Commit fdbf540e authored by jan.koester's avatar jan.koester
Browse files

bugfix

parent 00a4bd7c

plugin/krb5/krb5.cpp

+11 −2
Changes for plugin/krb5/krb5.cpp: 11 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -3601,9 +3601,18 @@ bool Krb5KDC::lookupPrincipal(RealmInfo &ri, const Krb5Principal &principal, 
    /* a machine account: sAMAccountName is NAME$ */

    if (!e && !principal.name.empty() && principal.name.back() != '$')

        e = ri.dir->bySamAccountName(principal.name + "$");

    /* a userPrincipalName */

    if (!e && principal.name.find('@') != std::string::npos)

    /* a userPrincipalName (NT-ENTERPRISE principal, e.g. a Windows logon as

     * "administrator@example.com") -> try the explicit UPN, then fall back to

     * the account name before the '@'. */

    if (!e && principal.name.find('@') != std::string::npos) {

        e = ri.dir->byUpn(principal.name);

        if (!e) {

            std::string sam = principal.name.substr(0, principal.name.find('@'));

            e = ri.dir->bySamAccountName(sam);

            if (!e && !sam.empty() && sam.back() != '$')

                e = ri.dir->bySamAccountName(sam + "$");

        }

    }

    if (!e)

        return false;

plugin/smb/smb.cpp

+19 −0
Changes for plugin/smb/smb.cpp: 19 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -358,6 +358,25 @@ std::vector<uint8_t> SmbServer::handleMessage(Conn &c, const std::vector<uint8_t 
                ntlm::Auth3 a;

                if (!ntlm::parseAuth3(ntok, a))

                    return errorResponse(req, smb::STATUS_LOGON_FAILURE);

                /* anonymous / NULL session: empty user and empty NT response.

                 * A machine opens \netlogon this way, then does the real auth in

                 * the netlogon RPC (ReqChallenge/Authenticate3). Accept it as an

                 * unsigned NULL session. */

                if (a.user.empty() && a.ntResponse.size() <= 1) {

                    std::cerr << "[SMB] NTLMSSP AUTH anonymous -> NULL session" << std::endl;

                    c.authenticated = true;

                    c.clientPrincipal = "ANONYMOUS";

                    std::vector<uint8_t> outTok = spnego

                        ? gss::buildSpnegoResp(gss::ACCEPT_COMPLETED, nullptr, {}, {})

                        : std::vector<uint8_t>();

                    auto resp = respHeader(smb::STATUS_SUCCESS);

                    std::vector<uint8_t> b2;

                    w16(b2, 9); w16(b2, 2 /*SMB2_SESSION_FLAG_IS_NULL*/); w16(b2, 72);

                    w16(b2, uint16_t(outTok.size()));

                    b2.insert(b2.end(), outTok.begin(), outTok.end());

                    resp.insert(resp.end(), b2.begin(), b2.end());

                    return resp;   /* NULL session: unsigned */

                }

                std::vector<uint8_t> ntHash; std::string princ;

                if (!g_KdcPlugin->ntlmNtHash(a.user, a.domain, ntHash, princ)) {

                    std::cerr << "[SMB] NTLMSSP AUTH '" << a.domain << "\\" << a.user