# Greenwolf/ntlm_theft

A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

Repository: https://github.com/Greenwolf/ntlm_theft
Canonical: https://ross.abutalabs.com/products/ntlm_theft
Language: Python
License: GPL-3.0
License Family: copyleft
Last push: 2025-09-22T14:28:27+00:00

## Health v2 (maintenance only)
Score: 52/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 43, release rhythm 35, longevity 100
- inputs: {"age_days": 2276, "days_push": 345, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1470, forks 176 (observed 2026-08-28T04:04:49.206047+00:00)

## What it is
ntlm_theft is a Python3 CLI tool that generates 21 different types of NTLMv2 hash theft files (e.g., .url, .scf, .docx, .pdf, .jnlp) that trigger SMB authentication when opened by a target. It is designed for penetration testers and red teamers to capture NTLMv2 hashes via a hash capture server such as Responder or impacket-smbserver.

## Use cases
- generate NTLMv2 hash theft files for internal phishing during a penetration test
- capture NTLMv2 hashes from employees who open malicious documents
- mass test antivirus and email gateway detection of hash theft file types
- create phishing payloads for targets with outbound SMB access
- quickly enumerate which file types can trigger NTLM authentication on Windows
- generate .url, .lnk, .docx, .xlsx, and .pdf files that leak NTLMv2 hashes to an SMB capture server

## When to choose
- you are a penetration tester or red teamer performing internal phishing engagements
- you need to capture NTLMv2 hashes from Windows hosts via SMB
- you want to test email gateways or antivirus against hash theft file types
- you need a quick way to generate many hash theft file variants at once

## When to avoid
- you need a stealthy, fully undetectable red team tool - many generated file types are known signatures
- you are looking for a defensive detection tool rather than an offensive generator
- your target environment blocks all outbound SMB traffic and you are not on the internal network
- you need macro-based or exploit-based document attacks rather than 'intended functionality' techniques

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, cli
- domain: security, penetration-testing, developer-tools
- platform: python, cli, cross-platform
- tags: ntlmv2, hash-theft, red-team, phishing, smb, responder, offensive-security

## Member repositories
- Greenwolf/ntlm_theft (main) score 52

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:49.206047+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:34:47.650855+00:00, confidence not recorded.
  - readme: https://github.com/Greenwolf/ntlm_theft (fetched 2026-08-28T04:04:49.206047+00:00, sha 3ccf36eaf2bd)
- Data as of 2026-08-30T08:39:29.467469+00:00.