mirror of
https://github.com/vanhauser-thc/thc-hydra.git
synced 2025-07-06 04:51:40 -07:00
Merge pull request #414 from rmaksimov/ntlm-auth-fix
fix NTLM authentication
This commit is contained in:
van Hauser
GitHub
commit
451e3d3edd
2 changed files with 73 additions and 71 deletions
29
hydra-http.c
29
hydra-http.c
|
|
@ -96,14 +96,14 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
|
|||
//send the first..
|
||||
if (use_proxy == 1 && proxy_authentication[selected_proxy] != NULL)
|
||||
sprintf(buffer,
|
||||
"%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nProxy-Authorization: Basic %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n",
|
||||
"%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nProxy-Authorization: Basic %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n",
|
||||
type, webtarget, webport, miscptr, webtarget, buf1, proxy_authentication[selected_proxy], header);
|
||||
else {
|
||||
if (use_proxy == 1)
|
||||
sprintf(buffer, "%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n",
|
||||
sprintf(buffer, "%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n",
|
||||
type, webtarget, webport, miscptr, webtarget, buf1, header);
|
||||
else
|
||||
sprintf(buffer, "%s %s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n", type, miscptr, webtarget,
|
||||
sprintf(buffer, "%s %s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n", type, miscptr, webtarget,
|
||||
buf1, header);
|
||||
}
|
||||
|
||||
|
|
@ -116,18 +116,17 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
|
|||
//receive challenge
|
||||
if (http_buf != NULL)
|
||||
free(http_buf);
|
||||
http_buf = hydra_receive_line(s);
|
||||
while (http_buf != NULL && (pos = hydra_strcasestr(http_buf, "WWW-Authenticate: NTLM ")) == NULL) {
|
||||
free(http_buf);
|
||||
http_buf = hydra_receive_line(s);
|
||||
}
|
||||
|
||||
http_buf = hydra_receive_line(s);
|
||||
if (http_buf == NULL) {
|
||||
if (verbose)
|
||||
hydra_report(stderr, "[ERROR] Server did not answer\n");
|
||||
free(buffer);
|
||||
free(header);
|
||||
return 1;
|
||||
return 3;
|
||||
}
|
||||
|
||||
pos = hydra_strcasestr(http_buf, "WWW-Authenticate: NTLM ");
|
||||
if (pos != NULL) {
|
||||
char *str;
|
||||
|
||||
|
|
@ -138,7 +137,11 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
|
|||
if ((str = strchr(pos, '\n')) != NULL) {
|
||||
pos[str - pos] = 0;
|
||||
}
|
||||
} else {
|
||||
hydra_report(stderr, "[ERROR] It is not NTLM authentication type\n");
|
||||
return 3;
|
||||
}
|
||||
|
||||
//recover challenge
|
||||
from64tobits((char *) buf1, pos);
|
||||
free(http_buf);
|
||||
|
|
@ -151,14 +154,14 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
|
|||
//create the auth response
|
||||
if (use_proxy == 1 && proxy_authentication[selected_proxy] != NULL)
|
||||
sprintf(buffer,
|
||||
"%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nProxy-Authorization: Basic %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n",
|
||||
"%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nProxy-Authorization: Basic %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n",
|
||||
type, webtarget, webport, miscptr, webtarget, buf1, proxy_authentication[selected_proxy], header);
|
||||
else {
|
||||
if (use_proxy == 1)
|
||||
sprintf(buffer, "%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n",
|
||||
sprintf(buffer, "%s http://%s:%d%s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n",
|
||||
type, webtarget, webport, miscptr, webtarget, buf1, header);
|
||||
else
|
||||
sprintf(buffer, "%s %s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\nConnection: keep-alive\r\n%s\r\n", type, miscptr, webtarget,
|
||||
sprintf(buffer, "%s %s HTTP/1.1\r\nHost: %s\r\nAuthorization: NTLM %s\r\nUser-Agent: Mozilla/4.0 (Hydra)\r\n%s\r\n", type, miscptr, webtarget,
|
||||
buf1, header);
|
||||
}
|
||||
|
||||
|
|
@ -231,7 +234,7 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
|
|||
|
||||
//the first authentication type failed, check the type from server header
|
||||
if ((hydra_strcasestr(http_buf, "WWW-Authenticate: Basic") == NULL) && (http_auth_mechanism == AUTH_BASIC)) {
|
||||
//seems the auth supported is not Basic shceme so testing further
|
||||
//seems the auth supported is not Basic scheme so testing further
|
||||
int32_t find_auth = 0;
|
||||
|
||||
if (hydra_strcasestr(http_buf, "WWW-Authenticate: NTLM") != NULL) {
|
||||
|
|
|
|||
73
hydra-mod.c
73
hydra-mod.c
|
|
@ -935,74 +935,73 @@ int32_t hydra_recv_nb(int32_t socket, char *buf, uint32_t length) {
|
|||
}
|
||||
|
||||
char *hydra_receive_line(int32_t socket) {
|
||||
char buf[1024], *buff, *buff2, text[64];
|
||||
int32_t i, j = 1, k, got = 0;
|
||||
char buf[1024], *buff, *buff2, pid[64];
|
||||
int32_t i, j, k, got = 0;
|
||||
|
||||
if ((buff = malloc(sizeof(buf))) == NULL) {
|
||||
fprintf(stderr, "[ERROR] could not malloc\n");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
memset(buff, 0, sizeof(buf));
|
||||
|
||||
if (debug)
|
||||
printf("[DEBUG] hydra_receive_line: waittime: %d, conwait: %d, socket: %d, pid: %d\n", waittime, conwait, socket, getpid());
|
||||
|
||||
if ((i = hydra_data_ready_timed(socket, (long) waittime, 0)) > 0) {
|
||||
if ((got = internal__hydra_recv(socket, buff, sizeof(buf) - 1)) < 0) {
|
||||
free(buff);
|
||||
return NULL;
|
||||
}
|
||||
} else {
|
||||
if (debug)
|
||||
printf("[DEBUG] hydra_data_ready_timed: %d, waittime: %d, conwait: %d, socket: %d\n", i, waittime, conwait, socket);
|
||||
}
|
||||
|
||||
if (got < 0) {
|
||||
if (debug) {
|
||||
sprintf(text, "[DEBUG] RECV [pid:%d]", getpid());
|
||||
hydra_dump_data((unsigned char*)"", -1, text);
|
||||
//hydra_report_debug(stderr, "DEBUG_RECV_BEGIN||END [pid:%d %d]", getpid(), i);
|
||||
perror("recv");
|
||||
}
|
||||
free(buff);
|
||||
return NULL;
|
||||
} else {
|
||||
if (got > 0) {
|
||||
for (k = 0; k < got; k++)
|
||||
if (buff[k] == 0)
|
||||
buff[k] = 32;
|
||||
buff[got] = 0;
|
||||
usleepn(100);
|
||||
}
|
||||
}
|
||||
|
||||
while (hydra_data_ready(socket) > 0 && j > 0) {
|
||||
do {
|
||||
j = internal__hydra_recv(socket, buf, sizeof(buf) - 1);
|
||||
if (j > 0) {
|
||||
for (k = 0; k < j; k++)
|
||||
if (buf[k] == 0)
|
||||
buf[k] = 32;
|
||||
|
||||
buf[j] = 0;
|
||||
|
||||
if ((buff2 = realloc(buff, got + j + 1)) == NULL) {
|
||||
free(buff);
|
||||
return NULL;
|
||||
} else
|
||||
}
|
||||
|
||||
buff = buff2;
|
||||
memcpy(buff + got, &buf, j + 1);
|
||||
got += j;
|
||||
buff[got] = 0;
|
||||
} else if (j < 0) {
|
||||
// some error occured
|
||||
got = -1;
|
||||
}
|
||||
usleepn(100);
|
||||
}
|
||||
} while (hydra_data_ready(socket) > 0 && j > 0
|
||||
#ifdef LIBOPENSSL
|
||||
|| use_ssl && SSL_pending(ssl)
|
||||
#endif
|
||||
);
|
||||
|
||||
if (got > 0) {
|
||||
if (debug) {
|
||||
sprintf(text, "[DEBUG] RECV [pid:%d]", getpid());
|
||||
hydra_dump_data(buff, got, text);
|
||||
sprintf(pid, "[DEBUG] RECV [pid:%d]", getpid());
|
||||
hydra_dump_data(buff, got, pid);
|
||||
//hydra_report_debug(stderr, "DEBUG_RECV_BEGIN [pid:%d len:%d]|%s|END", getpid(), got, buff);
|
||||
}
|
||||
if (got == 0) {
|
||||
} else {
|
||||
if (got < 0) {
|
||||
if (debug) {
|
||||
sprintf(pid, "[DEBUG] RECV [pid:%d]", getpid());
|
||||
hydra_dump_data((unsigned char*)"", -1, pid);
|
||||
//hydra_report_debug(stderr, "DEBUG_RECV_BEGIN||END [pid:%d %d]", getpid(), i);
|
||||
perror("recv");
|
||||
}
|
||||
}
|
||||
free(buff);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
usleepn(100);
|
||||
} else {
|
||||
if (debug)
|
||||
printf("[DEBUG] hydra_data_ready_timed: %d, waittime: %d, conwait: %d, socket: %d\n", i, waittime, conwait, socket);
|
||||
}
|
||||
|
||||
return buff;
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue