ntlmssp 0.1.0

Pure-Rust NTLM / NTLMSSP (MS-NLMP): NEGOTIATE/CHALLENGE/AUTHENTICATE with NTLMv2, the MIC, key exchange, and RC4 sign+seal — no FFI. Drives SMB/HTTP/DCE-RPC auth from any platform.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# ntlmssp

[![crates.io](https://img.shields.io/crates/v/ntlmssp.svg)](https://crates.io/crates/ntlmssp)
[![docs.rs](https://img.shields.io/docsrs/ntlmssp)](https://docs.rs/ntlmssp)
[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

A pure-Rust, **no-FFI** implementation of Windows NTLM / NTLMSSP (MS-NLMP): the
NEGOTIATE / CHALLENGE / AUTHENTICATE token exchange with **NTLMv2**, the message-integrity
code (MIC), key exchange, and **RC4 sign+seal** for message privacy. No `windows` crate, no
SSPI — so you can perform NTLM authentication from Linux/macOS to drive SMB, HTTP, or
DCE/RPC.

## Features

- Build the three NTLMSSP messages (Type 1/2/3) with NTLMv2, target-info, and the MIC.
- Authenticate from a **password** or directly from an **NT hash** (pass-the-hash).
- `SealState`: RC4-based per-message sign+seal (the sealed-RPC / packet-privacy primitive),
  with directional keys derived from the exported session key.
- Parse a server CHALLENGE (Type 2) into its fields (server challenge, target info).
- Crypto building blocks: `md4`, `nt_owf_v2`, and a NetNTLMv2 extractor
  (`netntlmv2_from_type3`) that yields a hashcat `-m 5600` string from a captured Type 3.
- Verified against the MS-NLMP §4.2.4 NTLMv2 test vector.

## Example

```rust
use ntlmssp::Ntlm;

let mut ntlm = Ntlm::new();
let type1 = ntlm.negotiate();                    // → send to server
// ... receive the server's Type 2 CHALLENGE bytes ...
let (type3, session_key) =
    ntlm.authenticate(&challenge, "CORP", "alice", "P@ssw0rd", "FILESERVER")?;
// send `type3`; use `session_key` for SMB/RPC signing.
```

Pass-the-hash:

```rust
let (type3, session_key) =
    ntlm.authenticate_hash(&challenge, "CORP", "alice", &nt_hash, "FILESERVER")?;
```

## Scope

Client-side NTLMSSP (NTLMv2) + the sign/seal state machine, plus enough server-side helpers
(`build_challenge`, `netntlmv2_from_type3`) to stand up a capture/relay endpoint. NTLMv1 and
LM responses are intentionally not produced (NTLMv2 only).

## License

MIT © icedracon. Extracted from [ADhammer](https://github.com/icedracon/adhammer).