_resp."
>
> http://www.innovation.ch/java/ntlm.html
> ftp://ftp.samba.org/pub/samba/docs/textdocs/ENCRYPTION.txt
> --------------------------------------------------------------------------------
> "11.2.7 Response Message Algorithm
> This section describes the calculation of the response message from the
> challenge
> message. The purpose of the response message is to prove to the server that
> the
> client has access to a shared secret, the user password. To protect that
> password
> from eavesdroppers, it is not sent across the wire. The client must take the
> challenge and encrypt the challenge with the user password. It can then
> send this
> signature across the wire without fear of compromising the user password.
> For NTLM, the Data Encryption Standard is used to create a digital
> signature of
> the challenge.
>
> To calculate a digital signature, we need the challenge which is 8 bytes
> (challenge - server nonce), the LanMan password which is 16 bytes (LMPW),
> and we
> generate three 8-byte signatures (LMResp)."
>
> http://www.opengroup.org/comsource/techref2/NCH1222X.HTM

Very interesting !!

> --------------------------------------------------------------------------------
>
> After I read and study this texts I have any questions, then I publishe
> this
> informations to with the freeTDS project, try to complete the processe. My
> intention did is publishe only when the proccess is completed, but I'm not
> with
> very time to pesquise.
> My big question is: In NTAuthenticate we have that know the password of
> user ?

Yes... and no.
I think even windows code clear text password using LN and NT scheme and
store just those crypted password.
Anyone know the method to obtain those crypted passwords from windows?

>From the first link

/* setup LanManager password */

char lm_pw[14];
int len = strlen(passw);
if (len > 14) len = 14;

for (idx=0; idx<len; idx++)
lm_pw[idx] = toupper(passw[idx]);
for (; idx<14; idx++)
lm_pw[idx] = 0;


/* create LanManager hashed password */

unsigned char magic[] = { 0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24,
0x25 };
unsigned char lm_hpw[21];
des_key_schedule ks;

setup_des_key(lm_pw, ks);
des_ecb_encrypt(magic, lm_hpw, ks);

setup_des_key(lm_pw+7, ks);
des_ecb_encrypt(magic, lm_hpw+8, ks);

memset(lm_hpw+16, 0, 5);


/* create NT hashed password */

int len = strlen(passw);
char nt_pw[2*len];
for (idx=0; idx<len; idx++)
{
nt_pw[2*idx] = passw[idx];
nt_pw[2*idx+1] = 0;
}

unsigned char nt_hpw[21];
MD4_CTX context;
MD4Init(&context);
MD4Update(&context, nt_pw, 2*len);
MD4Final(nt_hpw, &context);

memset(nt_hpw+16, 0, 5);

This code crypt clear text password (as you can see it not use any
information from network).


> For me this is strange, but all texts suggests the use of password of user
> to
> encrypt the servernonce for build the last packet (0x11). And if it don't is
> used, what we have use ?
>
>
> Sample of MS Query Analyser:
> >>100100CC00000100C40000000100007100000000000000075004000000000000E0830000B4000000160400005600000000000000000000005600150080000600000000008C00040094000000940000000050FC253F5794003000C40000004D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A00650072007600740073003100300030004F004400420043004E544C4D535350000100000007B200A007000700290000000900090020000000534154454C4C495445444F4DD64E494F
>
> <<0401004900000000ED3E004E544C4D53535000020000000E000E0030000000058201002DCF9C3F554646FD0000000000000000000000003E00000044004F004D00CD004E0049004F00
>
> >>110100B2000001004E544C4D5353500003000000180018007A00000018001800920000000E000E00400000001A001A004E000000120012006800000000000000AA0000000582000044004F004D00CD004E0049004F00410064006D0069006E006900730074007200610064006F00720053004100540045004C004C00490054004500999A24312075654311A9967A04ADF2B1C1BBE9AE936372528152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27
>
> <<0401019800000000E31B0001066D0061007300740065007200066D0061007300740065007200AB620045160000020025004300680061006E00670065006400200064006100740061006200610073006500200063006F006E007400650078007400200074006F00200027006D006100730074006500720027002E0006560054005300310030003000000000E31700020A750073005F0065006E0067006C0069007300680000AB660047160000010027004300680061006E0067006500640020006C0061006E00670075006100670065002000730065007400740069006E006700200074006F002000750073005F0065006E0067006C006900730068002E0006560054005300310030003000000000E30F000305690073006F005F003100010000E30B000504310030003300330000E30F00060631003900360036003100310000AD36000107000000164D006900630072006F0073006F00660074002000530051004C002000530065007200760065007200000000000700034AE3130004043400300039003600043400300039003600FD0000000000000000
>
> I can easily simulate and capture the comunications of MSSQL Server with
> ethereal in the enterprise that I work.
>

I think at this time ethereal are no more necessary...

>
> Regards,
> Fernando !!
>

Good Luck

Frediano Ziglio (aka freddy77)






Archive powered by MHonArc 2.6.24.

Top of Page