Java Doc for NTLM.java in  » Web-Crawler » JoBo » com » luigidragone » net » ntlm » Java Source Code / Java DocumentationJava Source Code and Java Documentation

This class implements the Microsoft NTLM authentication protocol.

NTLM is a Microsoft proprietary network authentication protocol used in many situations (e.g. by the Microsoft Proxy Server to authenticate a browser).

It requires a JCE compatible MD4 hash algorithm implementation and a DES with no-padding ECB cipher to compute the requested value.
An open source JCE compatible library is Cryptix JCE and it is available here. We are assuming that the JCE provider is correctly installed and configured. Notice that the Sun JCE implementation proviedes the DES cipher but doesn't provide the MD4 hashing.

• the host name (with its own domain);
• the user name (with its own domain);
• the user password.

To start an NTLM authentication procedure (e.g. with a proxy server) build a request message calling NTLM.formatRequest(String,String) formatRequest and send it to the server.
Once the challenge packet has been correctly received extract from it the nonce with NTLM.getNonce(byte[]) getNonce function and use it to compute the reply and build the response message with NTLM.formatResponse(String,String,String,byte[],byte[],byte[]) formatResponse method and send it back to the server.
Repeat the previous steps until the server authenticates the client's identity or a large number of retries has been made. The check of a successful authentication is protocol specific (e.g. code 200 in HTTP), thus it is not performed by this component.

We want to access to the page http://www.server.com/page.html through an NTLM proxy proxy.domain.com that accepts connection on port 80.
We access to proxy from host HOSTDOMAIN\\HOST with the user USERDOMAIN\\user (password "1234567890").
As first step we open a socket connection to proxy server and set up the required object. Notice that we use a keep-alive connection, because NTLM authentication is connection based and the connection must be alive through the whole process.


 Socket s = new Socket("proxy.domain.com", 80);
 s.setKeepAlive(true);
 InputStream is = s.getInputStream();
 OutputStream os = s.getOutputStream();
 BufferedReader r = new BufferedReader(new InputStreamReader(is));
 BufferedWriter w = new BufferedWriter(new OutputStreamWriter(os));
 String host = "HOST";
 String hostDomain = "HOSTDOMAIN";
 String user = "user";
 String userDomain = "USERDOMAIN";
 String password = "1234567890";
 

 byte[] fstMsg = NTLM.formatRequest(host, hostDomain);
 byte[] fstMsg64 = Codecs.base64Encode(fstMsg);
 System.out.println("NTLM Request Packet: " + new String(fstMsg64));
 w.write("GET http://www.server.com/page.html HTTP/1.0\n");
 w.write("Host: www.server.com\n");
 w.write("Proxy-Connection: Keep-Alive\n");
 w.write("Proxy-Authorization: NTLM " + new String(fstMsg64) + "\n\n");
 w.flush();
 System.out.println("First Message Sent");
 

 String resp = "";
 int contentLength = 0;
 while((line = r.readLine()) != null)
 if(line.length() == 0)
 break;
 if(line.startsWith("Content-Length"))
 contentLength = Integer.parseInt(line.substring(line.indexOf(":") + 1).trim());
 else if(line.startsWith("Proxy-Authenticate"))
 resp = line.substring(line.indexOf(":") + 1).trim();
 r.skip(contentLength);
 System.out.println("Second Message Received");
 System.out.println("Content Length: " + contentLength);
 System.out.println("Proxy-Authenticate: " + resp);
 resp = resp.substring(resp.indexOf(" ")).trim();
 System.out.println("NTLM Chellange Packet: " + resp);
 resp = Codecs.base64Decode(resp);
 byte[] sndMsg = resp.getBytes();
 byte[] nonce = NTLM.getNonce(sndMsg);
 

 byte[] trdMsg = NTLM.formatResponse(host, user, userDomain,
 NTLM.computeLMPassword(password), NTLM.computeNTPassword(password),
 nonce);
 System.out.println(trdMsg.length);
 byte[] trdMsg64 = Codecs.base64Encode(trdMsg);
 System.out.println("NTLM Response Packet: " + new String(trdMsg64));
 

 w.write("GET http://www.server.com/page.html HTTP/1.0\n");
 w.write("Proxy-Connection: Keep-Alive\n");
 w.write("Host: www.server.com\n");
 w.write("Proxy-Authorization: NTLM " + new String(trdMsg64) + "\n\n");
 w.flush();
 System.out.println("Third Message Sent");
 

 System.out.println("Server response: " + r.readLine());
 

Computes an odd DES key from 56 bits represented as a 7-bytes array.

Computes the NTLM response to the nonce based on the supplied hashed passwords.

Builds a request message for the host of the specified domain that can be send to the server to start the NTLM protocol.

The returned message should be encoded according to protocol specific rules (e.g.

Builds the nonce response message.

It requires the Lan Manager and NT hashed version of user password, that can be computed from the cleartext version by NTLM.computeNTPassword(String) computeNTPassword and NTLM.computeNTLMResponse(byte[],byte[],byte[],byte[],byte[]) computeNTLMResponse , and the nonce obtained from the server by NTLM.getNonce(byte[]) getNonce .
The returned message should be encoded according to protocol specific rules (e.g.

Extracts from the server challenge response the nonce required to perform the authentication.

The received message should be decoded according to protocol specific rules (e.g.

Converts an unsigned byte to an unsigned integer.

Computes an odd DES key from 56 bits represented as a 7-bytes array.

Keeps elements from index offset to index offset + 7 of supplied array.

Computes the NTLM response to the nonce based on the supplied hashed passwords.

If the hashed password are not available they can be computed from the cleartext password by the means of NTLM.computeLMPassword(String) computeLMPassword and NTLM.computeNTPassword(String) computeNTPassword methods.

Builds a request message for the host of the specified domain that can be send to the server to start the NTLM protocol.

The returned message should be encoded according to protocol specific rules (e.g. base 64 encoding).
The message format is discussed here.

Builds the nonce response message.

It requires the Lan Manager and NT hashed version of user password, that can be computed from the cleartext version by NTLM.computeNTPassword(String) computeNTPassword and NTLM.computeNTLMResponse(byte[],byte[],byte[],byte[],byte[]) computeNTLMResponse , and the nonce obtained from the server by NTLM.getNonce(byte[]) getNonce .
The returned message should be encoded according to protocol specific rules (e.g. base 64 encoding).
The message format is discussed here.

Extracts from the server challenge response the nonce required to perform the authentication.

The received message should be decoded according to protocol specific rules (e.g. base 64 encoding).
The message format is discussed here.

Converts an unsigned byte to an unsigned integer.

Notice that Java bytes are always signed, but the cryptographic algorithms rely on unsigned ones, that can be simulated in this way.
A bit mask is employed to prevent that the signum bit is extended to MSBs.