Anatomy of NTLMv1/NTLMv1-SSP

There has been some confusion about NTLMv1 and NTLMv1-SSP reversing to NTLM hashes using hashcats mode 14000. This was largely due to a talk at Derbycon that had some incomplete information combined with a few forum posts on hashcat.net. In order to simplify the process as much as possible a tool called the NTLMv1 multi tool was created to automate most of the steps in converting an NTLMv1 and NTLMv1-SSP hash into a hashcat challenge file.