TestFuzzNTLMMessage.c

 
#include <stddef.h>
#include <stdint.h>
 
#include <winpr/crt.h>
#include <winpr/sspi.h>
#include <winpr/wlog.h>
 
#include "../sspi.h"
 
#define TEST_SSPI_INTERFACE SSPI_INTERFACE_WINPR
#define NTLM_PACKAGE_NAME NTLM_SSP_NAME
 
static const char* TEST_NTLM_USER = "Username";
static const char* TEST_NTLM_DOMAIN = "Domain";
static const char* TEST_NTLM_PASSWORD = "P4ss123!";
static const BYTE TEST_NTLM_V2_HASH[16] = { 0x4c, 0x7f, 0x70, 0x6f, 0x7d, 0xde, 0x05, 0xa9,
                                          0xd1, 0xa0, 0xf4, 0xe7, 0xff, 0xe3, 0xbf, 0xb8 };
 
typedef struct
{
  CtxtHandle context;
  ULONG cbMaxToken;
  ULONG fContextReq;
  ULONG pfContextAttr;
  TimeStamp expiration;
  SecBuffer inputBuffer[1];
  SecBuffer outputBuffer[1];
  BOOL haveContext;
  BOOL haveInputBuffer;
  SecBufferDesc inputBufferDesc;
  SecBufferDesc outputBufferDesc;
  CredHandle credentials;
  SecPkgInfo* pPackageInfo;
  SecurityFunctionTable* table;
  SEC_WINNT_AUTH_IDENTITY identity;
} FUZZ_NTLM_CLIENT;
 
typedef struct
{
  CtxtHandle context;
  ULONG cbMaxToken;
  ULONG fContextReq;
  ULONG pfContextAttr;
  TimeStamp expiration;
  SecBuffer inputBuffer[1];
  SecBuffer outputBuffer[1];
  BOOL haveContext;
  BOOL haveInputBuffer;
  SecBufferDesc inputBufferDesc;
  SecBufferDesc outputBufferDesc;
  CredHandle credentials;
  SecPkgInfo* pPackageInfo;
  SecurityFunctionTable* table;
} FUZZ_NTLM_SERVER;
 
static void fuzz_ntlm_client_uninit(FUZZ_NTLM_CLIENT* client)
{
  if (!client)
    return;
 
  free(client->outputBuffer[0].pvBuffer);
  client->outputBuffer[0].pvBuffer = nullptr;
 
  free(client->identity.User);
  free(client->identity.Domain);
  free(client->identity.Password);
 
  if (client->table)
  {
    if (SecIsValidHandle(&client->credentials))
      (void)client->table->FreeCredentialsHandle(&client->credentials);
    if (client->pPackageInfo)
      (void)client->table->FreeContextBuffer(client->pPackageInfo);
    if (client->haveContext && SecIsValidHandle(&client->context))
      (void)client->table->DeleteSecurityContext(&client->context);
  }
}
 
static BOOL fuzz_ntlm_client_init(FUZZ_NTLM_CLIENT* client)
{
  SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
 
  WINPR_ASSERT(client);
 
  ZeroMemory(client, sizeof(*client));
  SecInvalidateHandle(&client->context);
  SecInvalidateHandle(&client->credentials);
 
  client->table = InitSecurityInterfaceEx(TEST_SSPI_INTERFACE);
  if (!client->table)
    return FALSE;
 
  if (sspi_SetAuthIdentity(&client->identity, TEST_NTLM_USER, TEST_NTLM_DOMAIN,
                           TEST_NTLM_PASSWORD) < 0)
    return FALSE;
 
  status = client->table->QuerySecurityPackageInfo(NTLM_PACKAGE_NAME, &client->pPackageInfo);
  if (status != SEC_E_OK)
    return FALSE;
 
  client->cbMaxToken = client->pPackageInfo->cbMaxToken;
  status = client->table->AcquireCredentialsHandle(
      nullptr, NTLM_PACKAGE_NAME, SECPKG_CRED_OUTBOUND, nullptr, &client->identity, nullptr,
      nullptr, &client->credentials, &client->expiration);
  if (status != SEC_E_OK)
    return FALSE;
 
  client->fContextReq = ISC_REQ_MUTUAL_AUTH | ISC_REQ_CONFIDENTIALITY | ISC_REQ_USE_SESSION_KEY;
  return TRUE;
}
 
static SECURITY_STATUS fuzz_ntlm_client_step(FUZZ_NTLM_CLIENT* client)
{
  SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
 
  WINPR_ASSERT(client);
 
  free(client->outputBuffer[0].pvBuffer);
  client->outputBuffer[0].pvBuffer = nullptr;
 
  client->outputBufferDesc.ulVersion = SECBUFFER_VERSION;
  client->outputBufferDesc.cBuffers = ARRAYSIZE(client->outputBuffer);
  client->outputBufferDesc.pBuffers = client->outputBuffer;
  client->outputBuffer[0].BufferType = SECBUFFER_TOKEN;
  client->outputBuffer[0].cbBuffer = client->cbMaxToken;
  client->outputBuffer[0].pvBuffer = calloc(1, client->outputBuffer[0].cbBuffer);
  if (!client->outputBuffer[0].pvBuffer)
    return SEC_E_INSUFFICIENT_MEMORY;
 
  if (client->haveInputBuffer)
  {
    client->inputBufferDesc.ulVersion = SECBUFFER_VERSION;
    client->inputBufferDesc.cBuffers = ARRAYSIZE(client->inputBuffer);
    client->inputBufferDesc.pBuffers = client->inputBuffer;
    client->inputBuffer[0].BufferType = SECBUFFER_TOKEN;
  }
 
  status = client->table->InitializeSecurityContext(
      &client->credentials, client->haveContext ? &client->context : nullptr, nullptr,
      client->fContextReq, 0, SECURITY_NATIVE_DREP,
      client->haveInputBuffer ? &client->inputBufferDesc : nullptr, 0, &client->context,
      &client->outputBufferDesc, &client->pfContextAttr, &client->expiration);
 
  if ((status == SEC_I_COMPLETE_AND_CONTINUE) || (status == SEC_I_COMPLETE_NEEDED))
  {
    if (client->table->CompleteAuthToken)
      (void)client->table->CompleteAuthToken(&client->context, &client->outputBufferDesc);
 
    if (status == SEC_I_COMPLETE_NEEDED)
      status = SEC_E_OK;
    else
      status = SEC_I_CONTINUE_NEEDED;
  }
 
  if (!IsSecurityStatusError(status))
    client->haveContext = TRUE;
 
  return status;
}
 
static void fuzz_ntlm_server_uninit(FUZZ_NTLM_SERVER* server)
{
  if (!server)
    return;
 
  free(server->outputBuffer[0].pvBuffer);
  server->outputBuffer[0].pvBuffer = nullptr;
 
  if (server->table)
  {
    if (SecIsValidHandle(&server->credentials))
      (void)server->table->FreeCredentialsHandle(&server->credentials);
    if (server->pPackageInfo)
      (void)server->table->FreeContextBuffer(server->pPackageInfo);
    if (SecIsValidHandle(&server->context))
      (void)server->table->DeleteSecurityContext(&server->context);
  }
}
 
static BOOL fuzz_ntlm_server_init(FUZZ_NTLM_SERVER* server)
{
  SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
 
  WINPR_ASSERT(server);
 
  ZeroMemory(server, sizeof(*server));
  SecInvalidateHandle(&server->context);
  SecInvalidateHandle(&server->credentials);
 
  server->table = InitSecurityInterfaceEx(TEST_SSPI_INTERFACE);
  if (!server->table)
    return FALSE;
 
  status = server->table->QuerySecurityPackageInfo(NTLM_PACKAGE_NAME, &server->pPackageInfo);
  if (status != SEC_E_OK)
    return FALSE;
 
  server->cbMaxToken = server->pPackageInfo->cbMaxToken;
  status = server->table->AcquireCredentialsHandle(
      nullptr, NTLM_PACKAGE_NAME, SECPKG_CRED_INBOUND, nullptr, nullptr, nullptr, nullptr,
      &server->credentials, &server->expiration);
  if (status != SEC_E_OK)
    return FALSE;
 
  server->fContextReq = ASC_REQ_MUTUAL_AUTH | ASC_REQ_CONFIDENTIALITY | ASC_REQ_CONNECTION |
                        ASC_REQ_USE_SESSION_KEY | ASC_REQ_REPLAY_DETECT |
                        ASC_REQ_SEQUENCE_DETECT | ASC_REQ_EXTENDED_ERROR;
  return TRUE;
}
 
static SECURITY_STATUS fuzz_ntlm_server_step(FUZZ_NTLM_SERVER* server)
{
  SECURITY_STATUS status = SEC_E_INTERNAL_ERROR;
 
  WINPR_ASSERT(server);
 
  free(server->outputBuffer[0].pvBuffer);
  server->outputBuffer[0].pvBuffer = nullptr;
 
  server->inputBufferDesc.ulVersion = SECBUFFER_VERSION;
  server->inputBufferDesc.cBuffers = ARRAYSIZE(server->inputBuffer);
  server->inputBufferDesc.pBuffers = server->inputBuffer;
  server->inputBuffer[0].BufferType = SECBUFFER_TOKEN;
 
  server->outputBufferDesc.ulVersion = SECBUFFER_VERSION;
  server->outputBufferDesc.cBuffers = ARRAYSIZE(server->outputBuffer);
  server->outputBufferDesc.pBuffers = server->outputBuffer;
  server->outputBuffer[0].BufferType = SECBUFFER_TOKEN;
  server->outputBuffer[0].cbBuffer = server->cbMaxToken;
  server->outputBuffer[0].pvBuffer = calloc(1, server->outputBuffer[0].cbBuffer);
  if (!server->outputBuffer[0].pvBuffer)
    return SEC_E_INSUFFICIENT_MEMORY;
 
  status = server->table->AcceptSecurityContext(
      &server->credentials, server->haveContext ? &server->context : nullptr,
      &server->inputBufferDesc, server->fContextReq, SECURITY_NATIVE_DREP, &server->context,
      &server->outputBufferDesc, &server->pfContextAttr, &server->expiration);
 
  if (!IsSecurityStatusError(status))
    server->haveContext = TRUE;
 
  if (status == SEC_I_CONTINUE_NEEDED)
  {
    SecPkgContext_AuthNtlmHash hash = WINPR_C_ARRAY_INIT;
    hash.Version = 2;
    CopyMemory(hash.NtlmHash, TEST_NTLM_V2_HASH, sizeof(TEST_NTLM_V2_HASH));
    (void)server->table->SetContextAttributes(&server->context, SECPKG_ATTR_AUTH_NTLM_HASH,
                                              &hash, sizeof(hash));
  }
 
  return status;
}
 
static void fuzz_ntlm_set_input(SecBuffer* buffer, BOOL* haveInputBuffer, const uint8_t* data,
                                size_t size)
{
  WINPR_ASSERT(buffer);
  WINPR_ASSERT(haveInputBuffer);
 
  buffer[0].BufferType = SECBUFFER_TOKEN;
  buffer[0].pvBuffer = (void*)data;
  buffer[0].cbBuffer = (ULONG)size;
  *haveInputBuffer = TRUE;
}
 
static void fuzz_ntlm_negotiate(const uint8_t* data, size_t size)
{
  FUZZ_NTLM_SERVER server = WINPR_C_ARRAY_INIT;
 
  if (!fuzz_ntlm_server_init(&server))
    goto fail;
 
  fuzz_ntlm_set_input(server.inputBuffer, &server.haveInputBuffer, data, size);
  (void)fuzz_ntlm_server_step(&server);
 
fail:
  fuzz_ntlm_server_uninit(&server);
}
 
static void fuzz_ntlm_challenge(const uint8_t* data, size_t size)
{
  FUZZ_NTLM_CLIENT client = WINPR_C_ARRAY_INIT;
 
  if (!fuzz_ntlm_client_init(&client))
    goto fail;
 
  if (IsSecurityStatusError(fuzz_ntlm_client_step(&client)))
    goto fail;
 
  fuzz_ntlm_set_input(client.inputBuffer, &client.haveInputBuffer, data, size);
  (void)fuzz_ntlm_client_step(&client);
 
fail:
  fuzz_ntlm_client_uninit(&client);
}
 
static void fuzz_ntlm_authenticate(const uint8_t* data, size_t size)
{
  FUZZ_NTLM_CLIENT client = WINPR_C_ARRAY_INIT;
  FUZZ_NTLM_SERVER server = WINPR_C_ARRAY_INIT;
 
  if (!fuzz_ntlm_client_init(&client))
    goto fail;
  if (!fuzz_ntlm_server_init(&server))
    goto fail;
 
  if (fuzz_ntlm_client_step(&client) != SEC_I_CONTINUE_NEEDED)
    goto fail;
 
  fuzz_ntlm_set_input(server.inputBuffer, &server.haveInputBuffer,
                      client.outputBuffer[0].pvBuffer, client.outputBuffer[0].cbBuffer);
  if (fuzz_ntlm_server_step(&server) != SEC_I_CONTINUE_NEEDED)
    goto fail;
 
  fuzz_ntlm_set_input(server.inputBuffer, &server.haveInputBuffer, data, size);
  (void)fuzz_ntlm_server_step(&server);
 
fail:
  fuzz_ntlm_client_uninit(&client);
  fuzz_ntlm_server_uninit(&server);
}
 
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
  static BOOL loggingInitialized = FALSE;
 
  if (!loggingInitialized)
  {
    (void)WLog_SetLogLevel(WLog_GetRoot(), WLOG_TRACE);
    loggingInitialized = TRUE;
  }
 
  if (size < 2)
    return 0;
  if (size > (1u << 20))
    return 0;
 
  switch (data[0] % 3)
  {
    case 0:
      fuzz_ntlm_negotiate(data + 1, size - 1);
      break;
    case 1:
      fuzz_ntlm_challenge(data + 1, size - 1);
      break;
    case 2:
      fuzz_ntlm_authenticate(data + 1, size - 1);
      break;
    default:
      break;
  }
 
  return 0;
}