klezVirus / klezVirus/SharpLdapRelayScan

NTLMChallenge() parsing data incorrectly

Open
#1 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
96
Forks
17
PR merge metrics
No merged PRs in 30d

Description

The constructor in [NtlmChallenge.cs](https://github.com/klezVirus/SharpLdapRelayScan/blob/cca08e880dc927b5f3577d31230de6a6903c1548/SharpLdapRelayScan/NTLMSSP/Messages/NtlmChallenge.cs) ( `NTLMSSP/Messages/NtlmChallenge.cs` ) is parsing the Negotiate Flags and Server Challenge in the wrong order. First it parses the Challenge and then the Flags when it should be the other way around. See the corrected code in the image below.

![image](https://github.com/user-attachments/assets/0776e515-cc9e-4bf6-9ff9-087b083c666d)

I realised as I am using the modified Novell library for another project and the `ToString()` function was showing values for the Flags and Challenge that were offset by 4 bytes. Not sure how it affects this tool, but I imagine if the credentials being passed are valid, this would prevent authentication from completing as the NTLM Challenge is malformed (in the case of relay attacks at least).

Contributor guide

No contributing guide indexed for this repository

Research direction

Open NTLMSSP/Messages/NtlmChallenge.cs and inspect the NtlmChallenge() constructor's parsing order for the Server Challenge and Negotiate Flags. Compare the parsed values with the corrected ordering shown in the issue image and verify that ToString() no longer reports values offset by four bytes.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.