Funny security blob in sesssetup&X.

[Richard Sharpe]

Hi,

Here is the content of the security blob in a sessionsetup&X from a Win2K 
box.

It looks wrong because it seems to be a negTokenInit, not the 
negTokenTarg I would expect.

Can anyone comment?

[rsharpe at tulomne ethereal] dumpasn1 -txh -157 ~/sesssetup.cap 
    <60 50>
0000 60   50: [APPLICATION 0] {
    <06 06>
0002 06    6:   OBJECT IDENTIFIER SPNEGO (1 3 6 1 5 5 2)
    <A0 46>
000A A0   46:   [0] {
                 ^ 
                 +---------value for negTokenInit?
    <30 44>
000C 30   44:     SEQUENCE {
    <A0 0E>
000E A0    E:       [0] {
    <30 0C>
0010 30    C:         SEQUENCE {
    <06 0A>
0012 06    A:           OBJECT IDENTIFIER
            :             Microsoft NTLMSSP (1 3 6 1 4 1 311 2 2 10
            :           }
            :         }
    <A2 32>
001E A2   32:       [2] {
    <04 30>
0020 04   30:         OCTET STRING    
            :           4E 54 4C 4D 53 53 50 00    NTLMSSP.
            :           01 00 00 00 97 B2 00 C0    ........
            :           08 00 08 00 28 00 00 00    ....(...
            :           08 00 08 00 20 00 00 00    .... ...
            :           57 49 4E 32 4B 54 53 54    WIN2KTST
            :           53 41 4D 42 41 4E 45 54                            
            :         }
            :       }
            :     }
            :   }

0 warnings, 0 errors.


Regards
-----
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org, 
sharpe at ethereal.com