diff --git a/package-lock.json b/package-lock.json index caf335de9b..693c3b28b8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -39,7 +39,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.14", + "dompurify": "^3.4.15", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -65,7 +65,7 @@ "jsonwebtoken": "9.0.3", "jsqr": "^1.4.0", "jsrsasign": "^11.1.5", - "kbpgp": "^2.1.18", + "kbpgp": "^2.1.19", "libbzip2-wasm": "0.0.4", "libyara-wasm": "^1.2.1", "lodash": "^4.18.1", @@ -73,7 +73,7 @@ "loglevel-message-prefix": "^3.0.0", "lz-string": "^1.5.0", "lz4js": "^0.2.0", - "markdown-it": "^14.3.0", + "markdown-it": "^14.3.1", "moment": "^2.30.1", "moment-timezone": "^0.6.3", "ngeohash": "^0.6.4", @@ -84,7 +84,7 @@ "ntlm": "^0.1.3", "nwmatcher": "^1.4.4", "openpgp": "^6.3.1", - "otpauth": "^9.5.0", + "otpauth": "^9.5.2", "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", @@ -118,22 +118,22 @@ "@babel/runtime": "^8.0.0", "@codemirror/commands": "^6.11.0", "@codemirror/language": "^6.12.4", - "@codemirror/search": "^6.7.1", - "@codemirror/state": "^6.7.1", - "@codemirror/view": "^6.43.9", - "@puppeteer/browsers": "3.2.1", - "autoprefixer": "^10.5.4", + "@codemirror/search": "^6.7.2", + "@codemirror/state": "^6.7.4", + "@codemirror/view": "^6.43.11", + "@puppeteer/browsers": "3.2.2", + "autoprefixer": "^10.5.5", "babel-loader": "^10.1.1", "babel-plugin-polyfill-corejs3": "^1.0.0", "base64-loader": "^1.0.0", - "chromedriver": "152.0.2", + "chromedriver": "152.0.3", "cli-progress": "^3.12.0", "colors": "^1.4.0", "compression-webpack-plugin": "^12.0.0", "copy-webpack-plugin": "^14.0.0", "core-js": "^3.50.0", "cspell": "^10.2.2", - "css-loader": "^7.1.4", + "css-loader": "^7.1.5", "eslint": "^10.8.1", "eslint-plugin-jsdoc": "^64.2.1", "glob": "^13.0.6", @@ -154,7 +154,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.26", + "postcss": "^8.5.28", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.2.0", "postcss-loader": "^8.2.1", @@ -1919,9 +1919,9 @@ } }, "node_modules/@codemirror/search": { - "version": "6.7.1", - "resolved": "https://registry.npmjs.org/@codemirror/search/-/search-6.7.1.tgz", - "integrity": "sha512-uMe5UO6PamJtSHrXhhHOzSX3ReWtiJrva6GnPMwSOrZtiExb5X5eExhr2OUZQVvdxPsKpY3Ro2mFbQadpPWmHA==", + "version": "6.7.2", + "resolved": "https://registry.npmjs.org/@codemirror/search/-/search-6.7.2.tgz", + "integrity": "sha512-gUYkYhT2+n/+VGZ+8EzE5WFkYZUZYm1VOKDudIsNqh42uRVQJ0a6Yss9sdKT3MeOYfuL1N6AZA57oza0Oyr0LA==", "dev": true, "license": "MIT", "dependencies": { @@ -1931,9 +1931,9 @@ } }, "node_modules/@codemirror/state": { - "version": "6.7.1", - "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.7.1.tgz", - "integrity": "sha512-9QzNDgE4EYDnAHfrTlR2lwiPciiOymLtwKK+8yHQzCc7GXhAP9xdEbEJFy2IWB1j9UGUl9BsgMmTo/ImA02T7A==", + "version": "6.7.4", + "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.7.4.tgz", + "integrity": "sha512-QhQIVRY+xHZDxwOSFrJ1eUMapJBUID3IdeAjf7dHO7zBUzSkyooHiodnalz5MG3iHzwixKMlAAyn7244y537EA==", "dev": true, "license": "MIT", "dependencies": { @@ -1941,9 +1941,9 @@ } }, "node_modules/@codemirror/view": { - "version": "6.43.9", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.9.tgz", - "integrity": "sha512-sTuUzTpPMFebRhg6dawChoKKgndIwfjmJgKVxBefPElcU2NwQ6AFroupk0SFqEerQyZOGRfDNnSN8Dw/lMAsXw==", + "version": "6.43.11", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.11.tgz", + "integrity": "sha512-2+esucbQX6wB2JYi1eDvdCPFTA31BN8oSy6xCmk3G6CloV11yOvEjYk+gH7kLrP0MuHG94E8WDhjs5oMiu3+Wg==", "dev": true, "license": "MIT", "dependencies": { @@ -4564,13 +4564,13 @@ "license": "MIT" }, "node_modules/@puppeteer/browsers": { - "version": "3.2.1", - "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.2.1.tgz", - "integrity": "sha512-KDz+3qDRdBAlRlMjmKyj6dEs33YHTk/xRHEENSXq6TNnhgoU15ruSHtEBeVF6OZ9tBDY55Se4P0nFMNsipzU9A==", + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.2.2.tgz", + "integrity": "sha512-q2BU4YfO9h/Wt7IcWPcggpOOqLk2Tbs1hDwolvKZrweRjy751OJBKMN9zO5bfD0pzU7X/tvKw/exQds4pM/LOg==", "dev": true, "license": "Apache-2.0", "dependencies": { - "modern-tar": "^0.8.0", + "modern-tar": "^0.8.4", "yargs": "^18.0.0" }, "bin": { @@ -5810,9 +5810,9 @@ "license": "MIT" }, "node_modules/autoprefixer": { - "version": "10.5.4", - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.4.tgz", - "integrity": "sha512-MaU0U/za7N3r6brxD4YB/l4NSrFzLPlANv6wEuQVaIPlD3L4W9rFcQPbL/EilY9BHhHvhfcz3gInDLrEtWT4EA==", + "version": "10.5.5", + "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.5.tgz", + "integrity": "sha512-uiRYvQYe/nNSzBJ7OUnd2/TZVsAdob3blml44teEpee9Cc1f4rGZFewO+JT3Wo8mgFOSzNqes4FHZn/Qz8WOuw==", "dev": true, "funding": [ { @@ -5830,8 +5830,8 @@ ], "license": "MIT", "dependencies": { - "browserslist": "^4.28.6", - "caniuse-lite": "^1.0.30001806", + "browserslist": "^4.28.9", + "caniuse-lite": "^1.0.30001810", "fraction.js": "^5.3.4", "picocolors": "^1.1.1", "postcss-value-parser": "^4.2.0" @@ -6025,9 +6025,9 @@ "license": "MIT" }, "node_modules/baseline-browser-mapping": { - "version": "2.11.1", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.1.tgz", - "integrity": "sha512-HYXq73DDpCtNzOmrFsm9eSwCvWCql0RzqjpDzXN9EadiLJ4DNat0nsZ/Bzmy+Ud12mb4/zKDY0cQ805ZzN+i0A==", + "version": "2.11.21", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", + "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==", "dev": true, "license": "Apache-2.0", "bin": { @@ -6559,9 +6559,9 @@ } }, "node_modules/browserslist": { - "version": "4.28.7", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz", - "integrity": "sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==", + "version": "4.28.9", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz", + "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==", "dev": true, "funding": [ { @@ -6579,11 +6579,11 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.44", - "caniuse-lite": "^1.0.30001806", - "electron-to-chromium": "^1.5.393", - "node-releases": "^2.0.51", - "update-browserslist-db": "^1.2.3" + "baseline-browser-mapping": "^2.11.20", + "caniuse-lite": "^1.0.30001810", + "electron-to-chromium": "^1.5.420", + "node-releases": "^2.0.54", + "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" @@ -6774,9 +6774,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001806", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz", - "integrity": "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==", + "version": "1.0.30001810", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz", + "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==", "dev": true, "funding": [ { @@ -6916,9 +6916,9 @@ } }, "node_modules/chromedriver": { - "version": "152.0.2", - "resolved": "https://registry.npmjs.org/chromedriver/-/chromedriver-152.0.2.tgz", - "integrity": "sha512-w/trjzSjQC8vHHwl4e+WXBGPRN3XnrsY14q/FdxCY8GtTUIlB+wH1gn/Kz3CHpdmbsouUEGal6E8bjEEz72pZg==", + "version": "152.0.3", + "resolved": "https://registry.npmjs.org/chromedriver/-/chromedriver-152.0.3.tgz", + "integrity": "sha512-6v3pquS2kgb1HedzALRZeaoFZVCgghW2u1QjlzaoZruw75QBxKQtv/PKzJ8Scb3L8Vx32gcFwvUKcHmW7xjIVg==", "dev": true, "hasInstallScript": true, "license": "Apache-2.0", @@ -7941,9 +7941,9 @@ } }, "node_modules/css-loader": { - "version": "7.1.4", - "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-7.1.4.tgz", - "integrity": "sha512-vv3J9tlOl04WjiMvHQI/9tmIrCxVrj6PFbHemBB1iihpeRbi/I4h033eoFIhwxBBqLhI0KYFS7yvynBFhIZfTw==", + "version": "7.1.5", + "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-7.1.5.tgz", + "integrity": "sha512-Q7iAfQkU2twNBryKX/vGAlE+GAmkF7quhSzAGNK8fBimxk3+tqg245rH52UPb9dioBolBc8rP0ihmHBaDTJQBA==", "dev": true, "license": "MIT", "dependencies": { @@ -8908,9 +8908,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.14", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz", - "integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==", + "version": "3.4.15", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz", + "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -9015,9 +9015,9 @@ } }, "node_modules/electron-to-chromium": { - "version": "1.5.396", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.396.tgz", - "integrity": "sha512-yHiw2Y3C3H9U6TMbOfoWK/BPreiOPXRfTWPBwQBoZG6/8TB6eOPnsy5oaRYuatR7Fw2SJ4kKforgufeo7fq0EQ==", + "version": "1.5.422", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.422.tgz", + "integrity": "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==", "dev": true, "license": "ISC" }, @@ -13086,9 +13086,9 @@ } }, "node_modules/kbpgp": { - "version": "2.1.18", - "resolved": "https://registry.npmjs.org/kbpgp/-/kbpgp-2.1.18.tgz", - "integrity": "sha512-kbvGTlBMkGc+nK5dm1FXW1QVI4e9CIchLY2B9fgLjKwtdZ9OHXwJxvutSBxSJ0nzerAstdxahg7VD1EwmT4gYA==", + "version": "2.1.19", + "resolved": "https://registry.npmjs.org/kbpgp/-/kbpgp-2.1.19.tgz", + "integrity": "sha512-JCs+fljGBPohlD0zySPVoIxSn1pf85uWcQaT7MCJ50QLHuEov0U/kjy7ccDPfILuJ60SMARM5eLZBh0tNgsHeA==", "license": "BSD-3-Clause", "dependencies": { "bn": "^1.0.5", @@ -13564,9 +13564,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.0", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz", - "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==", + "version": "14.3.1", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.1.tgz", + "integrity": "sha512-4Ej49aYTDFIQ+uBkfX8GBvJGccoARxxPep+7aWTs55ozbjQJpW9M26Fe53vnGgvLeVzva/amzjQQaQu9w0vMhA==", "funding": [ { "type": "github", @@ -14508,9 +14508,9 @@ "license": "CC0-1.0" }, "node_modules/node-releases": { - "version": "2.0.51", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz", - "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==", + "version": "2.0.54", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz", + "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==", "dev": true, "license": "MIT", "engines": { @@ -14942,29 +14942,17 @@ } }, "node_modules/otpauth": { - "version": "9.5.1", - "resolved": "https://registry.npmjs.org/otpauth/-/otpauth-9.5.1.tgz", - "integrity": "sha512-fJmDAHc8wImfqqqOXIlBvT1dEKrZK0Cmb2VEgScpNTolCz0PHh6ExUZGv4sLtOsWNaHCQlD+rRqaPgnoxFoZjQ==", + "version": "9.5.2", + "resolved": "https://registry.npmjs.org/otpauth/-/otpauth-9.5.2.tgz", + "integrity": "sha512-GQ5emWR/x1tcExT62IBT0UfO95wZzJZyxYOJOGVeQF47SYEN9vmh0vISvDZaNMuFJRG+IaWCKtfm+t9Bfoal6w==", "license": "MIT", "dependencies": { - "@noble/hashes": "2.2.0" + "@noble/hashes": "2.4.0" }, "funding": { "url": "https://github.com/hectorm/otpauth?sponsor=1" } }, - "node_modules/otpauth/node_modules/@noble/hashes": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz", - "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==", - "license": "MIT", - "engines": { - "node": ">= 20.19.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/p-limit": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz", @@ -15575,9 +15563,9 @@ } }, "node_modules/postcss": { - "version": "8.5.26", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", - "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", + "version": "8.5.28", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz", + "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==", "dev": true, "funding": [ { @@ -15595,7 +15583,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.17", + "nanoid": "^3.3.18", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -18489,9 +18477,9 @@ } }, "node_modules/update-browserslist-db": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz", - "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==", + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz", + "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index a6c22338de..9a977559f7 100644 --- a/package.json +++ b/package.json @@ -45,22 +45,22 @@ "@babel/runtime": "^8.0.0", "@codemirror/commands": "^6.11.0", "@codemirror/language": "^6.12.4", - "@codemirror/search": "^6.7.1", - "@codemirror/state": "^6.7.1", - "@codemirror/view": "^6.43.9", - "@puppeteer/browsers": "3.2.1", - "autoprefixer": "^10.5.4", + "@codemirror/search": "^6.7.2", + "@codemirror/state": "^6.7.4", + "@codemirror/view": "^6.43.11", + "@puppeteer/browsers": "3.2.2", + "autoprefixer": "^10.5.5", "babel-loader": "^10.1.1", "babel-plugin-polyfill-corejs3": "^1.0.0", "base64-loader": "^1.0.0", - "chromedriver": "152.0.2", + "chromedriver": "152.0.3", "cli-progress": "^3.12.0", "colors": "^1.4.0", "compression-webpack-plugin": "^12.0.0", "copy-webpack-plugin": "^14.0.0", "core-js": "^3.50.0", "cspell": "^10.2.2", - "css-loader": "^7.1.4", + "css-loader": "^7.1.5", "eslint": "^10.8.1", "eslint-plugin-jsdoc": "^64.2.1", "glob": "^13.0.6", @@ -81,7 +81,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.26", + "postcss": "^8.5.28", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.2.0", "postcss-loader": "^8.2.1", @@ -124,7 +124,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.14", + "dompurify": "^3.4.15", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -150,7 +150,7 @@ "jsonwebtoken": "9.0.3", "jsqr": "^1.4.0", "jsrsasign": "^11.1.5", - "kbpgp": "^2.1.18", + "kbpgp": "^2.1.19", "libbzip2-wasm": "0.0.4", "libyara-wasm": "^1.2.1", "lodash": "^4.18.1", @@ -158,7 +158,7 @@ "loglevel-message-prefix": "^3.0.0", "lz-string": "^1.5.0", "lz4js": "^0.2.0", - "markdown-it": "^14.3.0", + "markdown-it": "^14.3.1", "moment": "^2.30.1", "moment-timezone": "^0.6.3", "ngeohash": "^0.6.4", @@ -169,7 +169,7 @@ "ntlm": "^0.1.3", "nwmatcher": "^1.4.4", "openpgp": "^6.3.1", - "otpauth": "^9.5.0", + "otpauth": "^9.5.2", "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", @@ -198,7 +198,7 @@ }, "allowScripts": { "@nightwatch/nightwatch-inspector@1.0.1": true, - "chromedriver@152.0.2": true, + "chromedriver@152.0.3": true, "core-js": false, "core-js-pure": false, "fsevents": false, diff --git a/src/core/operations/LMHash.mjs b/src/core/operations/LMHash.mjs index 2bedf0e856..8deed8f297 100644 --- a/src/core/operations/LMHash.mjs +++ b/src/core/operations/LMHash.mjs @@ -7,6 +7,12 @@ import Operation from "../Operation.mjs"; import {smbhash} from "ntlm"; +/** + * The LAN Manager hashing algorithm only uses the first 14 characters of the + * uppercased password. + */ +const LM_HASH_MAX_LENGTH = 14; + /** * LM Hash operation */ @@ -33,7 +39,14 @@ class LMHash extends Operation { * @returns {string} */ run(input, args) { - return smbhash.lmhash(input); + // Uppercase *before* truncating to 14 characters. Some characters + // expand when uppercased (e.g. "ß" -> "SS"), and the underlying ntlm + // library truncates first and then uppercases into a fixed 14-byte + // buffer, overflowing it and throwing a RangeError for such inputs + // (#1807). Normalising here preserves the library's 14-byte invariant + // and leaves every ASCII input's hash unchanged. + const password = input.toUpperCase().slice(0, LM_HASH_MAX_LENGTH); + return smbhash.lmhash(password); } } diff --git a/tests/operations/tests/NTLM.mjs b/tests/operations/tests/NTLM.mjs index 6dfa704c7d..362b5f890c 100644 --- a/tests/operations/tests/NTLM.mjs +++ b/tests/operations/tests/NTLM.mjs @@ -30,5 +30,23 @@ TestRegister.addTests([ }, ], }, + { + // #1807: bytes that expand when uppercased (e.g. 0xDF -> "SS") used to + // overflow the library's fixed 14-byte buffer and throw a RangeError, + // which also broke the "Generate all hashes" operation. + name: "LM Hash: input with characters that expand when uppercased", + input: "cf df 26 2e 2d 2b 2c 30 21 25 21 53 28 2a", + expectedOutput: "98C1A4EB163B98D8DB93DECF17002EEE", + recipeConfig: [ + { + op: "From Hex", + args: ["Auto"], + }, + { + op: "LM Hash", + args: [], + }, + ], + }, ]);