|
| 1 | +#include <unistd.h> |
| 2 | +#include <string.h> |
| 3 | + |
| 4 | +//Init values |
| 5 | +#define INIT_A 0x67452301 |
| 6 | +#define INIT_B 0xefcdab89 |
| 7 | +#define INIT_C 0x98badcfe |
| 8 | +#define INIT_D 0x10325476 |
| 9 | + |
| 10 | +#define SQRT_2 0x5a827999 |
| 11 | +#define SQRT_3 0x6ed9eba1 |
| 12 | + |
| 13 | +unsigned int nt_buffer[16]; |
| 14 | +unsigned int output[4]; |
| 15 | +char hex_format[33]; |
| 16 | +char itoa16[16] = "0123456789ABCDEF"; |
| 17 | + |
| 18 | +//This is the MD4 compress function |
| 19 | +static void ntlm_crypt() |
| 20 | +{ |
| 21 | + unsigned int a = INIT_A; |
| 22 | + unsigned int b = INIT_B; |
| 23 | + unsigned int c = INIT_C; |
| 24 | + unsigned int d = INIT_D; |
| 25 | + |
| 26 | + /* Round 1 */ |
| 27 | + a += (d ^ (b & (c ^ d))) + nt_buffer[0] ;a = (a << 3 ) | (a >> 29); |
| 28 | + d += (c ^ (a & (b ^ c))) + nt_buffer[1] ;d = (d << 7 ) | (d >> 25); |
| 29 | + c += (b ^ (d & (a ^ b))) + nt_buffer[2] ;c = (c << 11) | (c >> 21); |
| 30 | + b += (a ^ (c & (d ^ a))) + nt_buffer[3] ;b = (b << 19) | (b >> 13); |
| 31 | + |
| 32 | + a += (d ^ (b & (c ^ d))) + nt_buffer[4] ;a = (a << 3 ) | (a >> 29); |
| 33 | + d += (c ^ (a & (b ^ c))) + nt_buffer[5] ;d = (d << 7 ) | (d >> 25); |
| 34 | + c += (b ^ (d & (a ^ b))) + nt_buffer[6] ;c = (c << 11) | (c >> 21); |
| 35 | + b += (a ^ (c & (d ^ a))) + nt_buffer[7] ;b = (b << 19) | (b >> 13); |
| 36 | + |
| 37 | + a += (d ^ (b & (c ^ d))) + nt_buffer[8] ;a = (a << 3 ) | (a >> 29); |
| 38 | + d += (c ^ (a & (b ^ c))) + nt_buffer[9] ;d = (d << 7 ) | (d >> 25); |
| 39 | + c += (b ^ (d & (a ^ b))) + nt_buffer[10] ;c = (c << 11) | (c >> 21); |
| 40 | + b += (a ^ (c & (d ^ a))) + nt_buffer[11] ;b = (b << 19) | (b >> 13); |
| 41 | + |
| 42 | + a += (d ^ (b & (c ^ d))) + nt_buffer[12] ;a = (a << 3 ) | (a >> 29); |
| 43 | + d += (c ^ (a & (b ^ c))) + nt_buffer[13] ;d = (d << 7 ) | (d >> 25); |
| 44 | + c += (b ^ (d & (a ^ b))) + nt_buffer[14] ;c = (c << 11) | (c >> 21); |
| 45 | + b += (a ^ (c & (d ^ a))) + nt_buffer[15] ;b = (b << 19) | (b >> 13); |
| 46 | + |
| 47 | + /* Round 2 */ |
| 48 | + a += ((b & (c | d)) | (c & d)) + nt_buffer[0] +SQRT_2; a = (a<<3 ) | (a>>29); |
| 49 | + d += ((a & (b | c)) | (b & c)) + nt_buffer[4] +SQRT_2; d = (d<<5 ) | (d>>27); |
| 50 | + c += ((d & (a | b)) | (a & b)) + nt_buffer[8] +SQRT_2; c = (c<<9 ) | (c>>23); |
| 51 | + b += ((c & (d | a)) | (d & a)) + nt_buffer[12]+SQRT_2; b = (b<<13) | (b>>19); |
| 52 | + |
| 53 | + a += ((b & (c | d)) | (c & d)) + nt_buffer[1] +SQRT_2; a = (a<<3 ) | (a>>29); |
| 54 | + d += ((a & (b | c)) | (b & c)) + nt_buffer[5] +SQRT_2; d = (d<<5 ) | (d>>27); |
| 55 | + c += ((d & (a | b)) | (a & b)) + nt_buffer[9] +SQRT_2; c = (c<<9 ) | (c>>23); |
| 56 | + b += ((c & (d | a)) | (d & a)) + nt_buffer[13]+SQRT_2; b = (b<<13) | (b>>19); |
| 57 | + |
| 58 | + a += ((b & (c | d)) | (c & d)) + nt_buffer[2] +SQRT_2; a = (a<<3 ) | (a>>29); |
| 59 | + d += ((a & (b | c)) | (b & c)) + nt_buffer[6] +SQRT_2; d = (d<<5 ) | (d>>27); |
| 60 | + c += ((d & (a | b)) | (a & b)) + nt_buffer[10]+SQRT_2; c = (c<<9 ) | (c>>23); |
| 61 | + b += ((c & (d | a)) | (d & a)) + nt_buffer[14]+SQRT_2; b = (b<<13) | (b>>19); |
| 62 | + |
| 63 | + a += ((b & (c | d)) | (c & d)) + nt_buffer[3] +SQRT_2; a = (a<<3 ) | (a>>29); |
| 64 | + d += ((a & (b | c)) | (b & c)) + nt_buffer[7] +SQRT_2; d = (d<<5 ) | (d>>27); |
| 65 | + c += ((d & (a | b)) | (a & b)) + nt_buffer[11]+SQRT_2; c = (c<<9 ) | (c>>23); |
| 66 | + b += ((c & (d | a)) | (d & a)) + nt_buffer[15]+SQRT_2; b = (b<<13) | (b>>19); |
| 67 | + |
| 68 | + /* Round 3 */ |
| 69 | + a += (d ^ c ^ b) + nt_buffer[0] + SQRT_3; a = (a << 3 ) | (a >> 29); |
| 70 | + d += (c ^ b ^ a) + nt_buffer[8] + SQRT_3; d = (d << 9 ) | (d >> 23); |
| 71 | + c += (b ^ a ^ d) + nt_buffer[4] + SQRT_3; c = (c << 11) | (c >> 21); |
| 72 | + b += (a ^ d ^ c) + nt_buffer[12] + SQRT_3; b = (b << 15) | (b >> 17); |
| 73 | + |
| 74 | + a += (d ^ c ^ b) + nt_buffer[2] + SQRT_3; a = (a << 3 ) | (a >> 29); |
| 75 | + d += (c ^ b ^ a) + nt_buffer[10] + SQRT_3; d = (d << 9 ) | (d >> 23); |
| 76 | + c += (b ^ a ^ d) + nt_buffer[6] + SQRT_3; c = (c << 11) | (c >> 21); |
| 77 | + b += (a ^ d ^ c) + nt_buffer[14] + SQRT_3; b = (b << 15) | (b >> 17); |
| 78 | + |
| 79 | + a += (d ^ c ^ b) + nt_buffer[1] + SQRT_3; a = (a << 3 ) | (a >> 29); |
| 80 | + d += (c ^ b ^ a) + nt_buffer[9] + SQRT_3; d = (d << 9 ) | (d >> 23); |
| 81 | + c += (b ^ a ^ d) + nt_buffer[5] + SQRT_3; c = (c << 11) | (c >> 21); |
| 82 | + b += (a ^ d ^ c) + nt_buffer[13] + SQRT_3; b = (b << 15) | (b >> 17); |
| 83 | + |
| 84 | + a += (d ^ c ^ b) + nt_buffer[3] + SQRT_3; a = (a << 3 ) | (a >> 29); |
| 85 | + d += (c ^ b ^ a) + nt_buffer[11] + SQRT_3; d = (d << 9 ) | (d >> 23); |
| 86 | + c += (b ^ a ^ d) + nt_buffer[7] + SQRT_3; c = (c << 11) | (c >> 21); |
| 87 | + b += (a ^ d ^ c) + nt_buffer[15] + SQRT_3; b = (b << 15) | (b >> 17); |
| 88 | + |
| 89 | + output[0] = a + INIT_A; |
| 90 | + output[1] = b + INIT_B; |
| 91 | + output[2] = c + INIT_C; |
| 92 | + output[3] = d + INIT_D; |
| 93 | +} |
| 94 | + |
| 95 | +//This include the Unicode conversion and the padding |
| 96 | +static void prepare_key(char *key) |
| 97 | +{ |
| 98 | + int i=0; |
| 99 | + int length=strlen(key); |
| 100 | + memset(nt_buffer,0,16*4); |
| 101 | + //The length of key need to be <= 27 |
| 102 | + for(;i<length/2;i++) |
| 103 | + nt_buffer[i] = key[2*i] | (key[2*i+1]<<16); |
| 104 | + |
| 105 | + //padding |
| 106 | + if(length%2==1) |
| 107 | + nt_buffer[i] = key[length-1] | 0x800000; |
| 108 | + else |
| 109 | + nt_buffer[i]=0x80; |
| 110 | + //put the length |
| 111 | + nt_buffer[14] = length << 4; |
| 112 | +} |
| 113 | + |
| 114 | +//This convert the output to hexadecimal form |
| 115 | +static void convert_hex() |
| 116 | +{ |
| 117 | + int i=0; |
| 118 | + //Iterate the integer |
| 119 | + for(;i<4;i++) |
| 120 | + { |
| 121 | + int j=0; |
| 122 | + unsigned int n=output[i]; |
| 123 | + //iterate the bytes of the integer |
| 124 | + for(;j<4;j++) |
| 125 | + { |
| 126 | + unsigned int convert=n%256; |
| 127 | + hex_format[i*8+j*2+1]=itoa16[convert%16]; |
| 128 | + convert=convert/16; |
| 129 | + hex_format[i*8+j*2+0]=itoa16[convert%16]; |
| 130 | + n=n/256; |
| 131 | + } |
| 132 | + } |
| 133 | + //null terminate the string |
| 134 | + hex_format[33]=0; |
| 135 | +} |
| 136 | + |
| 137 | +int main(int argc, char **argv) |
| 138 | +{ |
| 139 | + prepare_key(argv[1]); |
| 140 | + ntlm_crypt(); |
| 141 | + convert_hex(); |
| 142 | + write(1, hex_format, 32); |
| 143 | + return 0; |
| 144 | +} |
0 commit comments