FreeTDS Development Group

[Frediano Ziglio <freddyz77 AT tin.it>]

Il dom, 2002-07-21 alle 17:47, Fernando ha scritto:
> Hello,
> 
>     I'm codify the login with NT Authentication(under TDS7) but still isn't 
> terminated.
> I think that 80% of the proccess will mapped but I break in a point(by 
> unknown and
> little time) and I want to share my work for found help to terminate the 
> process. Does anybody has interested ? See following:

I'm interested too.
Time ago I watch also some samba code but I stopped...

> 
> -------------------------------------------------------------------------
> Login sequence based in SQL Server Authentication:
> >> 0x10 (login packet)
> << 0xAD + 0xFD
> 
> Login sequence based in NT Authentication:
> >> 0x10 (login packet) -- Negotiate
> << 0xED                -- Challenge
> >> 0x11                -- Authenticate
> << 0xAD + 0xFD
> -------------------------------------------------------------------------
> 
> Login packet to NT Authentication:
> ----------------------------------
> Header
> 10
> 01
> 00CC
> 00000100
> Payload
> C400
> 0000010000
> 71
> 00000000000000
> 075004000000000000 --magic
> E083 -- NtAuthenticate (if not NtAuthenticate is used E003)
> 0000B400000016040000 --magic

See also tds7.txt in doc directory for filling some blank.

> 5600 --Position of hostname (Little endian)
> 0000 --Length of hostname   (Little endian)
> 0000 --Position of username (Little endian)
> 0000 --Length of username   (Little endian)
> 0000 --Position of password (Little endian)
> 0000 --Length of password   (Little endian)
> 5600 --Position of appname  (Little endian)
> 1500 --Length of appname    (Little endian)
> 8000 --Position of servername (Little endian)
> 0600 --Length of servername (Little endian)
> 0000 --Position of unknow   (Little endian)
> 0000 --Length of unknow     (Little endian)
> 8C00 --Position of libname  (Little endian)
> 0400 --Length of libame     (Little endian)
> 9400 --Position of language (Little endian)
> 0000 --Length of language   (Little endian)
> 9400 --Position of dbname   (Little endian)
> 0000 --Length of dbame      (Little endian)
> 0050FC253F57 --magic2C253F57

MAC address

> 9400 --Partial packet size  (Little endian)
> 3000 --unknow               (Little endian)

Authentication (offset and length)

> C400 --Total packet size    (Little endian)
> 0000 --unknow

I think this is another (unknown) offset, length field

> 4D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A0065007200
>  -- MS Query Analyser
> 760074007300310030003000 --vts100
> 4F00440042004300         --ODBC
> 4E544C4D535350  -- NTLMSSP           -------
> 00                                          |

Padding to 32 bit

> 01 -- Message Type 1                        |
> 0000 -- unknow                              |
> 00

Message type is a 32 bit (from samba code)


> 07B2 -- unknow                              |
> 00A0 -- unknow                              |

This contain a bit flags with info (Unicode coding, support for NTLMv2,
and other). I don't know if this field is 16 or 32 bit...

> 0700 -- Domain length                       |
> 0700 -- Domain length                       |
> 2900 -- Domain offset                       | NTLMSSP Message Type-1 
> (Negotiate)
> 0000 -- unknow                              |

Offset are 32bit, not 16bit, this is the high word of offset (discovered
in samba code)

> 0900 -- Host length                         |
> 0900 -- Host length                         |
> 2000 -- Host offset                         |
> 0000 -- unknow                              |
> 534154454C4C495445 --SATELLITE              |
> 444F4DD64E494F     --DOMÍNIO         --------
> 
> 
>     This part named "NTLMSSP Message Type-1" is not necessarily in login 
> packet
> based in SQL Server authenticate, only in NT Authenticate. After send this 
> login
> packet to MSSQL Server, we receive the 0xED packet, described following:
> 
> 0xED packet:
> ------------
> Header
> 04
> 01
> 0049
> 00000000
> Payload
> ED
> 3E00
> 4E544C4D535350 --NTLMSSP               ----
> 00                                        |
> 02000000 --Message Type 2                 |

> 0E000E00 --unknow/constant                |
> 3000 --Message len                        |
> 0000 --unknow/constant                    |

size, size, position of domain name

> 05820100 --unknow/constant                |  NTLMSSP Message Type-2 
> (Challenge)

This is a bit field that specify field of authentication (such as domain
in unicode and other)

> 2DCF9C3F554646FD --Server nonce           |

small correction

> 0000000000000000
> 000000003E000000      |

Another strange size,size,length field ???

> 44004F004D00CD004E0049004F00 --DOMÍNIO ----
> 
>   After receive this packet we has build the 0x11 packet. This is the part 
> more
> hard (or less easy). The 0x11 is the last packet in process of authenticate,
> after it we receive the packets 0xAD and 0xFD, then the proccess is 
> finished.
> See description of 0x11 packet:
> 
> 0x11 packet:
> ------------
> Header
> 11
> 01
> 00B2
> 00000100
> Payload
> 4E544C4D535350 --NTLMSSP                                        ---------
> 00                                                                   |
> 03000000 -- unknow/constant                                          |

Message type 3

> 1800 -- LM-resp len                                                     |
> 1800 -- LM-resp len                                                     |
> 7A00 -- LM-resp offset                                                  |
> 0000 -- unknow/constant                                                 |
> 1800 -- NT-resp len                                                     |
> 1800 -- NT-resp len                                                     |
> 9200 -- NT-resp offset                                                  |
> 0000 -- unknow/constant                                                 |
> 0E00 -- Domain len                                                      |
> 0E00 -- Domain len                                                      |
> 4000 -- Domain offset                                                   |
> 0000 -- unknow/constant                                                 |
> 1A00 -- User len                                                        |
> 1A00 -- User len                                                        |  
> NTLMSSP Message Type-3 (Authenticate)
> 4E00 -- User offset                                                     |
> 0000 -- unknow/constant                                                 |
> 1200 -- Host len                                                        |
> 1200 -- Host len                                                        |
> 6800 -- Host offset                                                     |
> 000000000000 -- unknow/constant                                         |
> AA00 -- Message len                                                     |
> 0000 -- Fixo                                                            |
> 0582 -- Fixo (0x0182)                                                   |
> 0000 -- Fixo                                                            |
> 44004F004D00CD004E0049004F00 --DOMÍNIO                                  |
> 410064006D0069006E006900730074007200610064006F007200 --Administrador    |
> 53004100540045004C004C00490054004500 --SATELLITE                        |
> 999A24312075654311A9967A04ADF2B1C1BBE9AE93637252 --LM manager           |
> 8152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27 --NT manager    --------
> 
>   My problem is get the "server nonce" of 0xED packet and build the LM 
> manager
> and NT manager to send in 0x11 packet. See the texts following:
> 
> --------------------------------------------------------------------------------
> "The nonce is used by the client to create the LanManager and NT responses
> (see Password Hashes). It is an array of 8 arbitrary bytes. The message 
> length
> field contains the length of the complete message, which in this case is
> always 40"
> 
> "Password Hashes
> To calculate the two response strings two password hashes are used: the 
> LanManager
> password hash and the NT password hash. These are described in detail in the
> Samba ENCRYPTION.txt document. However, a few things are not clear (such as 
> what
> the magic constant for the LanManager hash is), so here is some almost-C 
> code
> which calculates the two responses. Inputs are passw and nonce, the results 
> are
> in lm_resp and nt_resp."
> 
> http://www.innovation.ch/java/ntlm.html
> ftp://ftp.samba.org/pub/samba/docs/textdocs/ENCRYPTION.txt
> --------------------------------------------------------------------------------
> "11.2.7    Response Message Algorithm
> This section describes the calculation of the response message from the 
> challenge
> message. The purpose of the response message is to prove to the server that 
> the
> client has access to a shared secret, the user password. To protect that 
> password
> from eavesdroppers, it is not sent across the wire. The client must take the
> challenge and encrypt the challenge with the user password. It can then 
> send this
> signature across the wire without fear of compromising the user password.
> For NTLM, the Data Encryption Standard is used to create a digital 
> signature of
> the challenge.
> 
> To calculate a digital signature, we need the challenge which is 8 bytes
> (challenge - server nonce), the LanMan password which is 16 bytes (LMPW), 
> and we
> generate three 8-byte signatures (LMResp)."
> 
> http://www.opengroup.org/comsource/techref2/NCH1222X.HTM

Very interesting !!

> --------------------------------------------------------------------------------
> 
>   After I read and study this texts I have any questions, then I publishe 
> this
> informations to with the freeTDS project, try to complete the processe. My
> intention did is publishe only when the proccess is completed, but I'm not 
> with
> very time to pesquise.
>   My big question is: In NTAuthenticate we have that know the password of 
> user ?

Yes... and no.
I think even windows code clear text password using LN and NT scheme and
store just those crypted password.
Anyone know the method to obtain those crypted passwords from windows?

>From the first link

    /* setup LanManager password */

    char  lm_pw[14];
    int   len = strlen(passw);
    if (len > 14)  len = 14;

    for (idx=0; idx<len; idx++)
        lm_pw[idx] = toupper(passw[idx]);
    for (; idx<14; idx++)
        lm_pw[idx] = 0;


    /* create LanManager hashed password */

    unsigned char magic[] = { 0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24,
0x25 };
    unsigned char lm_hpw[21];
    des_key_schedule ks;

    setup_des_key(lm_pw, ks);
    des_ecb_encrypt(magic, lm_hpw, ks);

    setup_des_key(lm_pw+7, ks);
    des_ecb_encrypt(magic, lm_hpw+8, ks);

    memset(lm_hpw+16, 0, 5);


    /* create NT hashed password */

    int   len = strlen(passw);
    char  nt_pw[2*len];
    for (idx=0; idx<len; idx++)
    {
        nt_pw[2*idx]   = passw[idx];
        nt_pw[2*idx+1] = 0;
    }

    unsigned char nt_hpw[21];
    MD4_CTX context;
    MD4Init(&context);
    MD4Update(&context, nt_pw, 2*len);
    MD4Final(nt_hpw, &context);

    memset(nt_hpw+16, 0, 5);

This code crypt clear text password (as you can see it not use any
information from network).


> For me this is strange, but all texts suggests the use of password of user 
> to
> encrypt the servernonce for build the last packet (0x11). And if it don't is
> used, what we have use ?
> 
> 
> Sample of MS Query Analyser:
> >>100100CC00000100C40000000100007100000000000000075004000000000000E0830000B4000000160400005600000000000000000000005600150080000600000000008C00040094000000940000000050FC253F5794003000C40000004D0053002000530051004C00200051007500650072007900200041006E0061006C0079007A00650072007600740073003100300030004F004400420043004E544C4D535350000100000007B200A007000700290000000900090020000000534154454C4C495445444F4DD64E494F
> 
> <<0401004900000000ED3E004E544C4D53535000020000000E000E0030000000058201002DCF9C3F554646FD0000000000000000000000003E00000044004F004D00CD004E0049004F00
> 
> >>110100B2000001004E544C4D5353500003000000180018007A00000018001800920000000E000E00400000001A001A004E000000120012006800000000000000AA0000000582000044004F004D00CD004E0049004F00410064006D0069006E006900730074007200610064006F00720053004100540045004C004C00490054004500999A24312075654311A9967A04ADF2B1C1BBE9AE936372528152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27
> 
> <<0401019800000000E31B0001066D0061007300740065007200066D0061007300740065007200AB620045160000020025004300680061006E00670065006400200064006100740061006200610073006500200063006F006E007400650078007400200074006F00200027006D006100730074006500720027002E0006560054005300310030003000000000E31700020A750073005F0065006E0067006C0069007300680000AB660047160000010027004300680061006E0067006500640020006C0061006E00670075006100670065002000730065007400740069006E006700200074006F002000750073005F0065006E0067006C006900730068002E0006560054005300310030003000000000E30F000305690073006F005F003100010000E30B000504310030003300330000E30F00060631003900360036003100310000AD36000107000000164D006900630072006F0073006F00660074002000530051004C002000530065007200760065007200000000000700034AE3130004043400300039003600043400300039003600FD0000000000000000
> 
> I can easily simulate and capture the comunications of MSSQL Server with
> ethereal in the enterprise that I work.
> 

I think at this time ethereal are no more necessary...

> 
> Regards,
> Fernando !!
> 

Good Luck

  Frediano Ziglio (aka freddy77)