Greenwolf/ntlm_theft

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1470 stars · 176 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ntlm_theft is a Python3 CLI tool that generates 21 different types of NTLMv2 hash theft files (e.g., .url, .scf, .docx, .pdf, .jnlp) that trigger SMB authentication when opened by a target. It is designed for penetration testers and red teamers to capture NTLMv2 hashes via a hash capture server such as Responder or impacket-smbserver.

Use cases

• generate NTLMv2 hash theft files for internal phishing during a penetration test
• capture NTLMv2 hashes from employees who open malicious documents
• mass test antivirus and email gateway detection of hash theft file types
• create phishing payloads for targets with outbound SMB access
• quickly enumerate which file types can trigger NTLM authentication on Windows
• generate .url, .lnk, .docx, .xlsx, and .pdf files that leak NTLMv2 hashes to an SMB capture server

When to choose

• you are a penetration tester or red teamer performing internal phishing engagements
• you need to capture NTLMv2 hashes from Windows hosts via SMB
• you want to test email gateways or antivirus against hash theft file types
• you need a quick way to generate many hash theft file variants at once

When to avoid

• you need a stealthy, fully undetectable red team tool - many generated file types are known signatures
• you are looking for a defensive detection tool rather than an offensive generator
• your target environment blocks all outbound SMB traffic and you are not on the internal network
• you need macro-based or exploit-based document attacks rather than 'intended functionality' techniques

Facets

cli-tool · maturity active

security penetration-testing cli security penetration-testing developer-tools python cli cross-platform ntlmv2 hash-theft red-team phishing smb responder offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Greenwolf/ntlm_theft")