Skip to content

kerberos: reject encryption types wider than Int32 #5107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KernelClint wants to merge 1 commit into
base: master
Choose a base branch
from
Open

kerberos: reject encryption types wider than Int32 #5107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion scapy/layers/kerberos.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,10 +374,22 @@ def fromSPN(spn: str):
}


class _KRBInt32Field(ASN1F_enum_INTEGER):
def m2i(self, pkt, s):
s = self._apply_tagging_dec(s, pkt, _fname=self.name)
codec = self.ASN1_tag.get_codec(pkt.ASN1_codec)
if codec.check_type_get_len(s)[0] > 5:
raise BER_Decoding_Error(
"Kerberos integer is wider than 32 bits", remaining=s
)
dec = codec.safedec if self.flexible_tag else codec.dec
return dec(s, context=self.context, **self._codec_kwargs(pkt))


class EncryptedData(ASN1_Packet):
ASN1_codec = ASN1_Codecs.BER
ASN1_root = ASN1F_SEQUENCE(
ASN1F_enum_INTEGER("etype", 0x17, _KRB_E_TYPES, explicit_tag=0xA0),
_KRBInt32Field("etype", 0x17, _KRB_E_TYPES, explicit_tag=0xA0),
ASN1F_optional(UInt32("kvno", None, explicit_tag=0xA1)),
ASN1F_STRING("cipher", "", explicit_tag=0xA2),
)
Expand Down
5 changes: 5 additions & 0 deletions test/regression.uts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1503,6 +1503,11 @@ assert pkt.json() == '{"length": null, "id": 0, "qr": 0, "opcode": 0, "aa": 0, "
pkt = KRB_AP_REP(bytes(KRB_AP_REP(encPart=EncryptedData())))
assert pkt.command() == "KRB_AP_REP(pvno=ASN1_INTEGER(5), msgType=ASN1_INTEGER(15), encPart=EncryptedData(etype=ASN1_INTEGER(23), kvno=None, cipher=ASN1_STRING(b'')))"

= KRB AP REP rejects encryption type wider than Int32
wide = KerberosTCPHeader(hex_bytes("000000206f1e301ca003020105a10302010fa210300ea0080206010101010101a2020400"))
assert Raw in wide
assert KRB_AP_REP not in wide

= Test json(à with ASN.1 packet

assert pkt.json() == '{"pvno": {"type": "ASN1_INTEGER", "value": "5"}, "msgType": {"type": "ASN1_INTEGER", "value": "15"}, "encPart": {"etype": {"type": "ASN1_INTEGER", "value": "23"}, "kvno": null, "cipher": {"type": "ASN1_STRING", "value": ""}}}'
Expand Down
Loading