Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix NTLM NegotiateFlags field offsets

Browse source 
Wrong offsets were used for the NegotiateFlags field of the
NEGOTIATE_MESSAGE, CHALLENGE_MESSAGE and AUTHENTICATE_MESSAGE. See
[MS-NLMP].pdf section 2.2.2.5 for a definition of that field.
This commit is contained in:
Jeffrey Bencteux 2018-07-25 13:27:11 +02:00
parent 4a97421ef3
commit 1bee7277e0
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/analyzer/protocol/ntlm/ntlm-protocol.pac
View file

@ -171,7 +171,7 @@ type NTLM_Negotiate_Flags = record {
request_non_nt_session_key : bool = (flags & 0x00400000) > 0; request_non_nt_session_key : bool = (flags & 0x00400000) > 0;
negotiate_identify : bool = (flags & 0x00100000) > 0; negotiate_identify : bool = (flags & 0x00100000) > 0;
negotiate_extended_sessionsecurity : bool = (flags & 0x00040000) > 0; negotiate_extended_sessionsecurity : bool = (flags & 0x00080000) > 0;
target_type_server : bool = (flags & 0x00020000) > 0; target_type_server : bool = (flags & 0x00020000) > 0;
target_type_domain : bool = (flags & 0x00010000) > 0; target_type_domain : bool = (flags & 0x00010000) > 0;
@ -179,14 +179,14 @@ type NTLM_Negotiate_Flags = record {
negotiate_oem_workstation_supplied : bool = (flags & 0x00002000) > 0; negotiate_oem_workstation_supplied : bool = (flags & 0x00002000) > 0;
negotiate_oem_domain_supplied : bool = (flags & 0x00001000) > 0; negotiate_oem_domain_supplied : bool = (flags & 0x00001000) > 0;
negotiate_anonymous_connection : bool = (flags & 0x00000400) > 0; negotiate_anonymous_connection : bool = (flags & 0x00000800) > 0;
negotiate_ntlm : bool = (flags & 0x00000100) > 0; negotiate_ntlm : bool = (flags & 0x00000200) > 0;
negotiate_lm_key : bool = (flags & 0x00000080) > 0; negotiate_lm_key : bool = (flags & 0x00000080) > 0;
negotiate_datagram : bool = (flags & 0x00000040) > 0; negotiate_datagram : bool = (flags & 0x00000040) > 0;
negotiate_seal : bool = (flags & 0x00000020) > 0; negotiate_seal : bool = (flags & 0x00000020) > 0;
negotiate_sign : bool = (flags & 0x00000010) > 0;
negotiate_sign : bool = (flags & 0x00000008) > 0;
request_target : bool = (flags & 0x00000004) > 0; request_target : bool = (flags & 0x00000004) > 0;
negotiate_oem : bool = (flags & 0x00000002) > 0; negotiate_oem : bool = (flags & 0x00000002) > 0;
negotiate_unicode : bool = (flags & 0x00000001) > 0; negotiate_unicode : bool = (flags & 0x00000001) > 0;