from impacket.dcerpc.v5 import nrpc, epm from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5 import transport from impacket import crypto from impacket.dcerpc.v5.ndr import NDRCALL import impacket from binascii import hexlify, unhexlify from Cryptodome.Cipher import DES, AES, ARC4 from binascii import hexlify, unhexlify serverChallenge = b'fe216509397c0893' sessionKey = nrpc.ComputeSessionKeyAES(None,b'\x00'*8, unhexlify(serverChallenge), unhexlify("31d6cfe0d16ae931b73c59d7e0c089c0")) print("session key: ", hexlify(sessionKey).decode()) enc = b'97357430f9fee6fb3b32bdea7a3b206d' pwdata = impacket.crypto.SamDecryptNTLMHash(unhexlify(enc), sessionKey) print ("pwdata: " + hexlify(pwdata).decode()) # 24631463edc7d6a03657f1ea0f3cff7b