Skip to content

Commit 33e9021

Browse files
abartletabartlet
committed
selftest: Test repushing an ntlmssp AUTHENTICATE_MESSAGE
This demonstrates a bug found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X fuzzer where the value() evaluatuion could segfault if it was made to follow a NULL pointer. This also demonstrates that the --base64 mode works on file inputs. Signed-off-by: Andrew Bartlett <[email protected]> Reviewed-by: Douglas Bagnall <[email protected]>
1 parent ac1be89 commit 33e9021

File tree

4 files changed

+148
-0
lines changed

4 files changed

+148
-0
lines changed

‎python/samba/tests/blackbox/ndrdump.py

+12
Original file line numberDiff line numberDiff line change
@@ -198,3 +198,15 @@ def test_ndrdump_fuzzed_IRemoteActivation_RemoteActivation(self):
198198
except BlackboxProcessError as e:
199199
self.fail(e)
200200
self.assertRegex(actual.decode('utf8'), expected + "$")
201+
202+
def test_ndrdump_fuzzed_ntlmsssp_AUTHENTICATE_MESSAGE(self):
203+
expected = open(self.data_path("fuzzed_ntlmssp-AUTHENTICATE_MESSAGE.txt")).read()
204+
try:
205+
actual = self.check_output(
206+
"ndrdump ntlmssp AUTHENTICATE_MESSAGE struct --base64-input %s --validate" %
207+
self.data_path("fuzzed_ntlmssp-AUTHENTICATE_MESSAGE.b64.txt"))
208+
except BlackboxProcessError as e:
209+
self.fail(e)
210+
# check_output will return bytes
211+
# convert expected to bytes for python 3
212+
self.assertEqual(actual, expected.encode('utf-8'))

‎selftest/knownfail.d/ndrdump-NTLMSSP

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_ntlmsssp_AUTHENTICATE_MESSAGE

‎source4/librpc/tests/fuzzed_ntlmssp-AUTHENTICATE_MESSAGE.b64.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AA4AAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAzOQAAAAAAAAABAAAAAAAAAAD//gAAAAAAAAAABDMyMTUyMTE1MDI2MzE0Njg3/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+5+T2dekB8vfW3brf3WrDRDczOQAAAAA=

‎source4/librpc/tests/fuzzed_ntlmssp-AUTHENTICATE_MESSAGE.txt

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
pull returned Success
2+
WARNING! 188 unread bytes
3+
[0000] 04 33 32 31 35 32 31 31 35 30 32 36 33 31 34 36 .3215211 50263146
4+
[0010] 38 37 FE FE FE FE FE FE FE FE FE FE FE FE FE FE 87...... ........
5+
[0020] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
6+
[0030] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
7+
[0040] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
8+
[0050] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
9+
[0060] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
10+
[0070] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
11+
[0080] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
12+
[0090] FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE FE ........ ........
13+
[00A0] FE FE FE FE FE E7 E4 F6 75 E9 01 F2 F7 D6 DD BA ........ u.......
14+
[00B0] DF DD 6A C3 44 37 33 39 00 00 00 00 ..j.D739 ....
15+
AUTHENTICATE_MESSAGE: struct AUTHENTICATE_MESSAGE
16+
Signature : ''
17+
MessageType : UNKNOWN_ENUM_VALUE (0)
18+
LmChallengeResponseLen : 0x0000 (0)
19+
LmChallengeResponseMaxLen: 0x0000 (0)
20+
LmChallengeResponse : NULL
21+
NtChallengeResponseLen : 0x0000 (0)
22+
NtChallengeResponseMaxLen: 0x0000 (0)
23+
NtChallengeResponse : NULL
24+
DomainNameLen : 0x0000 (0)
25+
DomainNameMaxLen : 0x0000 (0)
26+
DomainName : NULL
27+
UserNameLen : 0x0000 (0)
28+
UserNameMaxLen : 0x0001 (1)
29+
UserName : NULL
30+
WorkstationLen : 0x3933 (14643)
31+
WorkstationMaxLen : 0x0000 (0)
32+
Workstation : NULL
33+
EncryptedRandomSessionKeyLen: 0x0100 (256)
34+
EncryptedRandomSessionKeyMaxLen: 0x0000 (0)
35+
EncryptedRandomSessionKey: NULL
36+
NegotiateFlags : 0xfeff0000 (4278124544)
37+
0: NTLMSSP_NEGOTIATE_UNICODE
38+
0: NTLMSSP_NEGOTIATE_OEM
39+
0: NTLMSSP_REQUEST_TARGET
40+
0: NTLMSSP_NEGOTIATE_SIGN
41+
0: NTLMSSP_NEGOTIATE_SEAL
42+
0: NTLMSSP_NEGOTIATE_DATAGRAM
43+
0: NTLMSSP_NEGOTIATE_LM_KEY
44+
0: NTLMSSP_NEGOTIATE_NETWARE
45+
0: NTLMSSP_NEGOTIATE_NTLM
46+
0: NTLMSSP_NEGOTIATE_NT_ONLY
47+
0: NTLMSSP_ANONYMOUS
48+
0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
49+
0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
50+
0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
51+
0: NTLMSSP_NEGOTIATE_ALWAYS_SIGN
52+
1: NTLMSSP_TARGET_TYPE_DOMAIN
53+
1: NTLMSSP_TARGET_TYPE_SERVER
54+
1: NTLMSSP_TARGET_TYPE_SHARE
55+
1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
56+
1: NTLMSSP_NEGOTIATE_IDENTIFY
57+
1: NTLMSSP_REQUEST_NON_NT_SESSION_KEY
58+
1: NTLMSSP_NEGOTIATE_TARGET_INFO
59+
1: NTLMSSP_NEGOTIATE_VERSION
60+
1: NTLMSSP_NEGOTIATE_128
61+
1: NTLMSSP_NEGOTIATE_KEY_EXCH
62+
1: NTLMSSP_NEGOTIATE_56
63+
Version: struct ntlmssp_VERSION
64+
ProductMajorVersion : UNKNOWN_ENUM_VALUE (0)
65+
ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_0 (0)
66+
ProductBuild : 0x0000 (0)
67+
Reserved: ARRAY(3)
68+
[0] : 0x00 (0)
69+
[1] : 0x00 (0)
70+
[2] : 0x00 (0)
71+
NTLMRevisionCurrent : UNKNOWN_ENUM_VALUE (0)
72+
push returned Success
73+
pull returned Success
74+
AUTHENTICATE_MESSAGE: struct AUTHENTICATE_MESSAGE
75+
Signature : 'NTLMSSP'
76+
MessageType : NtLmAuthenticate (3)
77+
LmChallengeResponseLen : 0x0000 (0)
78+
LmChallengeResponseMaxLen: 0x0000 (0)
79+
LmChallengeResponse : NULL
80+
NtChallengeResponseLen : 0x0000 (0)
81+
NtChallengeResponseMaxLen: 0x0000 (0)
82+
NtChallengeResponse : NULL
83+
DomainNameLen : 0x0000 (0)
84+
DomainNameMaxLen : 0x0000 (0)
85+
DomainName : NULL
86+
UserNameLen : 0x0000 (0)
87+
UserNameMaxLen : 0x0000 (0)
88+
UserName : NULL
89+
WorkstationLen : 0x0000 (0)
90+
WorkstationMaxLen : 0x0000 (0)
91+
Workstation : NULL
92+
EncryptedRandomSessionKeyLen: 0x0000 (0)
93+
EncryptedRandomSessionKeyMaxLen: 0x0000 (0)
94+
EncryptedRandomSessionKey: NULL
95+
NegotiateFlags : 0xfeff0000 (4278124544)
96+
0: NTLMSSP_NEGOTIATE_UNICODE
97+
0: NTLMSSP_NEGOTIATE_OEM
98+
0: NTLMSSP_REQUEST_TARGET
99+
0: NTLMSSP_NEGOTIATE_SIGN
100+
0: NTLMSSP_NEGOTIATE_SEAL
101+
0: NTLMSSP_NEGOTIATE_DATAGRAM
102+
0: NTLMSSP_NEGOTIATE_LM_KEY
103+
0: NTLMSSP_NEGOTIATE_NETWARE
104+
0: NTLMSSP_NEGOTIATE_NTLM
105+
0: NTLMSSP_NEGOTIATE_NT_ONLY
106+
0: NTLMSSP_ANONYMOUS
107+
0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
108+
0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
109+
0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL
110+
0: NTLMSSP_NEGOTIATE_ALWAYS_SIGN
111+
1: NTLMSSP_TARGET_TYPE_DOMAIN
112+
1: NTLMSSP_TARGET_TYPE_SERVER
113+
1: NTLMSSP_TARGET_TYPE_SHARE
114+
1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
115+
1: NTLMSSP_NEGOTIATE_IDENTIFY
116+
1: NTLMSSP_REQUEST_NON_NT_SESSION_KEY
117+
1: NTLMSSP_NEGOTIATE_TARGET_INFO
118+
1: NTLMSSP_NEGOTIATE_VERSION
119+
1: NTLMSSP_NEGOTIATE_128
120+
1: NTLMSSP_NEGOTIATE_KEY_EXCH
121+
1: NTLMSSP_NEGOTIATE_56
122+
Version: struct ntlmssp_VERSION
123+
ProductMajorVersion : UNKNOWN_ENUM_VALUE (0)
124+
ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_0 (0)
125+
ProductBuild : 0x0000 (0)
126+
Reserved: ARRAY(3)
127+
[0] : 0x00 (0)
128+
[1] : 0x00 (0)
129+
[2] : 0x00 (0)
130+
NTLMRevisionCurrent : UNKNOWN_ENUM_VALUE (0)
131+
WARNING! orig bytes:260 validated pushed bytes:72
132+
WARNING! orig and validated differ at byte 0x00 (0)
133+
WARNING! orig byte[0x00] = 0x00 validated byte[0x00] = 0x4E
134+
dump OK

0 commit comments

Comments
 (0)