# NTLMRawUnHide | A Python3 Script Designed To Parse Network Packet Capture Files

**URL:** <https://onehack.st/t/ntlmrawunhide-a-python3-script-designed-to-parse-network-packet-capture-files/198464>\
**Category:** Tools & Scripts\
**Tags:** tools, cracking\
**Created:** [August 19, 2021, 9:05pm UTC](https://onehack.st/t/ntlmrawunhide-a-python3-script-designed-to-parse-network-packet-capture-files/198464 "2021-08-19T21:05:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [August 19, 2021, 9:05pm UTC](https://onehack.st/t/ntlmrawunhide-a-python3-script-designed-to-parse-network-packet-capture-files/198464/1 "2021-08-19T21:05:01Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/7/b/7ba89b87e77d9551655ff07af020592e234ea493.jpeg)

## Intro

NTLMRawUnhide.py is a Python3 script designed to parse network packet capture files and extract NTLMv2 hashes in a crackable format. The tool was developed to extract NTLMv2 hashes from files generated by native Windows binaries like NETSH.EXE and PKTMON.EXE without conversion.

The following binary network packet capture formats are supported:

- \*.pcap
- \*.pcapng
- \*.cap
- \*.etl

## Usage

```auto
Usage: NTLMRawUnhide.py -i <inputfile> [-o <outputfile>] [-f] [-h] [-q] [-v]

```

```auto
Main options:
  -f, --follow Continuously "follow" (e.g. "read from")
                             input file for new data
  -h, --help
  -i, --input <inputfile> Binary packet data input file
                             (.pcap, .pcapng, .cap, .etl, others?)
  -o, --output <outputfile> Output file to record any found NTLM
                             hashes
  -q, --quiet Be a lot more quiet and only output
                             found NTLM hashes. --quiet will also
                             disable verbose, if specified.
  -v, --verbose

```

## Examples

Extract NTLMv2 hashes from examples/capture.pcap:

```auto
python3 NTLMRawUnhide.py -i examples/capture.pcap

```

Same, but with verbose output:

```auto
python3 NTLMRawUnhide.py -i examples/capture.pcap -v

```

Extract NTLMv2 hashes from examples/capture.pcap and continue to monitor the file for new hashes (like tail -f):

```auto
python3 NTLMRawUnhide.py -i examples/capture.pcap -f

```

Extract NTLMv2 hashes from examples/capture.pcap and write extracted hashes to /tmp/hashes.txt

```auto
python3 NTLMRawUnhide.py -i examples/capture.pcap -o /tmp/hashes.txt

```

## Packet Capture Methods

To create a compatible packet capture file, any of the following methods can be used:

- Wireshark:

```auto
Set capture filter as "tcp port 445"; Save as .pcapng

```

- tcpdump

```auto
tcpdump -i eth0 -w capture.pcap "port 445"

```

- NETSH.EXE

```auto
netsh.exe trace start persistent=yes capture=yes TCP.AnyPort=445 tracefile=C:\Users\Public\capture.etl
netsh.exe trace stop

```

- PKTMON.EXE

```auto
pktmon.exe filter add SMB -p 445
:: List all filters 
pktmon.exe filter list
:: Find id of the network adapter (example > Id: 9)
pktmon.exe comp list
:: pktmon.exe start --etw -p 0 -c [Adapter ID]     
pktmon.exe start --etw -p 0 -c 9 
:: Will create the file PktMon.etl in current directory
pktmon.exe stop
:: Cleanup
pktmon.exe filter remove

```

## References

The following URL was very helpful when building this tool: The NTLM Authentication Protocol and Security Support Provider [http://davenport.sourceforge.net/ntlm.html](http://davenport.sourceforge.net/ntlm.html)

## GitHub:

> **[GitHub - mlgualtieri/NTLMRawUnHide: NTLMRawUnhide.py is a Python3 script designed to...](https://github.com/mlgualtieri/NTLMRawUnHide)**
>
> NTLMRawUnhide.py is a Python3 script designed to parse network packet capture files and extract NTLMv2 hashes in a crackable format. The following binary network packet capture formats are supported: \*.pcap \*.pcapng \*.cap \*.etl