eladshamir/Internal-Monologue

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1681 stars · 238 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C# post-exploitation tool that retrieves NTLM hashes by inducing NetNTLM challenge-response computations in-process, without touching the LSASS process. It is designed to bypass Credential Guard and evade endpoint protection that targets Mimikatz.

Use cases

• retrieve ntlm hashes without touching lsass
• bypass credential guard on windows 10
• extract credentials while evading antivirus detection of mimikatz
• capture netntlmv1 responses to crack ntlm hashes offline
• red team credential dumping on windows hosts

When to choose

• you need NTLM hashes on a Credential Guard-protected Windows host
• you want a lightweight in-memory credential extraction that avoids LSASS access
• you are doing authorized red team or penetration testing on Windows environments

When to avoid

• you need a general-purpose post-exploitation suite beyond NTLM hash retrieval
• you require a maintained tool with an active license and ongoing support
• your target systems force NetNTLMv2 with no downgrade, limiting crackability

Facets

cli-tool · maturity maintenance

security penetration-testing cryptography security penetration-testing windows windows cli ntlm credential-harvesting red-team lsass netntlm post-exploitation credential-guard-bypass

Member repositories

For agents

markdown · JSON · MCP: product_card(name="eladshamir/Internal-Monologue")