tspkg - EvanMcBroom/lsa-whisperer GitHub Wiki

Terminal Services Package

The tspkg authentication package (AP) supports authenticating to a Remote Desktop server, formally known as terminal services. The tspkg package does not implement any security protocol but instead uses the credssp package to facilitate communication between a client and server.

Table of Contents

Functions

Protocal messages were only added to tspkg in NT 10 to support the "Remote Desktop Protocol Authentication Redirection Virtual Channel" (MS-RDPEAR), more commonly known as Remote Credential Guard. MS-RDPEAR messages are sent from a server to a client over an established RDP session. These messages allow a server to authenticate a client to networked resources without the client sending the server certain credential material.

Clients will begin processing any recieved MS-RDPEAR messages as a normal package call to tspkg. The tskpg package will first validate the message and then forward it to another AP for further processing. The APs a message may be forwarded to and the commands they support are documented by Microsoft and provided here for convenience.

Id Message Type CLI Support RDPEAR Version Internal Function

0x100

KerbNegotiateVersion

All

HandleNegotiateVersion

0x101

KerbBuildAsReqAuthenticator

All

HandleBuildAsReqAuthenticator

0x102

KerbVerifyServiceTicket

All

HandleVerifyServiceTicket

0x103

KerbCreateApReqAuthenticator

All

HandleCreateApReqAuthenticator

0x104

KerbDecryptApReply

All

HandleDecryptApReply

0x105

KerbUnpackKdcReplyBody

All

HandleUnpackKdcReplyBody

0x106

KerbComputeTgsChecksum

All

HandleComputeTgsChecksum

0x107

KerbBuildEncryptedAuthData

All

HandleBuildEncryptedAuthData

0x108

KerbPackApReply

All

HandlePackApReply

0x109

KerbHashS4UPreauth

➖

❔

Not identified

0x10A

KerbSignS4UPreauthData

➖

❔

Not identified

0x10B

KerbVerifyChecksum

All

HandleVerifyChecksum

0x113

KerbDecryptPacCredentials

All

HandleDecryptPacCredentials

0x114

KerbCreateECDHKeyAgreement

❌

⇐4.0

Not identified

0x115

KerbCreateDHKeyAgreement

❌

⇐4.0

Not identified

0x116

KerbDestroyKeyAgreement

❌

⇐4.0

Not identified

0x117

KerbKeyAgreementGenerateNonce

❌

⇐4.0

Not identified

0x118

KerbFinalizeKeyAgreement

❌

⇐4.0

Not identified

0x200

NtlmNegotiateVersion

All

HandleDecryptPacCredentials

0x201 (⇐5.0)

NtlmProtectCredential

❌

⇐5.0

ProtectCredential

0x202 (⇐5.0) 0x201 (>6.0)

NtlmLm20GetNtlm3ChallengeResponse

All

Lm20GetNtlm3ChallengeResponse

0x203 (⇐5.0) 0x202 (>6.0)

NtlmCalculateNtResponse

All

CalculateNtResponse

0x204 (⇐5.0) 0x203 (>6.0)

NtlmCalculateUserSessionKeyNt

All

CalculateUserSessionKeyNt

0x205 (⇐5.0) 0x204 (>6.0)

NtlmCompareCredentials

All

CompareCredentials
✏️
 The internal function for each message type will be located in kerberos.dll or msv1_0.dll.
⚠️ **GitHub.com Fallback** ⚠️