[Patch] Support for LDAP with GSSAPI/NTLMSSP auth scheme decoding in wireshark

[Stefan (metze) Metzmacher]

Stefan (metze) Metzmacher schrieb:
> Hi Matthieu,
> 
>>>> I finally finished my patch to support NTLMSSP auth in LDAP.
>>>> As metze proposed I add the option that read all the keytab that were
>>>> provided, and try all the encoded password inside it.
>>>>
>>>> It seems to work quite well, I tried with a few keytab generated for
>>>> pure "traditional" LDAP with kerberos auth and I've been able to decode
>>>> (well if the keytab contains the md4(password) of the user trying to
>>>> authenticate himself).
>>>> I'm quite surprised that when "extracting" crypted password in a keytab
>>>> they are only stored by using md4(unicode(password))) even if we ask
>>>> keytab to use arc4_hmac (but I'm far from being well aware of all in
>>>> kerberos ...).
>>>>
>>>> Concerning protocols, I tested NTLM v1 and NTLM v2, for NTLM v1 I tested
>>>> mostly with extended security flags so for less secure (and maybe not
>>>> anymore really used ?) scheme (like pure lan manager auth or simple nt
>>>> auth) problems might still exist.
>>>>
>>>> It would be just great if you can provide me some feedback, in anycase
>>>> my goal is to submit it to wireshark devs soon.
>>> Thanks! I'll give it a try in the next days.

For LDAP it works fine, it's only DCERPC that doesn't work completely.

metze

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.samba.org/archive/samba-technical/attachments/20090502/4389ab23/signature-0001.bin