{"id":13540240,"url":"https://github.com/evilmog/ntlmv1-multi","last_synced_at":"2025-04-02T07:30:46.262Z","repository":{"id":32117338,"uuid":"131620271","full_name":"evilmog/ntlmv1-multi","owner":"evilmog","description":"NTLMv1 Multitool","archived":false,"fork":false,"pushed_at":"2025-03-11T20:33:26.000Z","size":5217,"stargazers_count":612,"open_issues_count":0,"forks_count":97,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-03-26T21:44:59.662Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/evilmog.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-04-30T16:36:33.000Z","updated_at":"2025-03-23T15:31:41.000Z","dependencies_parsed_at":"2022-08-07T17:15:20.868Z","dependency_job_id":"fcd8caef-1bdd-463e-a909-0abd0745ce7a","html_url":"https://github.com/evilmog/ntlmv1-multi","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilmog%2Fntlmv1-multi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilmog%2Fntlmv1-multi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilmog%2Fntlmv1-multi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/evilmog%2Fntlmv1-multi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/evilmog","download_url":"https://codeload.github.com/evilmog/ntlmv1-multi/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246774216,"owners_count":20831494,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:43.344Z","updated_at":"2025-04-02T07:30:46.254Z","avatar_url":"https://github.com/evilmog.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"de81f9dd79c219c876c1313cd97852ce\"\u003e\u003c/a\u003e破解\u0026\u0026Crack\u0026\u0026爆破\u0026\u0026BruteForce","\u003ca id=\"73c3c9225523cbb05333246f23342846\"\u003e\u003c/a\u003e工具","Python"],"sub_categories":["\u003ca id=\"f2c76d99a0b1fda124d210bd1bbc8f3f\"\u003e\u003c/a\u003eWordlist生成","\u003ca id=\"53084c21ff85ffad3dd9ce445684978b\"\u003e\u003c/a\u003e未分类的"],"readme":"# NTLMv1 Multi Tool\nThis tool reverses NTLMv1 hashes to NTLM, or more specifically it formats NTLMv1 challenge responses into a format that can be cracked with hashcat mode 14000\n\n# CT3 calculation\nIf you specify `--ct3 1` it will calculate the the final 4 digits of the NTLM for you, if you specify `--json 1` then  `--ct3 1` is implied ansd it will return as the element pt3, eg:\n```\npython3 ntlmv1.py --ntlm \"DC1$::MOG:AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E:AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E:1122334455667788\" --json 1\n\n{\"ntlmv1\": \"DC1$::MOG:AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E:AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E:1122334455667788\", \"user\": \"DC1$\", \"domain\": \"MOG\", \"challenge\": \"1122334455667788\", \"lmresp\": \"AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E\", \"ntresp\": \"AC51EC464A91A35A04A862DA3106EC2B352661ECEF909C5E\", \"ct3\": \"352661ECEF909C5E\", \"ct3_crack\": \"ct3_to_ntlm.bin 352661ECEF909C5E 1122334455667788\", \"pt3\": \"8c71\", \"hash1\": \"AC51EC464A91A35A:1122334455667788\", \"hash2\": \"04A862DA3106EC2B:1122334455667788\"}\n```\n\nFinally in this update I have moved the functions into main() so that you can just import the module for direct use\n\n# 10 Nov, 2020 Updates\nI added 2 new options, `--hashcat` and `--hcutils` these set the path to your hashcat and hashcat-utils respectively so you can do a direct copy and paste from the tool.\n\nYou would run the tool like this if your hashcat directory was in ~/git/hashcat and your hashcat-utils directory was in ~/git/hashcat-utils:\n```\npython3 ./ntlmv1.py --ntlm \"SERVER1$::MOG:9DE7F41D81C1207400000000000000000000000000000000:DE766A98B60D1C911DCFFFDBB3E521314B2CE34EAB63CC7B:1122334455667788\" --hashcat \"~/git/hashcat\" --hcutils \"~/git/hashcat-utils\"\n```\n\n# Dec 10, 2019 Updates\nYes this is supposedly python 3 compatible, I have also merged ntlmv1 and ntlmv1-ess\n\n# ntlmv1-multi\nNTLMv1 Multitool\n\nThis tool modifies NTLMv1/NTLMv1-ESS/MSCHAPv2 hashes so they can be cracked with DES Mode 14000 in hashcat\n\nThis tool is based on work done by atom of team Hashcat https://hashcat.net/forum/thread-5832.html\n\nIt is also based on https://hashcat.net/forum/thread-5912.html and https://www.youtube.com/watch?v=LIHACAct2vo\n\n# Usage\n\n## NTLMv1 without ESS\nTo capture use responder with the --lm flag, without --lm you will activate ESS which will take longer to crack, also a new flag is out --disable-ess which will try to disable ESS and force the downgrade. Try --disable-ess first and if that fails please try --lm. If using --disable-ess or --lm ensure your client challenge is 1122334455667788 to use the FPGA, however this may trigger some network IDS/IPS protections if they see that traffic.\n\nThe capture will look like this.\n```\n[SMB] NTLMv1 Client   : 184.64.60.62\n[SMB] NTLMv1 Username : DUSTIN-5AA37877\\hashcat\n[SMB] NTLMv1 Hash     : hashcat::DUSTIN-5AA37877:76365E2D142B5612980C67D057EB9EFEEE5EF6EB6FF6E04D:727B4E35F947129EA52B9CDEDAE86934BB23EF89F50FC595:1122334455667788\n[*] Skipping previously captured hash for DUSTIN-5AA37877\\hashcat\n```\n\nThe hash portion looks like this\n```\nhashcat::DUSTIN-5AA37877:76365E2D142B5612980C67D057EB9EFEEE5EF6EB6FF6E04D:727B4E35F947129EA52B9CDEDAE86934BB23EF89F50FC595:1122334455667788\n```\n\nSo use the multi tool like so (its also python 2 compatible)\n```\npython3 ntlmv1.py --ntlmv1 hashcat::DUSTIN-5AA37877:76365E2D142B5612980C67D057EB9EFEEE5EF6EB6FF6E04D:727B4E35F947129EA52B9CDEDAE86934BB23EF89F50FC595:1122334455667788\n```\n\nIt will output the following data without modifing server challenges etc\n```\n['hashcat', '', 'DUSTIN-5AA37877', '76365E2D142B5612980C67D057EB9EFEEE5EF6EB6FF6E04D', '727B4E35F947129EA52B9CDEDAE86934BB23EF89F50FC595', '1122334455667788']\n\nHostname: DUSTIN-5AA37877\nUsername: hashcat\nChallenge: 1122334455667788\nLM Response: 76365E2D142B5612980C67D057EB9EFEEE5EF6EB6FF6E04D\nNT Response: 727B4E35F947129EA52B9CDEDAE86934BB23EF89F50FC595\nCT1: 727B4E35F947129E\nCT2: A52B9CDEDAE86934\nCT3: BB23EF89F50FC595\n\nTo Calculate final 4 characters of NTLM hash use:\n./ct3_to_ntlm.bin BB23EF89F50FC595 1122334455667788\n\nTo crack with hashcat create a file with the following contents:\n727B4E35F947129E:1122334455667788\nA52B9CDEDAE86934:1122334455667788\n\nTo crack with hashcat:\n./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1\n```\n\nThe password used in this case is \"password\" and we can verify the ntlm hash with\n```\necho -n password | iconv -f utf8 -t utf16le | openssl dgst -md4\n(stdin)= 8846f7eaee8fb117ad06bdd830b7586c\n```\n\nWith hashcat utils ct3_to_ntlm.bin that atom wrote you can calculate the last 4 characters of the NTLM hash from the NTLMv1 challenge, which the tool outputs\n```\n./ct3_to_ntlm.bin BB23EF89F50FC595 1122334455667788\n586c\n```\n\nThis matches up to the end of the ntlm hash so we are good to go, the next step is cracking the hashes with hashcat so we need to make a hashes.txt file with\n```\n727B4E35F947129E:1122334455667788\nA52B9CDEDAE86934:1122334455667788\n```\n\nTo crack this with hashcat you use\n```\n./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1\n```\n\nAn important note is that hashcat will return DES keys and not NTLM keys, you will need to convert to NTLM using `deskey_to_ntlm.pl` from [Hashcat Utils](https://github.com/hashcat/hashcat-utils/releases/), this can be accomplished with\n```\n./deskey_to_ntlm.pl [cracked des key 1]\n./deskey_to_ntlm.pl [cracked des key 2]\n```\n\nyou then combine the two ntlm keys with the third part of the password. Calculated by (whatever the tool outputs)\n```\n./ct3_to_ntlm.bin BB23EF89F50FC595 1122334455667788\n```\n\nAdd those 3x together and you are good to go\n\n### Testing with the des converter\n\nIf you are just testing my code and know the password already you can use the des converter\n```\npython ntlm-to-des.py --ntlm b4b9b02e6f09a9bd760f388b67351e2b\nDESKEY1: b55d6d04e67926\nDESKEY2: bcba83e6895b9d\n\necho \"$HEX[b55d6d04e67926]\"\u003e\u003edes.cand\necho \"$HEX[bcba83e6895b9d]\"\u003e\u003edes.cand\n```\n\nBasically you do the following\n```\necho \"$HEX[b55d6d04e67926]\"\u003e\u003edes.cand\necho \"$HEX[bcba83e6895b9d]\"\u003e\u003edes.cand\n```\n\n```\n./hashcat -m 14000 -a 0 hashes.txt des.cand\n```\n\nAnd you should have some reversed hashes\n\n## NTLMv1 with ESS\nESS changes the server challenge, if you see ESS in your responder because you didn't use --lm or the client is set not to give out a LM response then ESS gets engaged. Also --disable-ess will try to force off ESS, however this requires a recent copy (August 2021 or more recent) of impacket and responder.\n\nThe ESS output looks like this\n```\n[SMB] NTLMv1-SSP Client   : 184.64.60.62\n[SMB] NTLMv1-SSP Username : DUSTIN-5AA37877\\hashcat\n[SMB] NTLMv1-SSP Hash     : hashcat::DUSTIN-5AA37877:85D5BC2CE95161CD00000000000000000000000000000000:892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0:1122334455667788\n```\n\nThe actual hash looks like this\n```\nhashcat::DUSTIN-5AA37877:85D5BC2CE95161CD00000000000000000000000000000000:892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0:1122334455667788\n```\n\nTo use the tool run (it is python3 compatible)\n```\npython3 ntlmv1.py --ntlmv1 \"hashcat::DUSTIN-5AA37877:85D5BC2CE95161CD00000000000000000000000000000000:892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0:1122334455667788\"\n```\n\nThe tool will output\n```\nHashfield Split:\n['hashcat', '', 'DUSTIN-5AA37877', '85D5BC2CE95161CD00000000000000000000000000000000', '892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0', '1122334455667788']\n\nHostname: DUSTIN-5AA37877\nUsername: hashcat\nLM Response: 85D5BC2CE95161CD00000000000000000000000000000000\nNT Response: 892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0\nClient Challenge: 1122334455667788\nSRV Challenge: b36d2b9a8607ea77\n\nTo Calculate final 4 characters of NTLM hash use:\n./ct3_to_ntlm.bin 2BBD6C9ABCD021D0 1122334455667788 85D5BC2CE95161CD00000000000000000000000000000000\n\nTo crack with hashcat create a file with the following contents:\n892F905962F76D32:b36d2b9a8607ea77\n3837F613F88DE27C:b36d2b9a8607ea77\n\nTo crack with hashcat:\n./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1\n\n```\n\nNow the password we are using in this case is password which has and ntlm hash of ```b4b9b02e6f09a9bd760f388b67351e2b```\n```\necho -n password | iconv -f utf8 -t utf16le | openssl dgst -md4\n(stdin)= 8846f7eaee8fb117ad06bdd830b7586c\n```\n\nSo to calculate the last 4 characters of the ntlm hash for our NTLMv1-ESS chalenge we use the following command from the tool output to get ```586c```\n```\n./ct3_to_ntlm.bin 2BBD6C9ABCD021D0 1122334455667788 85D5BC2CE95161CD00000000000000000000000000000000\n```\n\nWe must make a hash file with the following content according to the tool which has the modified SRV Challenges to deal with ESS\n```\n892F905962F76D32:b36d2b9a8607ea77\n3837F613F88DE27C:b36d2b9a8607ea77\n```\n\nTo crack with hashcat we use the following according to the tool\n```\n./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset hashes.txt ?1?1?1?1?1?1?1?1\n```\n\n\nAn important note is that hashcat will return DES keys and not NTLM keys, you will need to convert to NTLM using `deskey_to_ntlm.pl` from [Hashcat Utils](https://github.com/hashcat/hashcat-utils/releases/), this can be accomplished with\n```\n./deskey_to_ntlm.pl [cracked des key 1]\n./deskey_to_ntlm.pl [cracked des key 2]\n```\n\nNow assuming we already knew what the ntlm hash was in the case because we made it and want to validate the tooling we use the following\n```\npython ntlm-to-des.py --ntlm b4b9b02e6f09a9bd760f388b67351e2b\n```\n\nThis will output some data for us\n```\nDESKEY1: b55d6d04e67926\nDESKEY2: bcba83e6895b9d\n\necho \"$HEX[b55d6d04e67926]\"\u003e\u003edes.cand\necho \"$HEX[bcba83e6895b9d]\"\u003e\u003edes.cand\n```\n\nThe important part here is\n```\necho \"$HEX[b55d6d04e67926]\"\u003e\u003edes.cand\necho \"$HEX[bcba83e6895b9d]\"\u003e\u003edes.cand\n```\n\nNow we can crack with hashcat using the following and not waiting 8 days\n```\n./hashcat -m 14000 -a 0 hashes.txt des.cand\n```\n\n## NTLM hash to DES Key Converter for data validation testing\n```\npython ntlm-to-des.py  --ntlm 8846f7eaee8fb117ad06bdd830b7586c\n```\n```\nDESKEY1: b55d6d05e6792652\nDESKEY2: bdba82e6895a9d6a\n\necho \"$HEX[b55d6d05e6792652]\"\u003e\u003edes.cand\necho \"$HEX[bdba82e6895a9d6a]\"\u003e\u003edes.cand\n```\n\n## JSON Support\nThe tool now supports json output, set the flag `--json 1` and it will output json output:\n\n```\npython3 ntlmv1.py --ntlmv1 \"SERVER1$::MOG:7EF3F506F5EA510E00000000000000000000000000000000:1217169BD7BE0270A033899BD440016D3E6DACAF5894D504:ff81dfd6b12c269d\" --json 1\n{\"ntlmv1\": \"SERVER1$::MOG:7EF3F506F5EA510E00000000000000000000000000000000:1217169BD7BE0270A033899BD440016D3E6DACAF5894D504:ff81dfd6b12c269d\", \"user\": \"SERVER1$\", \"domain\": \"MOG\", \"challenge\": \"ff81dfd6b12c269d\", \"lmresp\": \"7EF3F506F5EA510E00000000000000000000000000000000\", \"ntresp\": \"1217169BD7BE0270A033899BD440016D3E6DACAF5894D504\", \"ct3\": \"3E6DACAF5894D504\", \"srvchallenge\": \"888f8ee0fa031808\", \"ct3_crack\": \"ct3_to_ntlm.bin 3E6DACAF5894D504 ff81dfd6b12c269d 7EF3F506F5EA510E00000000000000000000000000000000\", \"hash1\": \"1217169BD7BE0270:888f8ee0fa031808\", \"hash2\": \"A033899BD440016D:888f8ee0fa031808\", \"CRACK_SH\": \"$NETLM$888f8ee0fa031808$1217169BD7BE0270A033899BD440016D3E6DACAF5894D504\"}\n```\n\nThe important fields are:\n* hash1 - this is the first hash for hashcat mode 14000\n* hash2 - this is the second hash for hashcat mode 14000\n* ct3_crack - this is the command to crack ct3 using hashcat utils\n* ntlmv1 - hthis is the original ntlmv1 hash\n* user - this is the user field\n* domain - this is the domain field\n* lmresp - this is the lm response\n* ntresp - this is the nt response\n* challenge - this is the original challenge field\n* srvchallenge - if this is an ESS hash the srv challenge gets populated\n\n# Acknowledgement / License\nThis repo is based on forum posts by atom the author of hashcat and research by moxie marlinspike. as atoms code is largely MIT licensed this project has also adopted that license to be compatible. This project is not GPL so that any entity can incorporate it into a commercial project without restrictions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevilmog%2Fntlmv1-multi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fevilmog%2Fntlmv1-multi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fevilmog%2Fntlmv1-multi/lists"}