Crate ntlmssp 

NTLM (MS-NLMP) — the impacket ntlm equivalent. Implements NTLMSSP NEGOTIATE / CHALLENGE / AUTHENTICATE with NTLMv2, key exchange, and the MIC, so it can drive both authenticated DCE/RPC and SMB session setup.

Crypto: NT hash = MD4(UTF-16LE(password)); NTOWFv2 = HMAC-MD5(NT, UPPER(user)+domain); NTLMv2 response = NTProofStr || temp. Verified against the MS-NLMP §4.2.4 test vector.

Modules

flags

Structs

Challenge

Parsed CHALLENGE (Type 2).

Ntlm

NTLM client: holds the NEGOTIATE message so the MIC can bind all three messages.

Rc4

RC4 stream cipher (ARCFOUR) — used for NTLM sealing.

SealState

NTLM message-confidentiality state for connection-oriented DCE/RPC (auth_level PKT_PRIVACY). Derives the four directional keys from the exported session key (Extended Session Security, no key exchange) and applies RC4 seal + HMAC-MD5 sign with independent per-direction sequence numbers, per MS-NLMP §3.4.3/§3.4.4.

Enums

NtlmError

Constants

CAPTURE_CHALLENGE

The classic fixed server challenge — makes captured NetNTLMv2 hashes usable with precomputed/rainbow attacks and is the Responder default.

Functions

build_challenge

Build an NTLM CHALLENGE (Type 2) advertising our server challenge and a synthetic target info. The client’s NTLMv2 proof is computed over this, so any well-formed target info yields a crackable hash (hashcat recomputes over the echoed blob).

md4

MD4 over raw bytes — the NT hash of already-encoded material (e.g. a gMSA managed password).

netntlmv2_from_type3

Parse an AUTHENTICATE (Type 3) and format the NetNTLMv2 for hashcat -m 5600: user::domain:serverChallenge:NTProofStr:blob.

nt_owf_v2

NTOWFv2 = HMAC-MD5(NT-hash, UTF-16LE(UPPER(user) + domain)).

nt_owf_v2_from_hash

NTOWFv2 straight from an existing NT hash — the pass-the-hash entry point.

parse_challenge