klezVirus / klezVirus/SharpLdapRelayScan
NTLMChallenge() parsing data incorrectly
- Dominant language
- C#
- Stars
- 96
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
The constructor in [NtlmChallenge.cs](https://github.com/klezVirus/SharpLdapRelayScan/blob/cca08e880dc927b5f3577d31230de6a6903c1548/SharpLdapRelayScan/NTLMSSP/Messages/NtlmChallenge.cs) ( `NTLMSSP/Messages/NtlmChallenge.cs` ) is parsing the Negotiate Flags and Server Challenge in the wrong order. First it parses the Challenge and then the Flags when it should be the other way around. See the corrected code in the image below.

I realised as I am using the modified Novell library for another project and the `ToString()` function was showing values for the Flags and Challenge that were offset by 4 bytes. Not sure how it affects this tool, but I imagine if the credentials being passed are valid, this would prevent authentication from completing as the NTLM Challenge is malformed (in the case of relay attacks at least).
Contributor guide
No contributing guide indexed for this repository
Research direction
Open NTLMSSP/Messages/NtlmChallenge.cs and inspect the NtlmChallenge() constructor's parsing order for the Server Challenge and Negotiate Flags. Compare the parsed values with the corrected ordering shown in the issue image and verify that ToString() no longer reports values offset by four bytes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100