Method _getSessionBaseKey

scapy/layers/ntlm.py:2187–2290

Return the Session Key by asking the DC.

(self, Context, ntlm)

        self.ssp = ssp

    def _getSessionBaseKey(self, Context, ntlm):
        """
        Return the Session Key by asking the DC.
        """
        # No user / no domain: skip.
        if not ntlm.UserNameLen or not ntlm.DomainNameLen:
            return super(NTLMSSP_DOMAIN, self)._getSessionBaseKey(Context, ntlm)

        # Import RPC stuff
        from scapy.layers.dcerpc import NDRUnion
        from scapy.layers.msrpce.msnrpc import (
            NETLOGON_SECURE_CHANNEL_METHOD,
            NetlogonClient,
        )
        from scapy.layers.msrpce.raw.ms_nrpc import (
            NETLOGON_LOGON_IDENTITY_INFO,
            NetrLogonSamLogonWithFlags_Request,
            PNETLOGON_AUTHENTICATOR,
            PNETLOGON_NETWORK_INFO,
            STRING,
            UNICODE_STRING,
        )

        # Create NetlogonClient with PRIVACY
        client = NetlogonClient()
        client.connect(self.DC_FQDN)

        # Establish the Netlogon secure channel (this will bind)
        try:
            if self.ssp is None and self.KEY is None:
                # Login via classic NetlogonSSP
                client.establish_secure_channel(
                    mode=NETLOGON_SECURE_CHANNEL_METHOD.NetrServerAuthenticate3,
                    UPN=f"{self.COMPUTER_NB_NAME}@{self.DOMAIN_NB_NAME}",
                    DC_FQDN=self.DC_FQDN,
                    HASHNT=self.HASHNT,
                )
            else:
                # Login via KerberosSSP (Windows 2025)
                client.establish_secure_channel(
                    mode=NETLOGON_SECURE_CHANNEL_METHOD.NetrServerAuthenticateKerberos,
                    UPN=self.UPN,
                    DC_FQDN=self.DC_FQDN,
                    PASSWORD=self.PASSWORD,
                    KEY=self.KEY,
                    ssp=self.ssp,
                )
        except ValueError:
            log_runtime.warning(
                "Couldn't establish the Netlogon secure channel. "
                "Check the credentials for '%s' !" % self.COMPUTER_NB_NAME
            )
            return super(NTLMSSP_DOMAIN, self)._getSessionBaseKey(Context, ntlm)

        # Request validation of the NTLM request
        req = NetrLogonSamLogonWithFlags_Request(
            LogonServer="",
            ComputerName=self.COMPUTER_NB_NAME,