#encoding:utf-8
import hashlib,binascii
from Crypto.Cipher import DES

def des_7key28key(passwd):
    #bytes转成二进制字符串，补齐56位
    key_bin_str = bin(int.from_bytes(passwd,byteorder='big',signed=False))[2:].rjust(56,'0')
    new_key = b''
    for i in range(0,56,7):
        #每7bit加1bit奇偶校验位
        one_byte = key_bin_str[i:i+7]
        if one_byte.count('1') % 2 == 0:
            new_byte = one_byte+'1'
        else:
            new_byte = one_byte+'0'
        new_key = new_key + bytes.fromhex(hex(int(new_byte,2))[2:].rjust(2,'0'))
    return new_key

def lm_hash(password:str):
    data = "KGS!@#$%".encode('utf-8')
    password = password.upper().encode("utf-8")
    if len(password) < 14:
        password += b'\x00'*(14-len(password))
    des1 = DES.new(des_7key28key(password[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(password[7:14]),DES.MODE_ECB)
    hash = des1.encrypt(data)+des2.encrypt(data)
    return hash

import hashlib
def ntlm_hash(password):
    hash = hashlib.new("md4",password.encode("utf-16le")).digest()
    return hash

import hashlib,binascii
from Crypto.Cipher import DES

def desl(password,data):
    if len(password) != 16:
        raise Exception("password length is not 16")
    des1 = DES.new(des_7key28key(password[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(password[7:14]),DES.MODE_ECB)
    des3 = DES.new(des_7key28key(password[14:]+b'\x00'*5),DES.MODE_ECB)
    cipher = des1.encrypt(data)+des2.encrypt(data)+des3.encrypt(data)
    return cipher

def ntlmv1_response(hash,server_challenge):
    return desl(hash,server_challenge)

def ntlmv1(passwd:str,server_challenge:str):
    lmhash = lm_hash(passwd)
    ntlmhash = ntlm_hash(passwd)
    server_challenge = binascii.a2b_hex(server_challenge)
    lm_response = ntlmv1_response(lmhash,server_challenge)
    ntlm_reponse = ntlmv1_response(ntlmhash,server_challenge)
    SessionBaseKey  = hashlib.new("md4",ntlmhash).digest()
    return lm_response,ntlm_reponse,SessionBaseKey

def main():
    password = "admin"
    server_challenge = "fe5b27eec00c4078"
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1(password,server_challenge)
    print(binascii.b2a_hex(lm_response)) #b'73c471c5d943991e4a04846625e872b5a7796a35c6963e0b'
    print(binascii.b2a_hex(ntlm_reponse)) #b'8926c7a5546090f1939868389d640c587188997dc948fb20'

hashcat.exe -m 5500 --hash-info
hashcat (v6.2.4) starting in hash-info mode

Hash Info:
==========

Hash mode #5500
  Name................: NetNTLMv1 / NetNTLMv1+ESS
  Category............: Network Protocols
  Slow.Hash...........: No
  Password.Len.Min....: 0
  Password.Len.Max....: 256
  Salt.Type...........: Embedded
  Salt.Len.Min........: 0
  Salt.Len.Max........: 256
  Kernel.Type(s)......: pure, optimized
  Example.Hash.Format.: plain
  Example.Hash........: ::5V4T:ada06359242920a500000000000000000000000000000000:0556d5297b5daa70eaffde82ef99293a3f3bb59b7c9704ea:9c23f6c094853920
  Example.Pass........: hashcat
  Benchmark.Mask......: ?b?b?b?b?b?b?b

hashcat.exe -m 5500 -a 3 :::73c471c5d943991e4a04846625e872b5a7796a35c6963e0b:8926c7a5546090f1939868389d640c587188997dc948fb20:fe5b27eec00c4078 ?l?l?l?l?l

import hashlib,binascii
from Crypto.Cipher import DES

def desl(password,data):
    if len(password) != 16:
        raise Exception("password length is not 16")
    des1 = DES.new(des_7key28key(password[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(password[7:14]),DES.MODE_ECB)
    des3 = DES.new(des_7key28key(password[14:]+b'\x00'*5),DES.MODE_ECB)
    cipher = des1.encrypt(data)+des2.encrypt(data)+des3.encrypt(data)
    return cipher

def ntlmv1_response(hash,server_challenge):
    return desl(hash,server_challenge)

def ntlmv1_session(passwd:str,server_challenge:str,client_challenge:str):
    ntlmhash = ntlm_hash(passwd)
    server_challenge = binascii.a2b_hex(server_challenge)
    client_challenge = binascii.a2b_hex(client_challenge)
    challenge = server_challenge+client_challenge
    challenge_md5 = hashlib.md5(challenge).digest()
    lm_response = client_challenge+16*b'\x00'
    ntlm_reponse = ntlmv1_response(ntlmhash,challenge_md5[0:8])
    SessionBaseKey  = hashlib.new("md4",ntlmhash).digest()
    return lm_response,ntlm_reponse,SessionBaseKey

def main():
    password = "admin"
    server_challenge = "39a3ce0f7efc4bb7"
    client_challenge = "c666a8c1224f89fc"
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1_session(password,server_challenge,client_challenge)
    print(binascii.b2a_hex(lm_response)) #b'c666a8c1224f89fc00000000000000000000000000000000'
    print(binascii.b2a_hex(ntlm_reponse)) 
![image-20221021164204-efdhaok.png](https://xzfile.aliyuncs.com/media/upload/picture/20231124121519-1407d97e-8a80-1.png)
#b'00811a4af35f4ea0f7e7dd72e2b94480c442ca4d94ba0328'

hashcat.exe -m 5500 -a 3 :::c666a8c1224f89fc00000000000000000000000000000000:00811a4af35f4ea0f7e7dd72e2b94480c442ca4d94ba0328:39a3ce0f7efc4bb7 ?l?l?l?l?l

import hashlib,hmac
def ntlmv2_hash(password,username,domain):
    ntlmhash = ntlm_hash(password)
    username = username.upper().encode('utf-16le')
    domain = domain.encode('utf-16le')
    ntlmv2hash = hmac.new(ntlmhash,username+domain,hashlib.md5).digest()
    return ntlmv2hash

import hashlib,hmac,binascii
def ntlmv2(passwd,username,domain,server_challenge,client_challenge,timestamp,avpairs):
    ntlmhash = ntlm_hash(passwd)
    ntlmv2hash = ntlmv2_hash(passwd,username,domain)
    server_challenge = binascii.a2b_hex(server_challenge)
    client_challenge = binascii.a2b_hex(client_challenge)
    timestamp = binascii.a2b_hex(timestamp)
    RespType_HiRespType_Reserved = binascii.a2b_hex("0101000000000000")
    temp = RespType_HiRespType_Reserved+timestamp+client_challenge+b'\x00'*4
    for avpair in avpairs:
        temp = temp + avpair
    temp = temp + b'\x00'*4
    NTProofStr = hmac.new(ntlmv2hash,server_challenge+temp,hashlib.md5).digest()
    ntlmv2_response = NTProofStr+temp
    lmv2_response = hmac.new(ntlmv2hash,server_challenge+client_challenge,hashlib.md5).digest()+client_challenge
    SessionBaseKey  = hmac.new(ntlmv2hash,NTProofStr,hashlib.md5).digest()
    return lmv2_response,ntlmv2_response,SessionBaseKey

def main():
    passwd = "admin"
    username = "administrator"
    domain = "xp"
    server_challenge = "4b00829f184a27e8"
    client_challenge = "2e1c413c13ae752c"
    timestamp = "0af748e18ee3d801"
    avpairs = [av_pair(2,"XP"),av_pair(1,"XP"),av_pair(4,"xp"),av_pair(3,"xp"),av_pair(0,"")]
    lmv2_response,ntlmv2_response,SessionBaseKey = ntlmv2(passwd,username,domain,server_challenge,client_challenge,timestamp,avpairs)
    hexdump(lmv2_response)
    hexdump(ntlmv2_response)

00000000: 77 E1 6D B0 92 AE 27 59  55 A6 F2 A4 EF 0B 1A 10  w.m...'YU.......
00000010: 2E 1C 41 3C 13 AE 75 2C                           ..A<..u,
00000000: A0 EE 2E 6A 12 F1 22 66  4D 03 10 4A C3 F2 9D 06  ...j.."fM..J....
00000010: 01 01 00 00 00 00 00 00  0A F7 48 E1 8E E3 D8 01  ..........H.....
00000020: 2E 1C 41 3C 13 AE 75 2C  00 00 00 00 02 00 04 00  ..A<..u,........
00000030: 58 00 50 00 01 00 04 00  58 00 50 00 04 00 04 00  X.P.....X.P.....
00000040: 78 00 70 00 03 00 04 00  78 00 70 00 00 00 00 00  x.p.....x.p.....
00000050: 00 00 00 00                                       ....

hashcat (v6.2.4) starting in hash-info mode

Hash Info:
==========

Hash mode #5600
  Name................: NetNTLMv2
  Category............: Network Protocols
  Slow.Hash...........: No
  Password.Len.Min....: 0
  Password.Len.Max....: 256
  Salt.Type...........: Embedded
  Salt.Len.Min........: 0
  Salt.Len.Max........: 256
  Kernel.Type(s)......: pure, optimized
  Example.Hash.Format.: plain
  Example.Hash........: 0UL5G37JOI0SX::6VB1IS0KA74:ebe1afa18b7fbfa6:aab8bf8675658dd2a939458a1077ba08:010100000000000031c8aa092510945398b9f7b7dde1a9fb00000000f7876f2b04b700
  Example.Pass........: hashcat
  Benchmark.Mask......: ?b?b?b?b?b?b?b
hashcat.exe -m 5600 -a 3 administrator::xp:4b00829f184a27e8:a0ee2e6a12f122664d03104ac3f29d06:01010000000000000af748e18ee3d8012e1c413c13ae752c0000000002000400580050000100040058005000040004007800700003000400780070000000000000000000 ?l?l?l?l?l

def kxkey_ntlmv1_LMKEY(lm_hash,lm_response):
    des1 = DES.new(des_7key28key(lm_hash[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(lm_hash[7:8]+b'\xbd'*6),DES.MODE_ECB)
    KeyExchangekey = des1.encrypt(lm_response[0:8])+des2.encrypt(lm_response[0:8])
    return KeyExchangekey

def kxkey_ntlmv1_NON_NT_SESSION(lm_hash):
    return lm_hash[0:8]+b'\x00'*8

def kxkey_ntlmv1_WITH_NT_SESSION(sessionbasekey,lm_response,server_challenge):
    server_challenge = binascii.a2b_hex(server_challenge)
    KeyExchangekey = hmac.new(sessionbasekey,server_challenge+lm_response[0:8],hashlib.md5).digest()
    return KeyExchangekey

#encoding:utf-8
import hashlib,binascii,hmac
from Crypto.Cipher import DES,ARC4
from hexdump import hexdump

def des_7key28key(passwd):
    #bytes转成二进制字符串，补齐56位
    key_bin_str = bin(int.from_bytes(passwd,byteorder='big',signed=False))[2:].rjust(56,'0')
    new_key = b''
    for i in range(0,56,7):
        #每7bit加1bit奇偶校验位
        one_byte = key_bin_str[i:i+7]
        if one_byte.count('1') % 2 == 0:
            new_byte = one_byte+'1'
        else:
            new_byte = one_byte+'0'
        new_key = new_key + bytes.fromhex(hex(int(new_byte,2))[2:].rjust(2,'0'))
    return new_key

def ntlm_hash(password):
    hash = hashlib.new("md4",password.encode("utf-16le")).digest()
    return hash

def ntlmv2_hash(password,username,domain):
    ntlmhash = ntlm_hash(password)
    username = username.upper().encode('utf-16le')
    domain = domain.encode('utf-16le')
    ntlmv2hash = hmac.new(ntlmhash,username+domain,hashlib.md5).digest()
    return ntlmv2hash

def lm_hash(password:str):
    data = "KGS!@#$%".encode('utf-8')
    password = password.upper().encode("utf-8")
    if len(password) < 14:
        password += b'\x00'*(14-len(password))
    des1 = DES.new(des_7key28key(password[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(password[7:14]),DES.MODE_ECB)
    hash = des1.encrypt(data)+des2.encrypt(data)
    return hash

def desl(password,data):
    if len(password) != 16:
        raise Exception("password length is not 16")
    des1 = DES.new(des_7key28key(password[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(password[7:14]),DES.MODE_ECB)
    des3 = DES.new(des_7key28key(password[14:]+b'\x00'*5),DES.MODE_ECB)
    cipher = des1.encrypt(data)+des2.encrypt(data)+des3.encrypt(data)
    return cipher

def ntlmv1_response(hash,server_challenge):
    return desl(hash,server_challenge)

def av_pair(avid:int,value:str):
    avid = avid.to_bytes(2,byteorder='little',signed=False)
    value = value.encode('utf-16le')
    avlen = len(value).to_bytes(2,byteorder='little',signed=False)
    return avid+avlen+value


def ntlmv1(passwd:str,server_challenge:str):
    lmhash = lm_hash(passwd)
    ntlmhash = ntlm_hash(passwd)
    server_challenge = binascii.a2b_hex(server_challenge)
    lm_response = ntlmv1_response(lmhash,server_challenge)
    ntlm_reponse = ntlmv1_response(ntlmhash,server_challenge)
    SessionBaseKey  = hashlib.new("md4",ntlmhash).digest()
    return lm_response,ntlm_reponse,SessionBaseKey




def ntlmv1_session(passwd:str,server_challenge:str,client_challenge:str):
    ntlmhash = ntlm_hash(passwd)
    server_challenge = binascii.a2b_hex(server_challenge)
    client_challenge = binascii.a2b_hex(client_challenge)
    challenge = server_challenge+client_challenge
    challenge_md5 = hashlib.md5(challenge).digest()
    lm_response = client_challenge+16*b'\x00'
    ntlm_reponse = ntlmv1_response(ntlmhash,challenge_md5[0:8])
    SessionBaseKey  = hashlib.new("md4",ntlmhash).digest()
    return lm_response,ntlm_reponse,SessionBaseKey

def ntlmv2(passwd,username,domain,server_challenge,client_challenge,timestamp,avpairs):
    ntlmhash = ntlm_hash(passwd)
    ntlmv2hash = ntlmv2_hash(passwd,username,domain)
    server_challenge = binascii.a2b_hex(server_challenge)
    client_challenge = binascii.a2b_hex(client_challenge)
    timestamp = binascii.a2b_hex(timestamp)
    RespType_HiRespType_Reserved = binascii.a2b_hex("0101000000000000")
    temp = RespType_HiRespType_Reserved+timestamp+client_challenge+b'\x00'*4
    for avpair in avpairs:
        temp = temp + avpair
    temp = temp + b'\x00'*4
    NTProofStr = hmac.new(ntlmv2hash,server_challenge+temp,hashlib.md5).digest()
    ntlmv2_response = NTProofStr+temp
    lmv2_response = hmac.new(ntlmv2hash,server_challenge+client_challenge,hashlib.md5).digest()+client_challenge
    SessionBaseKey  = hmac.new(ntlmv2hash,NTProofStr,hashlib.md5).digest()
    return lmv2_response,ntlmv2_response,SessionBaseKey

def kxkey_ntlmv1_LMKEY(lm_hash,lm_response):
    des1 = DES.new(des_7key28key(lm_hash[0:7]),DES.MODE_ECB)
    des2 = DES.new(des_7key28key(lm_hash[7:8]+b'\xbd'*6),DES.MODE_ECB)
    KeyExchangekey = des1.encrypt(lm_response[0:8])+des2.encrypt(lm_response[0:8])
    return KeyExchangekey

def kxkey_ntlmv1_NON_NT_SESSION(lm_hash):
    return lm_hash[0:8]+b'\x00'*8

def kxkey_ntlmv1_WITH_NT_SESSION(sessionbasekey,lm_response,server_challenge):
    server_challenge = binascii.a2b_hex(server_challenge)
    KeyExchangekey = hmac.new(sessionbasekey,server_challenge+lm_response[0:8],hashlib.md5).digest()
    return KeyExchangekey


def responsetest():
    passwd = "admin"
    username = "administrator"
    domain = "xp"
    server_challenge = "4b00829f184a27e8"
    client_challenge = "2e1c413c13ae752c"
    timestamp = "0af748e18ee3d801"
    avpairs = [av_pair(2,"XP"),av_pair(1,"XP"),av_pair(4,"xp"),av_pair(3,"xp"),av_pair(0,"")]
    lmv2_response,ntlmv2_response,SessionBaseKey = ntlmv2(passwd,username,domain,server_challenge,client_challenge,timestamp,avpairs)
    hexdump(lmv2_response)
    hexdump(ntlmv2_response)
    print(binascii.b2a_hex(ntlmv2_response))
    #ntlm v1 with v2 session test
    password = "admin"
    server_challenge = "39a3ce0f7efc4bb7"
    client_challenge = "c666a8c1224f89fc"
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1_session(password,server_challenge,client_challenge)
    print(binascii.b2a_hex(lm_response))
    print(binascii.b2a_hex(ntlm_reponse))
    #ntlm v1 test
    password = "admin"
    server_challenge = "fe5b27eec00c4078"
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1(password,server_challenge)
    print(binascii.b2a_hex(lm_response))
    print(binascii.b2a_hex(ntlm_reponse))

def sessiontest():
    passwd = "Password"
    username = "User"
    domain = "Domain"
    server_name = "Server"
    workstation_name = "COMPUTER"
    RandomSessionKey = "UUUUUUUUUUUUUUUU"
    client_challenge = "aaaaaaaaaaaaaaaa"
    server_challenge = "0123456789abcdef"
    lmhash = lm_hash(passwd)
    ntlmhash = ntlm_hash(passwd)
    #ntlmv2
    timestamp = "0000000000000000"
    avpairs = [av_pair(2,domain),av_pair(1,server_name),av_pair(0,"")]
    lmv2_response,ntlmv2_response,SessionBaseKey = ntlmv2(passwd,username,domain,server_challenge,client_challenge,timestamp,avpairs)
    hexdump(SessionBaseKey)
    hexdump(lmv2_response)
    hexdump(ntlmv2_response)
    rc4 = ARC4.new(SessionBaseKey)
    cipher = rc4.encrypt(RandomSessionKey.encode('utf-8'))
    hexdump(cipher)

    #ntlmv1 with v2 session
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1_session(passwd,server_challenge,client_challenge)
    hexdump(ntlmhash)
    kxkey = kxkey_ntlmv1_WITH_NT_SESSION(SessionBaseKey,lm_response,server_challenge)
    hexdump(kxkey)
    hexdump(SessionBaseKey)
    hexdump(lm_response)
    hexdump(ntlm_reponse)
    #ntlmv1
    lm_response,ntlm_reponse,SessionBaseKey = ntlmv1(passwd,server_challenge)
    hexdump(SessionBaseKey)
    hexdump(lm_response)
    hexdump(ntlm_reponse)
    kxkey_LMKEY = kxkey_ntlmv1_LMKEY(lmhash,lm_response)
    hexdump(kxkey_LMKEY)
    kxkey_NON_NT_SESSION = kxkey_ntlmv1_NON_NT_SESSION(lmhash)
    hexdump(kxkey_NON_NT_SESSION)
    hexdump(SessionBaseKey)
    rc4 = ARC4.new(kxkey_LMKEY)
    cipher = rc4.encrypt(RandomSessionKey.encode('utf-8'))
    hexdump(cipher)
    rc4 = ARC4.new(kxkey_NON_NT_SESSION)
    cipher = rc4.encrypt(RandomSessionKey.encode('utf-8'))
    hexdump(cipher)
    rc4 = ARC4.new(SessionBaseKey)
    cipher = rc4.encrypt(RandomSessionKey.encode('utf-8'))
    hexdump(cipher)

#ntlm.py
#NEGOTIATE_MESSAGE
class NTLMAuthNegotiate(Structure):

    structure = (
        ('','"NTLMSSP\x00'),
        ('message_type','<L=1'),
        ('flags','<L'),
        ('domain_len','<H-domain_name'),
        ('domain_max_len','<H-domain_name'),
        ('domain_offset','<L=0'),
        ('host_len','<H-host_name'),
        ('host_maxlen','<H-host_name'),
        ('host_offset','<L=0'),
        ('os_version',':'),
        ('host_name',':'),
        ('domain_name',':'))

#CHALLENGE_MESSAGE
class NTLMAuthChallenge(Structure):

    structure = (
        ('','"NTLMSSP\x00'),
        ('message_type','<L=2'),
        ('domain_len','<H-domain_name'),
        ('domain_max_len','<H-domain_name'),
        ('domain_offset','<L=40'),
        ('flags','<L=0'),
        ('challenge','8s'),
        ('reserved','8s=""'),
        ('TargetInfoFields_len','<H-TargetInfoFields'),
        ('TargetInfoFields_max_len','<H-TargetInfoFields'),
        ('TargetInfoFields_offset','<L'),
        ('VersionLen','_-Version','self.checkVersion(self["flags"])'), 
        ('Version',':'),
        ('domain_name',':'),
        ('TargetInfoFields',':'))

#AUTHENTICATE_MESSAGE
class NTLMAuthChallengeResponse(Structure):

    structure = (
        ('','"NTLMSSP\x00'),
        ('message_type','<L=3'),
        ('lanman_len','<H-lanman'),
        ('lanman_max_len','<H-lanman'),
        ('lanman_offset','<L'),
        ('ntlm_len','<H-ntlm'),
        ('ntlm_max_len','<H-ntlm'),
        ('ntlm_offset','<L'),
        ('domain_len','<H-domain_name'),
        ('domain_max_len','<H-domain_name'),
        ('domain_offset','<L'),
        ('user_len','<H-user_name'),
        ('user_max_len','<H-user_name'),
        ('user_offset','<L'),
        ('host_len','<H-host_name'),
        ('host_max_len','<H-host_name'),
        ('host_offset','<L'),
        ('session_key_len','<H-session_key'),
        ('session_key_max_len','<H-session_key'),
        ('session_key_offset','<L'),
        ('flags','<L'),
        ('VersionLen','_-Version','self.checkVersion(self["flags"])'), 
        ('Version',':=""'),
        ('MICLen','_-MIC','self.checkMIC(self["flags"])'),
        ('MIC',':=""'),
        ('domain_name',':'),
        ('user_name',':'),
        ('host_name',':'),
        ('lanman',':'),
        ('ntlm',':'),
        ('session_key',':'))

#ntlm.py
def __expand_DES_key(key):
    # Expand the key from a 7-byte password key into a 8-byte DES key
    if not isinstance(key, bytes):
        key = bytes(key)
    key  = bytearray(key[:7]).ljust(7, b'\x00')
    s = bytearray()
    s.append(((key[0] >> 1) & 0x7f) << 1)
    s.append(((key[0] & 0x01) << 6 | ((key[1] >> 2) & 0x3f)) << 1)
    s.append(((key[1] & 0x03) << 5 | ((key[2] >> 3) & 0x1f)) << 1)
    s.append(((key[2] & 0x07) << 4 | ((key[3] >> 4) & 0x0f)) << 1)
    s.append(((key[3] & 0x0f) << 3 | ((key[4] >> 5) & 0x07)) << 1)
    s.append(((key[4] & 0x1f) << 2 | ((key[5] >> 6) & 0x03)) << 1)
    s.append(((key[5] & 0x3f) << 1 | ((key[6] >> 7) & 0x01)) << 1)
    s.append((key[6] & 0x7f) << 1)
    return bytes(s)

def __DES_block(key, msg):
    cipher = DES.new(__expand_DES_key(key),DES.MODE_ECB)
    return cipher.encrypt(msg)

def ntlmssp_DES_encrypt(key, challenge):
    answer  = __DES_block(key[:7], challenge)
    answer += __DES_block(key[7:14], challenge)
    answer += __DES_block(key[14:], challenge)
    return answer

#ntlm.py
def compute_lmhash(password):
    # This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
    password = password.upper()
    lmhash  = __DES_block(b(password[:7]), KNOWN_DES_INPUT)
    lmhash += __DES_block(b(password[7:14]), KNOWN_DES_INPUT)
    return lmhash

def compute_nthash(password):
    # This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
    try:
        password = str(password).encode('utf_16le')
    except UnicodeDecodeError:
        import sys
        password = password.decode(sys.getfilesystemencoding()).encode('utf_16le')

    hash = MD4.new()
    hash.update(password)
    return hash.digest()

#ntlm.py
def LMOWFv1(password, lmhash = '', nthash=''):
    if lmhash != '':
       return lmhash
    return compute_lmhash(password)

def NTOWFv1(password, lmhash = '', nthash=''):
    if nthash != '':
       return nthash
    return compute_nthash(password)   

def get_ntlmv1_response(key, challenge):
    return ntlmssp_DES_encrypt(key, challenge)

def generateSessionKeyV1(password, lmhash, nthash):
    hash = MD4.new()
    hash.update(NTOWFv1(password, lmhash, nthash))
    return hash.digest()

def computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',
                          nthash='', use_ntlmv2=USE_NTLMv2):
    if user == '' and password == '':
        # Special case for anonymous authentication
        lmResponse = ''
        ntResponse = ''
    else:
        lmhash = LMOWFv1(password, lmhash, nthash)
        nthash = NTOWFv1(password, lmhash, nthash)
        if flags & NTLMSSP_NEGOTIATE_LM_KEY:
           ntResponse = ''
           lmResponse = get_ntlmv1_response(lmhash, serverChallenge)
        elif flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
           md5 = hashlib.new('md5')
           chall = (serverChallenge + clientChallenge)
           md5.update(chall)
           ntResponse = ntlmssp_DES_encrypt(nthash, md5.digest()[:8])
           lmResponse = clientChallenge + b'\x00'*16
        else:
           ntResponse = get_ntlmv1_response(nthash,serverChallenge)
           lmResponse = get_ntlmv1_response(lmhash, serverChallenge)

    sessionBaseKey = generateSessionKeyV1(password, lmhash, nthash)
    return ntResponse, lmResponse, sessionBaseKey

#ntlm.py
def hmac_md5(key, data):
    import hmac
    h = hmac.new(key, digestmod=hashlib.md5)
    h.update(data)
    return h.digest()

def NTOWFv2( user, password, domain, hash = ''):
    if hash != '':
       theHash = hash 
    else:
       theHash = compute_nthash(password)
    return hmac_md5(theHash, user.upper().encode('utf-16le') + domain.encode('utf-16le'))

def LMOWFv2( user, password, domain, lmhash = ''):
    return NTOWFv2( user, password, domain, lmhash)

def computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',
                          nthash='', use_ntlmv2=USE_NTLMv2):

    responseServerVersion = b'\x01'
    hiResponseServerVersion = b'\x01'
    responseKeyNT = NTOWFv2(user, password, domain, nthash)

    av_pairs = AV_PAIRS(serverName)
    # In order to support SPN target name validation, we have to add this to the serverName av_pairs. Otherwise we will
    # get access denied
    # This is set at Local Security Policy -> Local Policies -> Security Options -> Server SPN target name validation
    # level
    if TEST_CASE is False:
        av_pairs[NTLMSSP_AV_TARGET_NAME] = 'cifs/'.encode('utf-16le') + av_pairs[NTLMSSP_AV_HOSTNAME][1]
        if av_pairs[NTLMSSP_AV_TIME] is not None:
           aTime = av_pairs[NTLMSSP_AV_TIME][1]
        else:
           aTime = struct.pack('<q', (116444736000000000 + calendar.timegm(time.gmtime()) * 10000000) )
           av_pairs[NTLMSSP_AV_TIME] = aTime
        serverName = av_pairs.getData()
    else:
        aTime = b'\x00'*8

    temp = responseServerVersion + hiResponseServerVersion + b'\x00' * 6 + aTime + clientChallenge + b'\x00' * 4 + \
           serverName + b'\x00' * 4

    ntProofStr = hmac_md5(responseKeyNT, serverChallenge + temp)

    ntChallengeResponse = ntProofStr + temp
    lmChallengeResponse = hmac_md5(responseKeyNT, serverChallenge + clientChallenge) + clientChallenge
    sessionBaseKey = hmac_md5(responseKeyNT, ntProofStr)

    if user == '' and password == '':
        # Special case for anonymous authentication
        ntChallengeResponse = ''
        lmChallengeResponse = ''

    return ntChallengeResponse, lmChallengeResponse, sessionBaseKey