Adding NTLM Type 2 Message Decoding#545
Conversation
lobsterjerusalem
changed the title
terrorbyte
left a comment
terrorbyte
left a comment
There was a problem hiding this comment.
The NTLM type 2 component seems good, I think the UTF16-LE decoding is too fragile.
There was a problem hiding this comment.
Pull request overview
Adds NTLM Type 2 message decoding utilities to the transform package, including parsing of TargetInfo AV pairs and UTF-16LE decoding, with accompanying unit tests.
Changes:
- Added NTLM Type 2 decoding (
DecodeNTLMType2) and supporting data structures (NTLMType2Message,TargetInfo). - Added TargetInfo AV-pair parsing (
decodeTargetInfo) and UTF-16LE decoding helper (DecodeUTF16LE). - Added unit tests covering UTF-16LE, TargetInfo parsing, and Type 2 message decoding.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 11 comments.
| File | Description |
|---|---|
| transform/encode.go | Implements NTLM Type 2 message parsing, TargetInfo parsing, and UTF-16LE decoding. |
| transform/encode_test.go | Adds tests validating UTF-16LE decoding, TargetInfo parsing, and NTLM Type 2 decoding. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
spac3yspace
left a comment
spac3yspace
left a comment
There was a problem hiding this comment.
Just one comment from me on checking the length of the received message before indexing.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
spac3yspace
left a comment
spac3yspace
left a comment
There was a problem hiding this comment.
Just suggesting an extra guard, but this otherwise looks good to me.
|
|
||
| // optional value parsing | ||
| if (returnMessage.Flags & 0x00800000) != 0 { // Negotiate target info is set | ||
| targetInfoData := message[targetNameOffset : targetNameOffset+targetNameLen] |
There was a problem hiding this comment.
Maybe add a guard here to ensure the message is large enough to be indexed here
Ready for review.
Adds NTLM Type 2 Message Decoding.