lsarpc.AuthInformation NDR Marshal

[krasnovu]

Good afternoon, @oiweiwei !
I am trying to call the CreateTrustedDomainEx2 method and get the error /lsarpc/v0/LsarCreateTrustedDomainEx2: ntstatus: STATUS_INVALID_PARAMETER (0xc000000d).
I suspected the AuthenticationInformation property in the lsarpc.CreateTrustedDomainEx2Request structure, since the bytes in it must be created by myself.
In the process of parsing I found a similar code in freeipa and it works without errors.
Where auth_info is populated in this method.

Corrected so that password and time coincide and output structure bytes.


You can see the differences in ndr encoding. I tried to understand the pointers part, but I think I didn't get it. For example, what I saw in the code is not clear is that the length is encoded twice. Can you please see if there really is an incorrect code?

Here is the data of the drsblobs.AuthenticationInformation structure from the freeipa: AGgGgr5z2wECAAAAAAAAAAAAAAAAAAAAAAAAAFAAYQBzAHMAdwBvAHIAZAA=
And this is the data of the structure lsarpc.AuthInformation from the library code: AGgGgr5z2wECECAAAAAAAAAAAAAAAAAAAAAABEAAAAAAQAAAAAAAAAAAUABhAHMAcwB3AG8AcgBkAA==.
main.go.tar.gz

[oiweiwei]

If this is an opaque blob you must specify ndr.Marshal(authInfo, ndr.Opaque) to get the data without NDR transfer encoding headers (like extra size, NDR pointers and so on).

[oiweiwei]

hm, in general, I consider that TrustAuthInfo and TrustAuthInfoBlob are different structures that cannot be used interchangeable. TrustAuthInfoBlob is not a part of IDL, so requires separate implementation.

[krasnovu]

The code in the first post is already deprecated. I have implemented TrustAuthInfoBlob. I also found how to get the session key. But unfortunately it did not help. I looked at my and freeipa's trace from weirshark and now everything coincides by structure. I even tried to decrypt freeipa's TrustAuthInfoBlob with the session key. And did the same from my trace. And the only suspicion I have now is that this session key is not what Windows expects. I'm attaching the actual code. If you don't want to publish your email address you can email me yours on my nickname on gmail.com.
main.go.tar.gz

[oiweiwei]

ye, you can send me traces on [email protected]. I will check them, it would also be nice if you could include python scripts to cross-validate with freeipa or some examples on how to use it.

[oiweiwei]

Hm, I was able to make it work finally. The key points:

1. you're right that something was with session key:

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/901ae284-31d3-4ea1-ae8a-766fc8bfe00e

The application provides a handle to an Open established on the session of interest. If the handle is invalid or if no Open referenced by the handle is found, the client MUST return an implementation-specific error code locally to the calling application. If the handle is valid and an Open is found and the Open.TreeConnect is NULL, the client MUST return an implementation-specific error code locally to the calling application. If the handle is valid and an Open is found and the Open.TreeConnect is not NULL, the client MUST do the following:

If Connection.Dialect belongs to the SMB 3.x dialect family, the client MUST return Open.TreeConnect.Session.ApplicationKey. Otherwise, the client MUST return Open.TreeConnect.Session.SessionKey.

2. There is a special session key used when DCE/RPC transport security is applied: "SystemLibraryDTC"

https://www.snia.org/sites/default/files/SDC/2016/presentations/smb/Stefan_Metzmacher_Improving_DCERPC_Security.pdf

So, to summarize,

you can just set key when WithSeal or WithSign is in action for LSA:

key2 = []byte("SystemLibraryDTC")

Or downgrade the SMB dialect to 2XX and use WithInsecure

I'll provide some access to SMBSessionKey based on guidelines from the references above.

[krasnovu]

While I was writing an explanatory note to the trace files and freipa python files, you found the problem, you are a true professional! Thank you very much, I admire you! The code works now! 🤝 🎆

[oiweiwei]

released v1.1.6 with gssapi.SMBEffectiveSessionKey gssapi attribute available in conn.Context(). You can try it with any combination of SMB dialects and Insecure/Sign/Seal RPC transport security levels. If Insecure -> SMB Session or Application key (depending on Dialect), else SystemLibraryDTC