zydronium/SMBLibrary
1
0
Fork 0
mirror of https://github.com/TalAloni/SMBLibrary.git synced 2025-04-30 10:47:48 +02:00
Code Issues Projects Releases Packages Wiki Activity

IntegratedNTLMAuthenticationProvider: Bugfix: IsGuest was not always set when the username did not exist

Browse source
This commit is contained in:
Tal Aloni 2017-02-26 19:43:17 +02:00
parent eaa8300e11
commit c8b66a16c9
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
SMBLibrary/Win32/IntegratedNTLMAuthenticationProvider.cs
View file

@ -75,7 +75,8 @@ namespace SMBLibrary.Win32.Security
authContext.UserName = message.UserName; authContext.UserName = message.UserName;
authContext.SessionKey = message.EncryptedRandomSessionKey; authContext.SessionKey = message.EncryptedRandomSessionKey;
if ((message.NegotiateFlags & NegotiateFlags.Anonymous) > 0) if ((message.NegotiateFlags & NegotiateFlags.Anonymous) > 0 ||
!IsUserExists(message.UserName))
{ {
if (this.EnableGuestLogin) if (this.EnableGuestLogin)
{ {
@ -113,7 +114,7 @@ namespace SMBLibrary.Win32.Security
// 3. The specified account does not exist. // 3. The specified account does not exist.
// OR: // OR:
// The password is correct but 'limitblankpassworduse' is set to 1 (logon over a network is disabled for accounts without a password). // The password is correct but 'limitblankpassworduse' is set to 1 (logon over a network is disabled for accounts without a password).
bool allowFallback = (!IsUserExists(message.UserName) || result == Win32Error.ERROR_ACCOUNT_RESTRICTION); bool allowFallback = (result == Win32Error.ERROR_ACCOUNT_RESTRICTION);
if (allowFallback && this.EnableGuestLogin) if (allowFallback && this.EnableGuestLogin)
{ {
authContext.IsGuest = true; authContext.IsGuest = true;

2
SMBLibrary/Win32/Security/SSPIHelper.cs
View file

@ -325,6 +325,8 @@ namespace SMBLibrary.Win32.Security
/// 1. The account is listed under the "Deny access to this computer from the network" list. /// 1. The account is listed under the "Deny access to this computer from the network" list.
/// 2. 'limitblankpassworduse' is set to 1, non-guest is attempting to login with an empty password, /// 2. 'limitblankpassworduse' is set to 1, non-guest is attempting to login with an empty password,
/// and the Guest account is disabled, has non-empty pasword set or listed under the "Deny access to this computer from the network" list. /// and the Guest account is disabled, has non-empty pasword set or listed under the "Deny access to this computer from the network" list.
///
/// Note: "If the Guest account is enabled, SSPI logon may succeed as Guest for user credentials that are not valid".
/// </summary> /// </summary>
/// <remarks> /// <remarks>
/// 1. 'limitblankpassworduse' will not affect the Guest account. /// 1. 'limitblankpassworduse' will not affect the Guest account.