| 114 | |
| 115 | } |
| 116 | void ParseUsernameFromType3(char* ntlmType3, int ntlmType3Len) { |
| 117 | short* domainLen, * userLen, * hostnameLen; |
| 118 | __int32* domainOffset, * userOffset, * hostnameOffset; |
| 119 | wchar_t domain[32], user[32], hostname[32]; |
| 120 | domainLen = (short*)(ntlmType3 + 28); |
| 121 | userLen = (short*)(ntlmType3 + 36); |
| 122 | hostnameLen = (short*)(ntlmType3 + 44); |
| 123 | domainOffset = (__int32*)(ntlmType3 + 32); |
| 124 | userOffset = (__int32*)(ntlmType3 + 40); |
| 125 | hostnameOffset = (__int32*)(ntlmType3 + 48); |
| 126 | memset(domain, 0, 32); |
| 127 | memcpy(domain, ntlmType3 + (*domainOffset), *domainLen); |
| 128 | memset(user, 0, 32); |
| 129 | memcpy(user, ntlmType3 + (*userOffset), *userLen); |
| 130 | memset(hostname, 0, 32); |
| 131 | memcpy(hostname, ntlmType3 + (*hostnameOffset), *hostnameLen); |
| 132 | printf("[+] Got NTLM type 3 AUTH message from %S\\%S with hostname %S \n", domain, user, hostname); |
| 133 | |
| 134 | } |
| 135 | |
| 136 | |
| 137 | PotatoAPI::PotatoAPI() { |
no outgoing calls
no test coverage detected