$ sharker -h
Usage: sharker [OPTIONS] [PCAP[ PCAP[ ...]]

  Sharker: A reasonably fast network protocol analysis tool with extensible
  filters.

Options:
  Input Source:
    -d, --pcap-dir DIR            Path to a directory containing PCAP files to
                                  parse.
    -i, --interface IFACE         Network interface to capture live data from
                                  (e.g., eth0, wlan0).
  Output Handling:                By default, everything is written to file,
                                  and only creds category is printed to
                                  console. For very large PCAPs, advised to
                                  disable console output or at least colors,
                                  since it slows down the parsing.
    -m, --output-mode [file|console|both|develop]
                                  Which output mode to enable.  [default:
                                  both]
    -u, --unique                  Output only unique results, will gradually
                                  take more and more RAM.
    -F, --fast                    Fastest configuration (do not affect filter
                                  selection).
  Output file mode:
    -o, --output-dir DIR          Output directory.
    -op, --output-prefix NAME     Prefix to use for the output files, defaults
                                  to the PCAP/interface name.
  Output console mode:
    -P                            Send all filters to console (default in
                                  console output mode).
    -C                            Do not use colors in console output, will
                                  speed up sharker when lot of stuff is
                                  printed.
    -pf FILT[,FILT[...]]          Send specific filters output to console.
    -xpf FILT[,FILT[...]]         Do not send specific filters to console.
    -pc CAT[,CAT[...]]            Send specific filter categories to console.
    -xpc CAT[,CAT[...]]           Do not send specific categories to console.
    -nwf FILT[,FILT[...]]         Do not write filters output to file.
    -nwc CAT[,CAT[...]]           Do not write filter categories to file.
  Filter Selection:
    -A, --all                     Enable all filters, will be slower.
    -f, --filters FILT[,FILT[...]]
                                  Only run specified filters.
    -nf, --not-filters FILT[,FILT[...]]
                                  Exclude specified filters.
    -c, --categories CAT[,CAT[...]]
                                  Only run specified categories of filters.
    -nc, --not-categories CAT[,CAT[...]]
                                  Exclude specified categories of filters.
  Filter Information:
    -l, --list-filters            List filters that would be active with
                                  current filtering options.
    -L, --list-all-filters        List all available filters.
    -Lc, --list-all-filter-categories
                                  List all available filter categories.
  Debugging:
    -v, --verbose                 Verbose mode.
  -h, --help                      Show this message and exit.

from .base import FilterConfigBase


class FilterConfig(FilterConfigBase):
    name = 'ntlmssp'
    description = 'Extract Net-NTLM hashes for cracking purposes'

    categories = [
        'creds',
        'windows'
    ]

    pcap_filter = 'gss-api || ntlmssp'

    mandatory_selectors = [
        'ntlmssp'
    ]

    def __init__(self, *args, **kwargs):
        self.challenges = {}
        super().__init__(*args, **kwargs)

    def parser(self, data):
        tcp_conn = data['tcp.stream'][0]
        msg_type = int(data['ntlmssp.messagetype'][0], 16) if 'ntlmssp.messagetype' in data else 0

        if msg_type == 1:
            # NTLM NEGOTIATE: nothing to do
            pass
        elif msg_type == 2:
            # NTLM CHALLENGE
            self.challenges[tcp_conn] = data['ntlmssp.ntlmserverchallenge'][0].replace(':', '')
        elif msg_type == 3:
            if tcp_conn not in self.challenges:
                self.log.error('Found an NTLM message type 3 (AUTH), but no type 2 (CHALLENGE) was received beforehand -> check in pcap if the challenge was not sent in an unsupported by tshark manner from the server, like in a Proxy-Authenticate HTTP header.')
                return 0

            ntresp = data['ntlmssp.auth.ntresponse'][0].replace(':', '')
            lmresp = data['ntlmssp.auth.lmresponse'][0].replace(':', '')
            user = data['ntlmssp.auth.username'][0]
            domain = data['ntlmssp.auth.domain'][0]
            workstation = data['ntlmssp.auth.hostname'][0]

            ntlm_hash = ''
            if len(ntresp) == 24 * 2:
                # NTLMv1 response
                if domain != '':
                    ntlm_hash = f'{user}::{domain}:{lmresp}:{ntresp}:{self.challenges[tcp_conn]}'
                else:
                    ntlm_hash = f'{user}::{workstation}:{lmresp}:{ntresp}:{self.challenges[tcp_conn]}'
            else:
                # NTLMv2 response
                if domain != '':
                    ntlm_hash = f'{user}::{domain}:{self.challenges[tcp_conn]}:{ntresp[:32]}:{ntresp[32:]}'
                else:
                    ntlm_hash = f'{user}::{workstation}:{self.challenges[tcp_conn]}:{ntresp[:32]}:{ntresp[32:]}'

            del self.challenges[tcp_conn]
            self.output(ntlm_hash)
            return 1

        return 0