Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#!/usr/bin/env ruby
2

3
##
4
# This module requires Metasploit: https://metasploit.com/download
5
# Current source: https://github.com/rapid7/metasploit-framework
6
##
7

8
#
9
# This script cracks any type of NTLM hash
10
# Credit to	-Yannick Hamon <yannick.hamon[at]xmcopartners.com> for the original idea/perl code
11
#		-Alexandre Maloteaux <a.maloteaux[at]gmail.com> for improvements
12
#
13

14
msfbase = __FILE__
15
while File.symlink?(msfbase)
16
  msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
17
end
18

19
$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib')))
20
require 'msfenv'
21

22
$:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
23

24
require 'rex'
25

26
CRYPT = Rex::Proto::NTLM::Crypt
27

28
BRUTE_MODE = 1
29
HASH_MODE  = 2
30
PASS_MODE =  3
31

32
def usage
33
  $stderr.puts("\nUsage: #{$0} -t type <options>\n" + $args.usage)
34
  $stderr.puts("This tool can be use in 3 ways whatever type is chosen\n")
35
  $stderr.puts("-If only a password (-p) is provided, it will display the hash.\n")
36
  $stderr.puts("-If a password (-p) and an hash (-a) is provided, it will test the password against the hash.\n")
37
  $stderr.puts("-If a list of password (-l) is provided and an hash (-a), it will try to bruteforce the hash \n\n")
38
  exit
39
end
40

41
def permute_pw(pw)
42
  # fast permutation from http://stackoverflow.com/a/1398900
43
  perms = [""]
44
  if pw.nil?
45
    return perms
46
  end
47
  tail = pw.downcase
48
  while tail.length > 0 do
49
    head, tail, psize = tail[0..0], tail[1..-1], perms.size
50
    hu = head.upcase
51
    for i in (0...psize)
52
      tp = perms[i]
53
      perms[i] = tp + hu
54
      if hu != head
55
        perms.push(tp + head)
56
      end
57
    end
58
  end
59
  return perms
60
end
61

62
type = hash = pass = srvchal = clichal = calculatedhash = list = user = domain = nil
63

64
$args = Rex::Parser::Arguments.new(
65
  "-t" => [ true,  "The type of hash to crack : HALFLM/LM/NTLM/HALFNETLMv1/NETLMv1/NETNTLMv1/NETNTLM2_SESSION/NETLMv2/NETNTLMv2"	],
66
  "-a" => [ true,  "The hash to crack"                                          				],
67
  "-p" => [ true,  "The password "                                                            		],
68
  "-l" => [ true,  "The list of password to check against an hash"                               		],
69
  "-s" => [ true,  "The LM/NTLM Server Challenge (NET* type only)"		                   	],
70
  "-c" => [ true,  "The LM/NTLM Client Challenge (NETNTLM2_SESSION/NETLMv2/NETNTLMv2/ type only)"    		 	],
71
  "-u" => [ true,  "The user name                (NETLMv2/NETNTLMv2 type only)"     	],
72
  "-d" => [ true,  "The domain (machine) name    (NETLMv2/NETNTLMv2 type only)"     	],
73
  "-h" => [ false, "Display this help information"                                                   	])
74

75
$args.parse(ARGV) { |opt, idx, val|
76
  case opt
77
    when "-t"
78
      type = val
79
    when "-a"
80
      hash = val
81
    when "-p"
82
      pass = val
83
    when "-l"
84
      list = val
85
    when "-s"
86
      srvchal = val
87
    when "-c"
88
      clichal = val
89
    when "-u"
90
      user = val
91
    when "-d"
92
      domain = val
93
    when "-h"
94
      usage
95
    else
96
      usage
97
  end
98
}
99

100
if not type
101
  usage
102
else
103
  if pass and (not (hash or list))
104
    mode = HASH_MODE
105
  elsif pass and hash and not list
106
    mode = PASS_MODE
107
  elsif list and hash and not pass
108
    mode = BRUTE_MODE
109
    if not File.exist? list
110
      $stderr.puts "[*] The passwords list file does not exist"
111
      exit
112
    end
113
    if not File.file? list
114
      $stderr.puts "[*] The passwords list provided is not a file"
115
      exit
116
    end
117
    if not File.readable? list
118
      $stderr.puts "[*] The passwords list file is not readable"
119
      exit
120
    end
121
  else
122
    usage
123
  end
124
end
125

126
if type == "HALFLM" or type == "LM" or type == "NTLM" then
127
  if srvchal != nil or clichal != nil or user != nil or domain != nil  then
128
    $stderr.puts "[*] No challenge, user or domain must be provided with this type"
129
    exit
130
  end
131
elsif type == "HALFNETLMv1" or type == "NETLMv1" or type == "NETNTLMv1" then
132
  if clichal != nil  or user != nil or domain != nil then
133
    $stderr.puts "[*] Client challenge, user or domain must not be provided with this type"
134
    exit
135
  end
136
elsif type == "NETNTLM2_SESSION"  then
137
  if user != nil or domain != nil then
138
    $stderr.puts "[*] User or domain must not be provided with this type"
139
    exit
140
  end
141
end
142

143
case type
144
when "HALFLM"
145
  case mode
146
  when BRUTE_MODE
147
    if not hash =~ /^([a-fA-F0-9]{16})$/
148
      $stderr.puts "[*] HALFLM HASH must be exactly 16 bytes of hexadecimal"
149
      exit
150
    end
151
    File.open(list,"rb") do |password_list|
152
      password_list.each_line do |line|
153
        password = line.gsub("\r\n",'').gsub("\n",'')
154
        if password =~ /^.{1,7}$/
155
          puts password
156
          calculatedhash = CRYPT::lm_hash(password,true).unpack("H*")[0].upcase
157
          if calculatedhash == hash.upcase
158
            puts "[*] Correct password found : #{password.upcase}"
159
            exit
160
          end
161
        end
162
      end
163
    end
164
    puts "[*] No password found"
165
    exit
166
  when HASH_MODE
167
    if not pass =~ /^.{0,7}$/
168
      $stderr.puts "[*] LM password can not be bigger then 7 characters"
169
      exit
170
    end
171
    calculatedhash = CRYPT::lm_hash(pass,true).unpack("H*")[0].upcase
172
    puts "[*] The LM hash for #{pass.upcase} is : #{calculatedhash}"
173
    exit
174
  when PASS_MODE
175
    if not pass =~ /^.{0,7}$/
176
      $stderr.puts "[*] LM password can not be bigger then 7 characters"
177
      exit
178
    end
179
    if not hash =~ /^([a-fA-F0-9]{16})$/
180
      $stderr.puts "[*] LM HASH must be exactly 16 bytes of hexadecimal"
181
      exit
182
    end
183
    calculatedhash = CRYPT::lm_hash(pass,true).unpack("H*")[0].upcase
184
    if hash.upcase == calculatedhash
185
      puts "[*] Correct password provided : #{pass.upcase}"
186
      exit
187
    else
188
      puts "[*] Incorrect password provided : #{pass.upcase}"
189
      exit
190
    end
191
  end
192

193
when "LM"
194
  case mode
195
  when BRUTE_MODE
196
    if not hash =~ /^([a-fA-F0-9]{32})$/
197
      $stderr.puts "[*] LM HASH must be exactly 32 bytes of hexadecimal"
198
      exit
199
    end
200
    File.open(list,"rb") do |password_list|
201
      password_list.each_line do |line|
202
        password = line.gsub("\r\n",'').gsub("\n",'')
203
        if password =~ /^.{1,14}$/
204
          puts password
205
          calculatedhash = CRYPT::lm_hash(password.upcase).unpack("H*")[0].upcase
206
          if calculatedhash == hash.upcase
207
            puts "[*] Correct password found : #{password.upcase}"
208
            exit
209
          end
210
        end
211
      end
212
    end
213
    puts "[*] No password found"
214
    exit
215
  when HASH_MODE
216
    if not pass =~ /^.{0,14}$/
217
      $stderr.puts "[*] LM password can not be bigger then 14 characters"
218
      exit
219
    end
220
    calculatedhash = CRYPT::lm_hash(pass.upcase).unpack("H*")[0].upcase
221
    puts "[*] The LM hash for #{pass.upcase} is : #{calculatedhash}"
222
    exit
223
  when PASS_MODE
224
    if not pass =~ /^.{0,14}$/
225
      $stderr.puts "[*] LM password can not be bigger then 14 characters"
226
      exit
227
    end
228
    if not hash =~ /^([a-fA-F0-9]{32})$/
229
      $stderr.puts "[*] LM HASH must be exactly 32 bytes of hexadecimal"
230
      exit
231
    end
232
    calculatedhash = CRYPT::lm_hash(pass.upcase).unpack("H*")[0].upcase
233
    if hash.upcase == calculatedhash
234
      puts "[*] Correct password provided : #{pass.upcase}"
235
      exit
236
    else
237
      puts "[*] Incorrect password provided : #{pass.upcase}"
238
      exit
239
    end
240
  end
241

242
when "NTLM"
243
  case mode
244
  when BRUTE_MODE
245
    if not hash =~ /^([a-fA-F0-9]{32})$/
246
      $stderr.puts "[*] NTLM HASH must be exactly 32 bytes of hexadecimal"
247
      exit
248
    end
249
    File.open(list,"rb") do |password_list|
250
      password_list.each_line do |line|
251
        password = line.gsub("\r\n",'').gsub("\n",'')
252
        for permutedpw in permute_pw(password)
253
          puts permutedpw
254
          calculatedhash = CRYPT::ntlm_hash(permutedpw).unpack("H*")[0].upcase
255
          if calculatedhash == hash.upcase
256
            puts "[*] Correct password found : #{permutedpw}"
257
            exit
258
          end
259
        end
260
      end
261
    end
262
    puts "[*] No password found"
263
    exit
264
  when HASH_MODE
265
    calculatedhash = CRYPT::ntlm_hash(pass).unpack("H*")[0].upcase
266
    puts "[*] The NTLM hash for #{pass} is : #{calculatedhash}"
267
    exit
268
  when PASS_MODE
269
    if not hash =~ /^([a-fA-F0-9]{32})$/
270
      $stderr.puts "[*] NTLM HASH must be exactly 32 bytes of hexadecimal"
271
      exit
272
    end
273
    for permutedpw in permute_pw(pass)
274
      calculatedhash = CRYPT::ntlm_hash(permutedpw).unpack("H*")[0].upcase
275
      if hash.upcase == calculatedhash
276
        puts "[*] Correct password provided : #{permutedpw}"
277
        exit
278
      end
279
    end
280
    puts "[*] Incorrect password provided : #{pass}"
281
  end
282
when  "HALFNETLMv1"
283
  case mode
284
  when BRUTE_MODE
285
    if not hash =~ /^([a-fA-F0-9]{16})$/
286
      $stderr.puts "[*] NETLMv1 HASH must be exactly 16 bytes of hexadecimal"
287
      exit
288
    end
289
    if not srvchal
290
      $stderr.puts "[*] Server challenge must be provided with this type"
291
      exit
292
    end
293
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
294
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
295
      exit
296
    end
297
    File.open(list,"rb") do |password_list|
298
      password_list.each_line do |line|
299
        password = line.gsub("\r\n",'').gsub("\n",'')
300
        if password =~ /^.{1,7}$/
301
          puts password
302
          #Rem : cause of the [0,7] there is only 1/256 chance that the guessed password will be the good one
303
          arglm = { 	:lm_hash => CRYPT::lm_hash(password,true)[0,7],
304
              :challenge => [ srvchal ].pack("H*") }
305
          calculatedhash = CRYPT::lm_response(arglm,true).unpack("H*")[0].upcase
306
          if calculatedhash == hash.upcase
307
            puts "[*] Correct password found : #{password.upcase}"
308
            exit
309
          end
310
        end
311
      end
312
    end
313
    puts "[*] No password found"
314
    exit
315
  when HASH_MODE
316
    if not pass =~ /^.{0,7}$/
317
      $stderr.puts "[*] HALFNETLMv1 password can not be bigger then 7 characters"
318
      exit
319
    end
320
    if not srvchal
321
      $stderr.puts "[*] Server challenge must be provided with this type"
322
      exit
323
    end
324
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
325
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
326
      exit
327
    end
328
    arglm = { 	:lm_hash => CRYPT::lm_hash(pass,true)[0,7],
329
        :challenge => [ srvchal ].pack("H*") }
330

331
    calculatedhash = CRYPT::lm_response(arglm,true).unpack("H*")[0].upcase
332
    puts "[*] The HALFNETLMv1 hash for #{pass.upcase} is : #{calculatedhash}"
333
    exit
334
  when PASS_MODE
335
    if not pass =~ /^.{0,7}$/
336
      $stderr.puts "[*] HALFNETLMv1 password can not be bigger then 7 characters"
337
      exit
338
    end
339
    if not hash =~ /^([a-fA-F0-9]{16})$/
340
      $stderr.puts "[*] HALFNETLMv1 HASH must be exactly 16 bytes of hexadecimal"
341
      exit
342
    end
343
    if not srvchal
344
      $stderr.puts "[*] Server challenge must be provided with this type"
345
      exit
346
    end
347
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
348
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
349
      exit
350
    end
351
    #Rem : cause of the [0,7] there is only 1/256 chance that the guessed password will be the good one
352
    arglm = { 	:lm_hash => CRYPT::lm_hash(pass,true)[0,7],
353
        :challenge => [ srvchal ].pack("H*") }
354

355
    calculatedhash = CRYPT::lm_response(arglm,true).unpack("H*")[0].upcase
356
    if hash.upcase == calculatedhash
357
      puts "[*] Correct password provided : #{pass.upcase}"
358
      exit
359
    else
360
      puts "[*] Incorrect password provided : #{pass.upcase}"
361
      exit
362
    end
363
  end
364
when  "NETLMv1"
365
  case mode
366
  when BRUTE_MODE
367
    if not hash =~ /^([a-fA-F0-9]{48})$/
368
      $stderr.puts "[*] NETLMv1 HASH must be exactly 48 bytes of hexadecimal"
369
      exit
370
    end
371
    if not srvchal
372
      $stderr.puts "[*] Server challenge must be provided with this type"
373
      exit
374
    end
375
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
376
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
377
      exit
378
    end
379
    File.open(list,"rb") do |password_list|
380
      password_list.each_line do |line|
381
        password = line.gsub("\r\n",'').gsub("\n",'')
382
        if password =~ /^.{1,14}$/
383
          puts password
384
          arglm = { 	:lm_hash => CRYPT::lm_hash(password),
385
              :challenge => [ srvchal ].pack("H*") }
386
          calculatedhash = CRYPT::lm_response(arglm).unpack("H*")[0].upcase
387
          if calculatedhash == hash.upcase
388
            puts "[*] Correct password found : #{password.upcase}"
389
            exit
390
          end
391
        end
392
      end
393
    end
394
    puts "[*] No password found"
395
    exit
396
  when HASH_MODE
397
    if not pass =~ /^.{1,14}$/
398
      $stderr.puts "[*] NETLMv1 password can not be bigger then 14 characters"
399
      exit
400
    end
401
    if not srvchal
402
      $stderr.puts "[*] Server challenge must be provided with this type"
403
      exit
404
    end
405
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
406
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
407
      exit
408
    end
409
    arglm = { 	:lm_hash => CRYPT::lm_hash(pass),
410
        :challenge => [ srvchal ].pack("H*") }
411

412
    calculatedhash = CRYPT::lm_response(arglm).unpack("H*")[0].upcase
413
    puts "[*] The NETLMv1 hash for #{pass.upcase} is : #{calculatedhash}"
414
    exit
415
  when PASS_MODE
416
    if not pass =~ /^.{1,14}$/
417
      $stderr.puts "[*] NETLMv1 password can not be bigger then 14 characters"
418
      exit
419
    end
420
    if not hash =~ /^([a-fA-F0-9]{48})$/
421
      $stderr.puts "[*] NETLMv1 HASH must be exactly 48 bytes of hexadecimal"
422
      exit
423
    end
424
    if not srvchal
425
      $stderr.puts "[*] Server challenge must be provided with this type"
426
      exit
427
    end
428
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
429
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
430
      exit
431
    end
432
    arglm = { 	:lm_hash => CRYPT::lm_hash(pass),
433
        :challenge => [ srvchal ].pack("H*") }
434

435
    calculatedhash = CRYPT::lm_response(arglm).unpack("H*")[0].upcase
436
    if hash.upcase == calculatedhash
437
      puts "[*] Correct password provided : #{pass.upcase}"
438
      exit
439
    else
440
      puts "[*] Incorrect password provided : #{pass.upcase}"
441
      exit
442
    end
443
  end
444
when "NETNTLMv1"
445
  case mode
446
  when BRUTE_MODE
447
    if not hash =~ /^([a-fA-F0-9]{48})$/
448
      $stderr.puts "[*] NETNTLMv1 HASH must be exactly 48 bytes of hexadecimal"
449
      exit
450
    end
451
    if not srvchal
452
      $stderr.puts "[*] Server challenge must be provided with this type"
453
      exit
454
    end
455
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
456
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
457
      exit
458
    end
459
    File.open(list,"rb") do |password_list|
460
      password_list.each_line do |line|
461
      password = line.gsub("\r\n",'').gsub("\n",'')
462
      for permutedpw in permute_pw(password)
463
        puts permutedpw
464
        argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(permutedpw),
465
            :challenge => [ srvchal ].pack("H*") }
466
        calculatedhash = CRYPT::ntlm_response(argntlm).unpack("H*")[0].upcase
467
          if calculatedhash == hash.upcase
468
            puts "[*] Correct password found : #{permutedpw}"
469
            exit
470
          end
471
        end
472
      end
473
    end
474
    puts "[*] No password found"
475
    exit
476
  when HASH_MODE
477
    if not srvchal
478
      $stderr.puts "[*] Server challenge must be provided with this type"
479
      exit
480
    end
481
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
482
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
483
      exit
484
    end
485
    argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(pass),
486
        :challenge => [ srvchal ].pack("H*") }
487
    calculatedhash = CRYPT::ntlm_response(argntlm).unpack("H*")[0].upcase
488
    puts "[*] The NETNTLMv1 hash for #{pass} is : #{calculatedhash}"
489
    exit
490
  when PASS_MODE
491
    if not hash =~ /^([a-fA-F0-9]{48})$/
492
      $stderr.puts "[*] NETNTLMv1 HASH must be exactly 48 bytes of hexadecimal"
493
      exit
494
    end
495
    if not srvchal
496
      $stderr.puts "[*] Server challenge must be provided with this type"
497
      exit
498
    end
499
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
500
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
501
      exit
502
    end
503
    for permutedpw in permute_pw(pass)
504
      argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(permutedpw),
505
          :challenge => [ srvchal ].pack("H*") }
506

507
      calculatedhash = CRYPT::ntlm_response(argntlm).unpack("H*")[0].upcase
508
      if hash.upcase == calculatedhash
509
        puts "[*] Correct password provided : #{permutedpw}"
510
        exit
511
      end
512
    end
513
    puts "[*] Incorrect password provided : #{pass}"
514
    exit
515
  end
516
when  "NETNTLM2_SESSION"
517
  case mode
518
  when BRUTE_MODE
519
    if not hash =~ /^([a-fA-F0-9]{48})$/
520
      $stderr.puts "[*] NETNTLM2_SESSION HASH must be exactly 48 bytes of hexadecimal"
521
      exit
522
    end
523
    if not srvchal
524
      $stderr.puts "[*] Server challenge must be provided with this type"
525
      exit
526
    end
527
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
528
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
529
      exit
530
    end
531
    if not clichal
532
      $stderr.puts "[*] Client challenge must be provided with this type"
533
      exit
534
    end
535
    if not clichal =~ /^([a-fA-F0-9]{16})$/
536
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
537
      exit
538
    end
539

540
    File.open(list,"rb") do |password_list|
541
      password_list.each_line do |line|
542
        password = line.gsub("\r\n",'').gsub("\n",'')
543
        for permutedpw in permute_pw(password)
544
          puts permutedpw
545
          argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(permutedpw),
546
              :challenge => [ srvchal ].pack("H*") }
547
          optntlm = {	:client_challenge => [ clichal ].pack("H*")}
548

549
          calculatedhash = CRYPT::ntlm2_session(argntlm,optntlm).join[24,24].unpack("H*")[0].upcase
550

551
          if calculatedhash == hash.upcase
552
            puts "[*] Correct password found : #{permutedpw}"
553
            exit
554
          end
555
        end
556
      end
557
    end
558
    puts "[*] No password found"
559
    exit
560
  when HASH_MODE
561
    if not srvchal
562
      $stderr.puts "[*] Server challenge must be provided with this type"
563
      exit
564
    end
565
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
566
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
567
      exit
568
    end
569
    if not clichal
570
      $stderr.puts "[*] Client challenge must be provided with this type"
571
      exit
572
    end
573
    if not clichal =~ /^([a-fA-F0-9]{16})$/
574
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
575
      exit
576
    end
577
    argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(pass),
578
        :challenge => [ srvchal ].pack("H*") }
579
    optntlm = {	:client_challenge => [ clichal ].pack("H*")}
580

581
    calculatedhash = CRYPT::ntlm2_session(argntlm,optntlm).join[24,24].unpack("H*")[0].upcase
582
    puts "[*] The NETNTLM2_SESSION hash for #{pass} is : #{calculatedhash}"
583
    exit
584
  when PASS_MODE
585
    if not hash =~ /^([a-fA-F0-9]{48})$/
586
      $stderr.puts "[*] NETNTLM2_SESSION HASH must be exactly 48 bytes of hexadecimal"
587
      exit
588
    end
589
    if not srvchal
590
      $stderr.puts "[*] Server challenge must be provided with this type"
591
      exit
592
    end
593
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
594
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
595
      exit
596
    end
597
    if not clichal
598
      $stderr.puts "[*] Client challenge must be provided with this type"
599
      exit
600
    end
601
    if not clichal =~ /^([a-fA-F0-9]{16})$/
602
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
603
      exit
604
    end
605
    for permutedpw in permute_pw(pass)
606
      argntlm = { 	:ntlm_hash =>  CRYPT::ntlm_hash(permutedpw),
607
          :challenge => [ srvchal ].pack("H*") }
608
      optntlm = {	:client_challenge => [ clichal ].pack("H*")}
609

610
      calculatedhash = CRYPT::ntlm2_session(argntlm,optntlm).join[24,24].unpack("H*")[0].upcase
611

612
      if hash.upcase == calculatedhash
613
        puts "[*] Correct password provided : #{permutedpw}"
614
        exit
615
      end
616
    end
617
    puts "[*] Incorrect password provided : #{pass}"
618
    exit
619
  end
620
when  "NETLMv2"
621
  case mode
622
  when BRUTE_MODE
623
    if not hash =~ /^([a-fA-F0-9]{32})$/
624
      $stderr.puts "[*] NETLMv2 HASH must be exactly 32 bytes of hexadecimal"
625
      exit
626
    end
627
    if not srvchal
628
      $stderr.puts "[*] Server challenge must be provided with this type"
629
      exit
630
    end
631
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
632
      $stderr.puts "[*] Server challenge mus be exactly 16 bytes of hexadecimal"
633
      exit
634
    end
635
    if not clichal
636
      $stderr.puts "[*] Client challenge must be provided with this type"
637
      exit
638
    end
639
    if not clichal =~ /^([a-fA-F0-9]{16})$/
640
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
641
      exit
642
    end
643
    if not user
644
      $stderr.puts "[*] User name must be provided with this type"
645
      exit
646
    end
647
    if not domain
648
      $stderr.puts "[*] Domain name must be provided with this type"
649
      exit
650
    end
651

652
    File.open(list,"rb") do |password_list|
653
      password_list.each_line do |line|
654
        password = line.gsub("\r\n",'').gsub("\n",'')
655
        puts password
656
        arglm = {	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user,password, domain),
657
            :challenge => [ srvchal ].pack("H*") }
658
        optlm = {	:client_challenge => [ clichal ].pack("H*")}
659
        calculatedhash = CRYPT::lmv2_response(arglm, optlm).unpack("H*")[0].upcase
660
        if calculatedhash.slice(0,32) == hash.upcase
661
          puts "[*] Correct password found : #{password}"
662
          exit
663
        end
664
      end
665
    end
666
    puts "[*] No password found"
667
    exit
668
  when HASH_MODE
669
    if not srvchal
670
      $stderr.puts "[*] Server challenge must be provided with this type"
671
      exit
672
    end
673
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
674
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
675
      exit
676
    end
677
    if not clichal
678
      $stderr.puts "[*] Client challenge must be provided with this type"
679
      exit
680
    end
681
    if not clichal =~ /^([a-fA-F0-9]{16})$/
682
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
683
      exit
684
    end
685
    if not user
686
      $stderr.puts "[*] User name must be provided with this type"
687
      exit
688
    end
689
    if not domain
690
      $stderr.puts "[*] Domain name must be provided with this type"
691
      exit
692
    end
693

694
    arglm = {	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user,pass, domain),
695
        :challenge => [ srvchal ].pack("H*") }
696
    optlm = {	:client_challenge => [ clichal ].pack("H*")}
697
    calculatedhash = CRYPT::lmv2_response(arglm, optlm).unpack("H*")[0].upcase
698

699
    puts "[*] The NETLMv2 hash for #{pass} is : #{calculatedhash.slice(0,32)}"
700
    exit
701
  when PASS_MODE
702
    if not hash =~ /^([a-fA-F0-9]{32})$/
703
      $stderr.puts "[*] NETLMv2 HASH must be exactly 32 bytes of hexadecimal"
704
      exit
705
    end
706
    if not srvchal
707
      $stderr.puts "[*] Server challenge must be provided with this type"
708
      exit
709
    end
710
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
711
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
712
      exit
713
    end
714
    if not clichal
715
      $stderr.puts "[*] Client challenge must be provided with this type"
716
      exit
717
    end
718
    if not clichal =~ /^([a-fA-F0-9]{16})$/
719
      $stderr.puts "[*] Client challenge must be exactly 16 bytes of hexadecimal"
720
      exit
721
    end
722
    if not user
723
      $stderr.puts "[*] User name must be provided with this type"
724
      exit
725
    end
726
    if not domain
727
      $stderr.puts "[*] Domain name must be provided with this type"
728
      exit
729
    end
730
    arglm = {	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user,pass, domain),
731
        :challenge => [ srvchal ].pack("H*") }
732
    optlm = {	:client_challenge => [ clichal ].pack("H*")}
733
    calculatedhash = CRYPT::lmv2_response(arglm, optlm).unpack("H*")[0].upcase
734
    if hash.upcase == calculatedhash.slice(0,32)
735
      puts "[*] Correct password provided : #{pass}"
736
      exit
737
    else
738
      puts "[*] Incorrect password provided : #{pass}"
739
      exit
740
    end
741
  end
742

743
when "NETNTLMv2"
744
  case mode
745
  when BRUTE_MODE
746
    if not hash =~ /^([a-fA-F0-9]{32})$/
747
      $stderr.puts "[*] NETNTLMv2 HASH must be exactly 32 bytes of hexadecimal"
748
      exit
749
    end
750
    if not srvchal
751
      $stderr.puts "[*] Server challenge must be provided with this type"
752
      exit
753
    end
754
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
755
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
756
      exit
757
    end
758
    if not clichal
759
      $stderr.puts "[*] Client challenge must be provided with this type"
760
      exit
761
    end
762
    if not clichal =~ /^([a-fA-F0-9]{17,})$/
763
      $stderr.puts "[*] Client challenge must be bigger then 16 bytes of hexadecimal"
764
      exit
765
    end
766
    if not user
767
      $stderr.puts "[*] User name must be provided with this type"
768
      exit
769
    end
770
    if not domain
771
      $stderr.puts "[*] Domain name must be provided with this type"
772
      exit
773
    end
774

775
    File.open(list,"rb") do |password_list|
776
      password_list.each_line do |line|
777
        password = line.gsub("\r\n",'').gsub("\n",'')
778
        for permutedpw in permute_pw(password)
779
          puts permutedpw
780
          argntlm = { 	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user, permutedpw, domain),
781
              :challenge => [ srvchal ].pack("H*") }
782
          optntlm = { 	:nt_client_challenge => [ clichal ].pack("H*")}
783
          calculatedhash = CRYPT::ntlmv2_response(argntlm,optntlm).unpack("H*")[0].upcase
784

785
          if calculatedhash.slice(0,32) == hash.upcase
786
            puts "[*] Correct password found : #{password}"
787
            exit
788
          end
789
        end
790
      end
791
    end
792
    puts "[*] No password found"
793
    exit
794
  when HASH_MODE
795
    if not srvchal
796
      $stderr.puts "[*] Server challenge must be provided with this type"
797
      exit
798
    end
799
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
800
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
801
      exit
802
    end
803
    if not clichal
804
      $stderr.puts "[*] Client challenge must be provided with this type"
805
      exit
806
    end
807
    if not clichal =~ /^([a-fA-F0-9]{17,})$/
808
      $stderr.puts "[*] Client challenge must be bigger then 16 bytes of hexadecimal"
809
      exit
810
    end
811
    if not user
812
      $stderr.puts "[*] User name must be provided with this type"
813
      exit
814
    end
815
    if not domain
816
      $stderr.puts "[*] Domain name must be provided with this type"
817
      exit
818
    end
819

820
    argntlm = { 	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user, pass, domain),
821
        :challenge => [ srvchal ].pack("H*") }
822
    optntlm = { 	:nt_client_challenge => [ clichal ].pack("H*")}
823
    calculatedhash = CRYPT::ntlmv2_response(argntlm,optntlm).unpack("H*")[0].upcase
824

825
    puts "[*] The NETNTLMv2 hash for #{pass} is : #{calculatedhash.slice(0,32)}"
826
    exit
827
  when PASS_MODE
828
    if not hash =~ /^([a-fA-F0-9]{32})$/
829
      $stderr.puts "[*] NETNTLMv2 HASH must be exactly 32 bytes of hexadecimal"
830
      exit
831
    end
832
    if not srvchal
833
      $stderr.puts "[*] Server challenge must be provided with this type"
834
      exit
835
    end
836
    if not srvchal =~ /^([a-fA-F0-9]{16})$/
837
      $stderr.puts "[*] Server challenge must be exactly 16 bytes of hexadecimal"
838
      exit
839
    end
840
    if not clichal
841
      $stderr.puts "[*] Client challenge must be provided with this type"
842
      exit
843
    end
844
    if not clichal =~ /^([a-fA-F0-9]{17,})$/
845
      $stderr.puts "[*] Client challenge must be bigger then 16 bytes of hexadecimal"
846
      exit
847
    end
848
    if not user
849
      $stderr.puts "[*] User name must be provided with this type"
850
      exit
851
    end
852
    if not domain
853
      $stderr.puts "[*] Domain name must be provided with this type"
854
      exit
855
    end
856

857
    for permutedpw in permute_pw(password)
858
      argntlm = { 	:ntlmv2_hash =>  CRYPT::ntlmv2_hash(user, permutedpw, domain),
859
          :challenge => [ srvchal ].pack("H*") }
860
      optntlm = { 	:nt_client_challenge => [ clichal ].pack("H*")}
861
      calculatedhash = CRYPT::ntlmv2_response(argntlm,optntlm).unpack("H*")[0].upcase
862

863
      if hash.upcase == calculatedhash.slice(0,32)
864
        puts "[*] Correct password provided : #{permutedpw}"
865
        exit
866
      end
867
    end
868
    puts "[*] Incorrect password provided : #{pass}"
869
    exit
870
  end
871
else
872
  $stderr.puts "type must be of type : HALFLM/LM/NTLM/HALFNETLMv1/NETLMv1/NETNTLMv1/NETNTLM2_SESSION/NETLMv2/NETNTLMv2"
873
  exit
874
end
875

876