1 |
2
|
Manuela
|
<?php
|
2 |
|
|
/*
|
3 |
|
|
* ntlm_sasl_client.php
|
4 |
|
|
*
|
5 |
|
|
* @(#) $Id$
|
6 |
|
|
*
|
7 |
|
|
*/
|
8 |
|
|
|
9 |
|
|
define("SASL_NTLM_STATE_START", 0);
|
10 |
|
|
define("SASL_NTLM_STATE_IDENTIFY_DOMAIN", 1);
|
11 |
|
|
define("SASL_NTLM_STATE_RESPOND_CHALLENGE", 2);
|
12 |
|
|
define("SASL_NTLM_STATE_DONE", 3);
|
13 |
|
|
define("SASL_FAIL", -1);
|
14 |
|
|
define("SASL_CONTINUE", 1);
|
15 |
|
|
|
16 |
|
|
class ntlm_sasl_client_class
|
17 |
|
|
{
|
18 |
|
|
public $credentials = array();
|
19 |
|
|
public $state = SASL_NTLM_STATE_START;
|
20 |
|
|
|
21 |
|
|
public function initialize(&$client)
|
22 |
|
|
{
|
23 |
|
|
if (!function_exists($function = "mcrypt_encrypt")
|
24 |
|
|
|| !function_exists($function = "mhash")
|
25 |
|
|
) {
|
26 |
|
|
$extensions = array(
|
27 |
|
|
"mcrypt_encrypt" => "mcrypt",
|
28 |
|
|
"mhash" => "mhash"
|
29 |
|
|
);
|
30 |
|
|
$client->error = "the extension " . $extensions[$function] .
|
31 |
|
|
" required by the NTLM SASL client class is not available in this PHP configuration";
|
32 |
|
|
return (0);
|
33 |
|
|
}
|
34 |
|
|
return (1);
|
35 |
|
|
}
|
36 |
|
|
|
37 |
|
|
public function ASCIIToUnicode($ascii)
|
38 |
|
|
{
|
39 |
|
|
for ($unicode = "", $a = 0; $a < strlen($ascii); $a++) {
|
40 |
|
|
$unicode .= substr($ascii, $a, 1) . chr(0);
|
41 |
|
|
}
|
42 |
|
|
return ($unicode);
|
43 |
|
|
}
|
44 |
|
|
|
45 |
|
|
public function typeMsg1($domain, $workstation)
|
46 |
|
|
{
|
47 |
|
|
$domain_length = strlen($domain);
|
48 |
|
|
$workstation_length = strlen($workstation);
|
49 |
|
|
$workstation_offset = 32;
|
50 |
|
|
$domain_offset = $workstation_offset + $workstation_length;
|
51 |
|
|
return (
|
52 |
|
|
"NTLMSSP\0" .
|
53 |
|
|
"\x01\x00\x00\x00" .
|
54 |
|
|
"\x07\x32\x00\x00" .
|
55 |
|
|
pack("v", $domain_length) .
|
56 |
|
|
pack("v", $domain_length) .
|
57 |
|
|
pack("V", $domain_offset) .
|
58 |
|
|
pack("v", $workstation_length) .
|
59 |
|
|
pack("v", $workstation_length) .
|
60 |
|
|
pack("V", $workstation_offset) .
|
61 |
|
|
$workstation .
|
62 |
|
|
$domain
|
63 |
|
|
);
|
64 |
|
|
}
|
65 |
|
|
|
66 |
|
|
public function NTLMResponse($challenge, $password)
|
67 |
|
|
{
|
68 |
|
|
$unicode = $this->ASCIIToUnicode($password);
|
69 |
|
|
$md4 = mhash(MHASH_MD4, $unicode);
|
70 |
|
|
$padded = $md4 . str_repeat(chr(0), 21 - strlen($md4));
|
71 |
|
|
$iv_size = mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_ECB);
|
72 |
|
|
$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
|
73 |
|
|
for ($response = "", $third = 0; $third < 21; $third += 7) {
|
74 |
|
|
for ($packed = "", $p = $third; $p < $third + 7; $p++) {
|
75 |
|
|
$packed .= str_pad(decbin(ord(substr($padded, $p, 1))), 8, "0", STR_PAD_LEFT);
|
76 |
|
|
}
|
77 |
|
|
for ($key = "", $p = 0; $p < strlen($packed); $p += 7) {
|
78 |
|
|
$s = substr($packed, $p, 7);
|
79 |
|
|
$b = $s . ((substr_count($s, "1") % 2) ? "0" : "1");
|
80 |
|
|
$key .= chr(bindec($b));
|
81 |
|
|
}
|
82 |
|
|
$ciphertext = mcrypt_encrypt(MCRYPT_DES, $key, $challenge, MCRYPT_MODE_ECB, $iv);
|
83 |
|
|
$response .= $ciphertext;
|
84 |
|
|
}
|
85 |
|
|
return $response;
|
86 |
|
|
}
|
87 |
|
|
|
88 |
|
|
public function typeMsg3($ntlm_response, $user, $domain, $workstation)
|
89 |
|
|
{
|
90 |
|
|
$domain_unicode = $this->ASCIIToUnicode($domain);
|
91 |
|
|
$domain_length = strlen($domain_unicode);
|
92 |
|
|
$domain_offset = 64;
|
93 |
|
|
$user_unicode = $this->ASCIIToUnicode($user);
|
94 |
|
|
$user_length = strlen($user_unicode);
|
95 |
|
|
$user_offset = $domain_offset + $domain_length;
|
96 |
|
|
$workstation_unicode = $this->ASCIIToUnicode($workstation);
|
97 |
|
|
$workstation_length = strlen($workstation_unicode);
|
98 |
|
|
$workstation_offset = $user_offset + $user_length;
|
99 |
|
|
$lm = "";
|
100 |
|
|
$lm_length = strlen($lm);
|
101 |
|
|
$lm_offset = $workstation_offset + $workstation_length;
|
102 |
|
|
$ntlm = $ntlm_response;
|
103 |
|
|
$ntlm_length = strlen($ntlm);
|
104 |
|
|
$ntlm_offset = $lm_offset + $lm_length;
|
105 |
|
|
$session = "";
|
106 |
|
|
$session_length = strlen($session);
|
107 |
|
|
$session_offset = $ntlm_offset + $ntlm_length;
|
108 |
|
|
return (
|
109 |
|
|
"NTLMSSP\0" .
|
110 |
|
|
"\x03\x00\x00\x00" .
|
111 |
|
|
pack("v", $lm_length) .
|
112 |
|
|
pack("v", $lm_length) .
|
113 |
|
|
pack("V", $lm_offset) .
|
114 |
|
|
pack("v", $ntlm_length) .
|
115 |
|
|
pack("v", $ntlm_length) .
|
116 |
|
|
pack("V", $ntlm_offset) .
|
117 |
|
|
pack("v", $domain_length) .
|
118 |
|
|
pack("v", $domain_length) .
|
119 |
|
|
pack("V", $domain_offset) .
|
120 |
|
|
pack("v", $user_length) .
|
121 |
|
|
pack("v", $user_length) .
|
122 |
|
|
pack("V", $user_offset) .
|
123 |
|
|
pack("v", $workstation_length) .
|
124 |
|
|
pack("v", $workstation_length) .
|
125 |
|
|
pack("V", $workstation_offset) .
|
126 |
|
|
pack("v", $session_length) .
|
127 |
|
|
pack("v", $session_length) .
|
128 |
|
|
pack("V", $session_offset) .
|
129 |
|
|
"\x01\x02\x00\x00" .
|
130 |
|
|
$domain_unicode .
|
131 |
|
|
$user_unicode .
|
132 |
|
|
$workstation_unicode .
|
133 |
|
|
$lm .
|
134 |
|
|
$ntlm
|
135 |
|
|
);
|
136 |
|
|
}
|
137 |
|
|
|
138 |
|
|
public function start(&$client, &$message, &$interactions)
|
139 |
|
|
{
|
140 |
|
|
if ($this->state != SASL_NTLM_STATE_START) {
|
141 |
|
|
$client->error = "NTLM authentication state is not at the start";
|
142 |
|
|
return (SASL_FAIL);
|
143 |
|
|
}
|
144 |
|
|
$this->credentials = array(
|
145 |
|
|
"user" => "",
|
146 |
|
|
"password" => "",
|
147 |
|
|
"realm" => "",
|
148 |
|
|
"workstation" => ""
|
149 |
|
|
);
|
150 |
|
|
$defaults = array();
|
151 |
|
|
$status = $client->GetCredentials($this->credentials, $defaults, $interactions);
|
152 |
|
|
if ($status == SASL_CONTINUE) {
|
153 |
|
|
$this->state = SASL_NTLM_STATE_IDENTIFY_DOMAIN;
|
154 |
|
|
}
|
155 |
|
|
unset($message);
|
156 |
|
|
return ($status);
|
157 |
|
|
}
|
158 |
|
|
|
159 |
|
|
public function step(&$client, $response, &$message, &$interactions)
|
160 |
|
|
{
|
161 |
|
|
switch ($this->state) {
|
162 |
|
|
case SASL_NTLM_STATE_IDENTIFY_DOMAIN:
|
163 |
|
|
$message = $this->typeMsg1($this->credentials["realm"], $this->credentials["workstation"]);
|
164 |
|
|
$this->state = SASL_NTLM_STATE_RESPOND_CHALLENGE;
|
165 |
|
|
break;
|
166 |
|
|
case SASL_NTLM_STATE_RESPOND_CHALLENGE:
|
167 |
|
|
$ntlm_response = $this->NTLMResponse(substr($response, 24, 8), $this->credentials["password"]);
|
168 |
|
|
$message = $this->typeMsg3(
|
169 |
|
|
$ntlm_response,
|
170 |
|
|
$this->credentials["user"],
|
171 |
|
|
$this->credentials["realm"],
|
172 |
|
|
$this->credentials["workstation"]
|
173 |
|
|
);
|
174 |
|
|
$this->state = SASL_NTLM_STATE_DONE;
|
175 |
|
|
break;
|
176 |
|
|
case SASL_NTLM_STATE_DONE:
|
177 |
|
|
$client->error = "NTLM authentication was finished without success";
|
178 |
|
|
return (SASL_FAIL);
|
179 |
|
|
default:
|
180 |
|
|
$client->error = "invalid NTLM authentication step state";
|
181 |
|
|
return (SASL_FAIL);
|
182 |
|
|
}
|
183 |
|
|
return (SASL_CONTINUE);
|
184 |
|
|
}
|
185 |
|
|
}
|