最近忙,事比较多,活多了,还要降薪,唉。没什么时间看书,将以前的一些技术blog也移到这里。NTLM在去年年底和今年年初研究过一阵子,写了总结和例子程序。里面涉及很多算法,在网上查了很久。下面是以前的博客:
如果我们进行抓包,在步骤二、步骤三、步骤四中,传递相关信息,在WWW-Authenticate中,使用了Base64算法进行扰码。
按照RFC2045的定义,Base64被定义为:Base64内容传送编码被设计用来把任意序列的8位字节描述为一种不易被人直接识别的形式。(The Base64 Content-Transfer-Encoding is designed to represent arbitrary sequences of octets in a form that need not be humanly readable.)
BASE64的原理可以在RFC中查阅,或者青参考网络共产主义:http://www.5dmail.net/html/2004-1-30/200413084348.htm 。我们在下面给出相关的程序代码。
// ********************************* Base64 算法 begin *****************************
// Translation Table as described in RFC1113
static const char cb64[]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
static unsigned char db64[256] = {
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 62, 255, 255, 255, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
255, 255, 255, 0, 255, 255, 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255,
255, 255, 255, 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37,
38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
255, 255, 255, 255, 255};
// encodeblock
// encode 3 8-bit binary bytes as 4 '6-bit' characters
static void encodeblock( unsigned char in[3], unsigned char out[4], int len )
{
out[0] = cb64[ in[0] >> 2 ];
out[1] = cb64[ ((in[0] & 0x03) << 4) | ((in[1] & 0xf0) >> 4) ];
out[2] = (unsigned char) (len > 1 ? cb64[ ((in[1] & 0x0f) << 2) | ((in[2] & 0xc0) >> 6) ] : '=');
out[3] = (unsigned char) (len > 2 ? cb64[ in[2] & 0x3f ] : '=');
}
void encode_base64(OUT char *dst, IN const char *src, IN int sz )
{
unsigned char in[3], *out = (unsigned char *) dst;
int i, len;
while (sz > 0){
len = 0;
for (i = 0; i < 3; i++, sz--){
if (sz > 0){
len++;
in[i] = src[i];
} else {
in[i] = 0;
}
}
src += 3;
if (len){
encodeblock(in, out, len);
out += 4;
}
}
*out = '/0';
}
void decode_base64(IN char *src, IN int src_len, OUT char *dst,OUT int * dst_len)
{
int j = 0, i = 0;
for ( i = 0; i < src_len; i += 4) {
dst[j++] = db64[src[i]] << 2 | db64[src[i + 1]] >> 4;
dst[j++] = db64[src[i + 1]] << 4 | db64[src[i + 2]] >> 2;
dst[j++] = db64[src[i + 2]] << 6 | db64[src[i + 3]];
}
dst[j] = '/0';
* dst_len = j-1;
}
// end of part1: Base64 算法 end
NTLM的实现:
-
- 实现PROXY穿越(16):NTLM的PROXY穿越
- 实现PROXY穿越(15):NTLM Session Security
- 实现PROXY穿越(14):NTLM type3 Message
- 实现PROXY穿越(13):NTLM type2 Message
- 实现PROXY穿越(12):NTLM type1 Message
- 实现PROXY穿越(11):NTLMv2 session response
- 实现PROXY穿越(10):NTLMv2 response
- 实现PROXY穿越(9):NTLMv1 response
- 实现PROXY穿越(8):NT-Hash的实现
- 实现PROXY穿越(7):MD4和MD5
- 实现PROXY穿越(6):LM-Hash的实现
- 实现PROXY穿越(5):DES算法之三
- 实现PROXY穿越(4):DES算法之二
- 实现PROXY穿越(3):DES算法之一
- 实现PROXY穿越(2):Base64算法
- 实现PROXY穿越(1):流程和NTLM算法