HTTP NTLM v2 decoding is fragile and possibly wrong

[hdm]

The NTLM library used is missing length checks when accessing byte offsets. The reported NetNTLMv2 challenge response may not be correct either.

[tomsteele]

If we change

flamingo/pkg/flamingo/http.go

Line 326 in d4a2611

nt := v2[32 : len(v2)-1]

To

nt := v2[32:]

The NTLMV2 hash works. But you're right, the length of the payload is not validated prior to processing. One of two ways to handle this, we either write our own parser or apply our own length check prior to processing.

Both are pretty easy to do. Thoughts @hdm ? Tempted to write this so we can rid ourselves of a dependency.

[tomsteele]

Adding a Header value and Hash value that are correct for writing unit tests

TlRMTVNTUAADAAAAGAAYAHAAAAAgASABiAAAAAAAAABYAAAACgAKAFgAAAAOAA4AYgAAAAAAAACoAQAABQKIogoAukcAAAAPvUs9MFTLfyF+taDWbFQG9mEAZABtAGkAbgBYAEIATwBYAFQAVwBPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOE5KXJoMxnJGJvv8TbP9VsBAQAAAAAAAKErrKbWGtYBrrSultnl0PMAAAAAAgAGAEYAVABQAAEAFgBGAFQAUAAtAFQATwBPAEwAQgBPAFgABAASAGYAdABwAC4AbABvAGMAYQBsAAMAKABzAGUAcgB2AGUAcgAyADAAMQA2AC4AZgB0AGIALgBsAG8AYwBhAGwABQASAGYAdABwAC4AbABvAGMAYQBsAAgAMAAwAAAAAAAAAAEAAAAAEAAAbyuztEal0DMc1MEeOrneJdaNuexiqXPMSC1m24nbeX0KABAAAAAAAAAAAAAAAAAAAAAAAAkAJABIAFQAVABQAC8AMQA5ADIALgAxADYAOAAuADcALgAyADQAMQAAAAAAAAAAAA=='

admin:::1122334455667788:E1392972683319C9189BEFF136CFF55B:0101000000000000A12BACA6D61AD601AEB4AE96D9E5D0F30000000002000600460054005000010016004600540050002D0054004F004F004C0042004F005800040012006600740070002E006C006F00630061006C000300280073006500720076006500720032003000310036002E006600740062002E006C006F00630061006C00050012006600740070002E006C006F00630061006C0008003000300000000000000001000000001000006F2BB3B446A5D0331CD4C11E3AB9DE25D68DB9EC62A973CC482D66DB89DB797D0A001000000000000000000000000000000000000900240048005400540050002F003100390032002E003100360038002E0037002E003200340031000000000000000000

[hdm]

I would lean towards removing the dependency if possible.