Skip to content

Commit 69e80f2

Browse files
p0rtL6p0rtL6
authored
Merge branch 'fortra:master' into master
2 parents e45f7c2 + ff8d248 commit 69e80f2

File tree

6 files changed

+23
-37
lines changed

6 files changed

+23
-37
lines changed

‎impacket/examples/ntlmrelayx/servers/httprelayserver.py

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -360,13 +360,7 @@ def do_local_auth(self, messageType, token, proxy):
360360
elif messageType == 3:
361361
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
362362
authenticateMessage.fromString(token)
363-
364-
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
365-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
366-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
367-
else:
368-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
369-
authenticateMessage['user_name'].decode('ascii'))).upper()
363+
self.authUser = authenticateMessage.getUserString()
370364

371365
self.target = self.server.config.target.getTarget(identity = self.authUser)
372366
if self.target is None:
@@ -441,13 +435,7 @@ def do_relay(self, messageType, token, proxy, content = None):
441435
authenticateMessage.fromString(token)
442436

443437
if self.server.config.disableMulti:
444-
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
445-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
446-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
447-
else:
448-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
449-
authenticateMessage['user_name'].decode('ascii'))).upper()
450-
438+
self.authUser = authenticateMessage.getUserString()
451439
target = '%s://%s@%s' % (self.target.scheme, self.authUser.replace("/", '\\'), self.target.netloc)
452440

453441
if not self.do_ntlm_auth(token, authenticateMessage):

‎impacket/examples/ntlmrelayx/servers/rawrelayserver.py

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -165,14 +165,8 @@ def do_ntlm_negotiate(self, token):
165165
return True
166166

167167
def do_ntlm_auth(self, token, authenticateMessage):
168-
169168
# For some attacks it is important to know the authenticated username, so we store it
170-
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
171-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
172-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
173-
else:
174-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
175-
authenticateMessage['user_name'].decode('ascii'))).upper()
169+
self.authUser = authenticateMessage.getUserString()
176170

177171
if authenticateMessage['user_name'] != '' or self.target.hostname == '127.0.0.1':
178172
clientResponse, errorCode = self.client.sendAuth(token)

‎impacket/examples/ntlmrelayx/servers/smbrelayserver.py

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -340,8 +340,7 @@ def SmbSessionSetup(self, connId, smbServer, recvPacket):
340340
client = connData['SMBClient']
341341
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
342342
authenticateMessage.fromString(token)
343-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
344-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
343+
self.authUser = authenticateMessage.getUserString()
345344

346345
if rawNTLM is True:
347346
respToken2 = SPNEGO_NegTokenResp()
@@ -409,11 +408,8 @@ def SmbSessionSetup(self, connId, smbServer, recvPacket):
409408

410409
def smb2TreeConnect(self, connId, smbServer, recvPacket):
411410
connData = smbServer.getConnectionData(connId)
412-
413411
authenticateMessage = connData['AUTHENTICATE_MESSAGE']
414-
415-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode ('utf-16le'),
416-
authenticateMessage['user_name'].decode ('utf-16le'))).upper ()
412+
self.authUser = authenticateMessage.getUserString()
417413

418414
if self.config.disableMulti:
419415
return self.origsmb2TreeConnect(connId, smbServer, recvPacket)
@@ -631,8 +627,7 @@ def SmbSessionSetupAndX(self, connId, smbServer, SMBCommand, recvPacket):
631627
client = connData['SMBClient']
632628
authenticateMessage = ntlm.NTLMAuthChallengeResponse()
633629
authenticateMessage.fromString(token)
634-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
635-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
630+
self.authUser = authenticateMessage.getUserString()
636631

637632
clientResponse, errorCode = self.do_ntlm_auth(client,sessionSetupData['SecurityBlob'],
638633
connData['CHALLENGE_MESSAGE']['challenge'])
@@ -773,8 +768,7 @@ def smbComTreeConnectAndX(self, connId, smbServer, SMBCommand, recvPacket):
773768
connData = smbServer.getConnectionData(connId)
774769

775770
authenticateMessage = connData['AUTHENTICATE_MESSAGE']
776-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode ('utf-16le'),
777-
authenticateMessage['user_name'].decode ('utf-16le'))).upper ()
771+
self.authUser = authenticateMessage.getUserString()
778772

779773
if self.config.disableMulti:
780774
return self.smbComTreeConnectAndX(connId, smbServer, SMBCommand, recvPacket)

‎impacket/examples/ntlmrelayx/servers/wcfrelayserver.py

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -306,12 +306,7 @@ def do_ntlm_negotiate(self, token):
306306

307307
def do_ntlm_auth(self, token, authenticateMessage):
308308
# For some attacks it is important to know the authenticated username, so we store it
309-
if authenticateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:
310-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('utf-16le'),
311-
authenticateMessage['user_name'].decode('utf-16le'))).upper()
312-
else:
313-
self.authUser = ('%s/%s' % (authenticateMessage['domain_name'].decode('ascii'),
314-
authenticateMessage['user_name'].decode('ascii'))).upper()
309+
self.authUser = authenticateMessage.getUserString()
315310

316311
if authenticateMessage['user_name'] != '' or self.target.hostname == '127.0.0.1':
317312
clientResponse, errorCode = self.client.sendAuth(token)

‎impacket/ntlm.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,20 @@ def fromString(self,data):
503503
lanman_end = self['lanman_len'] + lanman_offset
504504
self['lanman'] = data[ lanman_offset : lanman_end]
505505

506+
def getUserString(self):
507+
if self['flags'] & NTLMSSP_NEGOTIATE_UNICODE:
508+
user = self['user_name'].decode('utf-16le')
509+
domain = self['domain_name'].decode('utf-16le')
510+
else:
511+
user = self['user_name'].decode('cp437')
512+
domain = self['domain_name'].decode('cp437')
513+
514+
# user is in UPN format
515+
if not domain and '@' in user:
516+
user, _, domain = user.rpartition("@")
517+
518+
return ('%s/%s' % (domain, user)).upper()
519+
506520
class ImpacketStructure(Structure):
507521
def set_parent(self, other):
508522
self.parent = other

‎impacket/smb3.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@
163163
22621:"Windows 11",
164164
22631:"Windows 11",
165165
25398:"Windows Server 2022",
166+
26100:"Windows 11 / Server 2025",
166167
}
167168

168169

0 commit comments

Comments
 (0)