Skip to content

Adding pipx support for ntlm_theft #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
schlopshow wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Adding pipx support for ntlm_theft #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db8744c
Added Pipx installation method for easier package management of ntlm_…
Apr 15, 2026
c9055ea
Added Pipx installation method for easier package management of ntlm_…
Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@

A tool for generating multiple types of NTLMv2 hash theft files.

ntlm_theft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the internal network.
ntlm_theft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the internal network.

The benefits of these file types over say macro based documents or exploit documents are that all of these are built using "intended functionality". None were flagged by Windows Defender Antivirus on June 2020, and 17 of the 21 attacks worked on a fully patched Windows 10 host.
The benefits of these file types over say macro based documents or exploit documents are that all of these are built using "intended functionality". None were flagged by Windows Defender Antivirus on June 2020, and 17 of the 21 attacks worked on a fully patched Windows 10 host.

ntlm_theft supports the following attack types:

Expand Down Expand Up @@ -44,15 +44,25 @@ I've found it useful while penetration testing to easily see what file types I h

These instructions will show you the requirements for and how to use ntlm_theft.

### Prerequisites
## Prerequisites

ntlm_theft requires Python3 and xlsxwriter:

```
pip3 install xlsxwriter
```

### Required Parameters

## Pipx Installation (For easier package package management)

```
pipx install git+https://github.com/Greenwolf/ntlm_theft
```

### Pipx Uninstall
```
pipx uninstall ntlm_theft
```

To start up the tool 4 parameters must be provided, an input format, the input file or folder and the basic running mode:

Expand Down Expand Up @@ -133,7 +143,7 @@ Generation Complete.
ntlm_theft
Created by Jacob Wilkin
Copyright (C) 2020 Jacob Wilkin

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
Expand All @@ -154,3 +164,4 @@ GNU General Public License for more details.
* [Osanda](https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/)
* [Violation Industry](https://www.youtube.com/watch?v=PDpBEY1roRc)
* [@kazkansouh](https://github.com/kazkansouh) - Adding .lnk support
* [@schlop](https://github.com/schlopshow) - Added pipx installation method
Loading