NTLMCrack

Use ntlm.pw (by @lkarlslund) to automatically convert hash dumps to credentials

Features

• Lookup cracked NTLM hashes straight from hashdump (hashcat format)
• Split cracked hashes into 2 separate files with -s
• Filter uncracked hashes with -f
• Import hashes directly from NetExec nxcdb with -X

Demo

Should I Use This?

If this is a lab environment without any sensitive passwords, then sure.

Otherwise, read here

Usage

usage: NTLMCrack [-h] [-X [WORKSPACE]] [-s] [-o OUTPUT] [-n LIMIT] [-f]
                 [--timeout TIMEOUT] [--version]
                 [file_path]

Use ntlm.pw to convert NTLM hash dumps to credentials

positional arguments:
  file_path             Path to a pwdump-format hash file

options:
  -h, --help            show this help message and exit
  -X [WORKSPACE], --nxc [WORKSPACE]
                        Read hashes from NetExec (uses the selected workspace
                        when omitted)
  -s, --separate-files  Write users and passwords to separate files
  -o OUTPUT, --output OUTPUT
                        Output path (default: credentials); with --separate-
                        files, a prefix for <prefix>.users and
                        <prefix>.passwords
  -n LIMIT, --limit LIMIT
                        Read at most the first N input lines or NetExec rows
  -f, --filter-not-found
                        Do not write credentials that ntlm.pw could not
                        resolve
  --timeout TIMEOUT     HTTP timeout in seconds (default: 30)
  --version             show program's version number and exit

Installation

Requires Python 3.11 or newer.

• With pipx:

pipx install git+https://github.com/Adamkadaban/NTLMCrack

Examples

Output to one file:

NTLMCrack example_hashes/hashes -n 100

Output to separate files:

NTLMCrack example_hashes/hashes -n 100 -s

Filter hashes that can't be cracked:

NTLMCrack example_hashes/hashes -f

Import hashes from current NetExec workspace:

NTLMCrack -X

Import hashes from specified NetExec workspace:

NTLMCrack -X GOAD