Skip to content

Add Seal/Sign Support for NTLM - #192

Open
JoeyShapiro wants to merge 4 commits into
masterzen:masterfrom
JoeyShapiro:master
Open

JoeyShapiro wants to merge 4 commits into
masterzen:masterfrom
JoeyShapiro:master

Conversation

@JoeyShapiro

Copy link
Copy Markdown

I added encryption support for NTLM so requests can be made to servers with sign/seal enabled.
I made the changes required to Azure/go-ntlmssp and am now putting them here.
This works on a windows 2016 vm with the default quick config, which requires encryption.

I removed encryption.go and the bodgit/ntlmssp library, as they seem unused and never wired up. Let me know if you need me to add them back for backwards compatibility. But I figured it made more sense to use the one from Azure that is already in and used in other places.

I really want this change so I can use this library to interact with all kinds of winrm servers. So let me know if there are any changes that need to be made for a merge. I am more than happy to make changes.

@masterzen

Copy link
Copy Markdown
Owner

Hi!

Thanks for your contributions. Unfortunately, it removes encryption.go on which #188 and #191 are based. I think there may be a path for having all three, but I need a few confirmation before:

  1. is the work in this PR genuinely a new implementation of MS-NLMP, or have you reused part of bodgit/ntlmssp ?
  2. It seems that sequence-number validation is weaker than what was in bodgit/ntlmssp: the bodgit version provides anti-replay by tracking incomingSeqNum and asserts the peer's signature encodes that same expected value. Yours only pulls the sequence number straight out of the received signature and just checks the checksum computed from it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants