|
| 1 | +package ikev2 |
| 2 | + |
| 3 | +import ( |
| 4 | + "github.com/vulncheck-oss/go-exploit/transform" |
| 5 | +) |
| 6 | + |
| 7 | +// Creates a Nonce component. |
| 8 | +// |
| 9 | +// ikev2.IkePackNonce(ikev2.PayloadType["NOTIFY"], ikeClient.IkeCrypto.InitNonce) |
| 10 | +func IkePackNonce(nextPayload int, nonce []byte) []byte { |
| 11 | + return IkePackPayloadHeader(nextPayload, nonce) |
| 12 | +} |
| 13 | + |
| 14 | +// Creates a VendorID component. |
| 15 | +// |
| 16 | +// tempBytes, _ = hex.DecodeString("4048b7d56ebce88525e7de7f00d6c2d3") |
| 17 | +// ikev2.IkePackVendorID(ikev2.PayloadType["NOTIFY"], tempBytes) |
| 18 | +func IkePackVendorID(nextPayload int, vendorID []byte) []byte { |
| 19 | + return IkePackPayloadHeader(nextPayload, vendorID) |
| 20 | +} |
| 21 | + |
| 22 | +// Creates a Notify component. |
| 23 | +// |
| 24 | +// tempBytes, _ = hex.DecodeString("0021030203030006") |
| 25 | +// ikev2.IkePackNotify(ikev2.PayloadType["NONE"], ikev2.NotifyType["SIGNATURE_HASH_ALGORITHMS"], tempBytes, 0, 0) |
| 26 | +func IkePackNotify(nextPayload int, notifyType int, data []byte, protocolID int, spiSize int) []byte { |
| 27 | + payload := make([]byte, 0) |
| 28 | + payload = append(payload, byte(protocolID)) |
| 29 | + payload = append(payload, byte(spiSize)) |
| 30 | + payload = append(payload, []byte(transform.PackBigInt16(notifyType))...) |
| 31 | + payload = append(payload, data...) |
| 32 | + |
| 33 | + return IkePackPayloadHeader(nextPayload, payload) |
| 34 | +} |
| 35 | + |
| 36 | +// Creates a KeyExchange component. |
| 37 | +// |
| 38 | +// ikev2.IkePackKeyExchange(ikev2.PayloadType["NONCE"], ikev2.DiffieHellmanGroup["DH_GROUP_2048_BIT_MODP"], ikeClient.IkeCrypto.ClientPubKey.Bytes()) |
| 39 | +func IkePackKeyExchange(nextPayload int, dhGroup int, data []byte) []byte { |
| 40 | + payload := []byte(transform.PackBigInt16(dhGroup)) |
| 41 | + payload = append(payload, []byte(transform.PackBigInt16(0))...) // reserved bytes (2) |
| 42 | + payload = append(payload, data...) |
| 43 | + |
| 44 | + return IkePackPayloadHeader(nextPayload, payload) |
| 45 | +} |
| 46 | + |
| 47 | +// Creates a Security Association component. |
| 48 | +// |
| 49 | +// ikev2.IkePackSecurityAssociation(ikev2.PayloadType["KEY_EXCHANGE"], ikev2.IkePackProposal(ikev2.PayloadType["NONE"], 1, 1, defaultTransforms, "")) |
| 50 | +func IkePackSecurityAssociation(payloadType int, proposal []byte) []byte { |
| 51 | + return IkePackPayloadHeader(payloadType, proposal) |
| 52 | +} |
| 53 | + |
| 54 | +// Creates a transform byte array from a transform. |
| 55 | +// |
| 56 | +// ikev2.IkeTransform{NextPayload: ikev2.PayloadType["TRANSFORM"], TransformType: ikev2.TransformType["ENCRYPTION_ALGORITHM"], TransformID: ikev2.EncryptionAlgorithm["ENCR_AES_CBC"], TransformAttributes: 0x800e0100} |
| 57 | +func (ikeTransform *IkeTransform) Pack() []byte { |
| 58 | + payload := make([]byte, 0) |
| 59 | + payload = append(payload, byte(ikeTransform.TransformType)) |
| 60 | + payload = append(payload, byte(0)) |
| 61 | + payload = append(payload, []byte(transform.PackBigInt16(ikeTransform.TransformID))...) |
| 62 | + transform.PackBigInt16(ikeTransform.TransformID) |
| 63 | + |
| 64 | + if ikeTransform.TransformAttributes != 0 { |
| 65 | + payload = append(payload, []byte(transform.PackBigInt32(ikeTransform.TransformAttributes))...) |
| 66 | + } |
| 67 | + |
| 68 | + return IkePackPayloadHeader(ikeTransform.NextPayload, payload) |
| 69 | +} |
| 70 | + |
| 71 | +// Encapsulates a Packed component (or any binary array) with the nextHeader. Used by most of these packs. |
| 72 | +func IkePackPayloadHeader(payloadType int, payloadIn []byte) []byte { |
| 73 | + payload := make([]byte, 0) |
| 74 | + payload = append(payload, byte(payloadType)) |
| 75 | + payload = append(payload, byte(0)) |
| 76 | + payload = append(payload, []byte(transform.PackBigInt16(len(payloadIn)+4))...) |
| 77 | + payload = append(payload, payloadIn...) |
| 78 | + |
| 79 | + return payload |
| 80 | +} |
| 81 | + |
| 82 | +// Creates a Proposal component. |
| 83 | +// |
| 84 | +// ikev2.IkePackProposal(ikev2.PayloadType["NONE"], 1, 1, defaultTransforms, ""). |
| 85 | +func IkePackProposal(nextPayload int, number int, id int, transforms []IkeTransform, spi string) []byte { |
| 86 | + payload := make([]byte, 0) |
| 87 | + payload = append(payload, byte(number)) |
| 88 | + payload = append(payload, byte(id)) |
| 89 | + payload = append(payload, byte(len(spi))) |
| 90 | + payload = append(payload, byte(len(transforms))) |
| 91 | + payload = append(payload, []byte(spi)...) |
| 92 | + for _, transform := range transforms { |
| 93 | + payload = append(payload, transform.Pack()...) |
| 94 | + } |
| 95 | + |
| 96 | + return IkePackPayloadHeader(nextPayload, payload) |
| 97 | +} |
| 98 | + |
| 99 | +// Creates a Header component. |
| 100 | +// |
| 101 | +// ikev2.IkePackHeader(ikeClient, ikev2.PayloadType["SECURITY_ASSOCIATION"], 0x20, ikev2.ExchangeType["IKE_SA_INIT"], 0x08, 0x0) |
| 102 | +func IkePackHeader(ikeClient *IkeClient, payloadType int, version int, exchangeType int, flags int, messageID int) []byte { |
| 103 | + payload := make([]byte, 0) |
| 104 | + payload = append(payload, Uint64ToString(ikeClient.IkeCrypto.InitSPI)...) |
| 105 | + payload = append(payload, Uint64ToString(ikeClient.IkeCrypto.RespSPI)...) |
| 106 | + payload = append(payload, byte(payloadType)) |
| 107 | + payload = append(payload, byte(version)) |
| 108 | + payload = append(payload, byte(exchangeType)) |
| 109 | + payload = append(payload, byte(flags)) |
| 110 | + payload = append(payload, []byte(transform.PackBigInt32(messageID))...) |
| 111 | + |
| 112 | + return payload |
| 113 | +} |
0 commit comments