Add Wireshark Decryption Helpers for NTLMv2/SMB Session Keys and Kerberos Keytab Generation

[solcoteh]

Hello CyberChef team,

I would like to suggest a set of CyberChef operations to help with authorized Windows network traffic analysis, especially when working with SMB2/SMB3, NTLMv2, Kerberos, Active Directory, and Wireshark decryption workflows.

While working on SMB, Kerberos, and Active Directory traffic analysis in CTF, lab, forensics, and DFIR scenarios, I noticed that several common decryption workflows still require analysts to manually combine multiple tools, scripts, command-line utilities, and low-level cryptographic operations.

CyberChef already provides many of the required primitives, such as UTF-16LE encoding, HMAC-MD5, RC4, hex/base64 handling, and binary transformations. However, the complete workflow is still difficult for many analysts and students because they need to understand the full NTLMv2 session key derivation process or manually create Kerberos keytab files using external tools such as ktutil, Metasploit modules, or custom scripts.

It would be very useful if CyberChef could provide dedicated operations for:

• Generating NTLMv2 / SMB session keys for Wireshark SMB2/SMB3 decryption
• Generating Wireshark-compatible Kerberos/KRB5 keytab files from user-provided keys
• Helping analysts move from known, authorized authentication material to Wireshark-ready decryption inputs

Possible operation names could include:

• Generate NTLMv2 SMB Session Key
• Calculate SMB Session Key from NTLMv2
• SMB2/SMB3 Wireshark Session Key Generator
• Generate Kerberos Keytab
• Build KRB5 Keytab
• Create Wireshark Keytab
• Kerberos Keytab from Keys
• NT Hash to Wireshark Keytab

Part 1: NTLMv2 / SMB Session Key Generator

The first operation would take the required NTLMv2 values and generate the final SMB session key that can be imported into Wireshark under:

Edit → Preferences → Protocols → SMB2 → Secret session keys for decryption

This would help analysts decrypt SMB2/SMB3 traffic when they already have the required authorized values.

Possible required inputs:

• Username
• Domain / Workgroup
• NT hash, or optionally plaintext password
• NTProofStr
• Encrypted Session Key

Possible optional inputs:

• SMB Session ID
• Server Challenge
• NTLMv2 Blob
• Full NTLMv2 hash line
• Negotiate flags
• Output format selector

Expected outputs:

• ResponseKeyNT
• SessionBaseKey / KeyExchangeKey
• Decrypted Random Session Key / Exported Session Key
• Wireshark-ready Session ID + Session Key pair
• Optional JSON output
• Optional CyberChef table output
• Optional explanation of each intermediate value

The current manual workflow looks like this:

Step 1: Calculate ResponseKeyNT

Input:

USERNAME + DOMAIN

Example:

ESHELLSTROPWORKGROUP

Operations:

• Encode text as UTF-16LE

• HMAC-MD5

  • Key: NT hash
  • Key format: Hex

Output:

ResponseKeyNT

Step 2: Calculate SessionBaseKey / KeyExchangeKey

Input:

NTProofStr

Operations:

• From Hex

• HMAC-MD5

  • Key: ResponseKeyNT
  • Key format: Hex

Output:

SessionBaseKey / KeyExchangeKey

Step 3: Decrypt Encrypted Session Key

Input:

Encrypted Session Key from Wireshark

Operations:

• From Hex

• RC4

  • Key: SessionBaseKey / KeyExchangeKey
  • Key format: Hex
  • Input format: Hex
  • Output format: Hex

Output:

Random Session Key / Exported Session Key

Step 4: Use the generated key in Wireshark

Edit → Preferences → Protocols → SMB2
Secret session keys for decryption → Add

Session ID:

Session Key:

This is technically possible today using manual CyberChef recipes, but a dedicated operation would reduce mistakes and make the workflow much more accessible to analysts, students, and defenders.

A good user experience could support multiple input modes.

Input mode 1: Manual NTLMv2 fields

• Username
• Domain
• NT hash
• NTProofStr
• Encrypted Session Key
• Optional Session ID

Input mode 2: Full NTLMv2 hash line

• Full NTLMv2 hash line
• Encrypted Session Key
• Optional Session ID

Input mode 3: Parsed PCAP extraction output

• Parsed NTLMSSP fields from a previous CyberChef operation
• Automatically use extracted values such as username, domain, NTProofStr, encrypted session key, and Session ID where available

Possible output modes:

Raw session key only

<session_key>

Wireshark-ready table format

Session ID: <session_id>
Session Key: <session_key>

JSON output

{
"username": "...",
"domain": "...",
"responseKeyNT": "...",
"sessionBaseKey": "...",
"encryptedSessionKey": "...",
"sessionKey": "...",
"wireshark": {
"sessionId": "...",
"sessionKey": "..."
}
}

This operation would be useful for:

• SMB2/SMB3 traffic decryption in Wireshark
• DFIR investigations
• SOC packet analysis
• CTF challenges
• Windows authentication learning
• NTLMv2 calculation validation
• Reducing manual copy/paste mistakes between multiple tools
• Teaching how NTLMv2 session key derivation works

Part 2: Kerberos / KRB5 Keytab Generator

The second operation would generate Wireshark-compatible Kerberos keytab files from user-provided Kerberos keys or NT hashes.

When analyzing Windows and Active Directory network traffic in Wireshark, it is often possible to decrypt Kerberos, DCE/RPC, LDAP, SMB, or NTLMSSP-related encrypted data if the analyst has the correct authorized keys. However, creating a usable keytab file is not always simple, especially in CTF, lab, DFIR, and research environments.

In many cases, analysts may already have one or more of the following:

• NT hash of a user
• NT hash of a machine account
• RC4-HMAC Kerberos key
• AES128 Kerberos key
• AES256 Kerberos key
• Principal name
• Realm
• KVNO
• Encryption type

However, they still need an external tool such as ktutil, Metasploit auxiliary/admin/kerberos/keytab, or a custom GitHub script to build a keytab file that Wireshark can consume.

It would be very useful if CyberChef could accept one or more key entries and generate a binary .keytab file as output.

For each key entry, the operation could accept:

• Principal
• Realm
• KVNO
• Encryption type
• Key value in hex

Supported encryption types could include:

• RC4-HMAC / etype 23
• AES128-CTS-HMAC-SHA1-96 / etype 17
• AES256-CTS-HMAC-SHA1-96 / etype 18

A very useful shortcut would be:

Input:

• Username or principal
• Realm
• NT hash

Output:

• A keytab entry using RC4-HMAC / etype 23, because in this specific case the RC4 key is the NT hash

Important note:

CyberChef should be careful not to imply that all Kerberos key types can be generated from only an NT hash. From an NT hash alone, the practical Wireshark-compatible use case is mainly RC4-HMAC / etype 23.

AES128 and AES256 entries should require the actual AES keys, or a separate password-based derivation feature if the maintainers decide to support that later.

A possible Kerberos keytab workflow could be:

1. The analyst obtains authorized keys from a lab, CTF, memory dump, or DFIR source.
2. The analyst opens CyberChef.
3. The analyst selects “Generate Kerberos Keytab”.
4. The analyst adds one or more entries.

Example entry 1:

Principal: eshellstrop
Realm: WORKGROUP
KVNO: 1
Encryption type: RC4-HMAC / 23
Key: 3f29138a04aadc19214e9c04028bf381

Example entry 2:

Principal: cifs/server.example.local
Realm: EXAMPLE.LOCAL
KVNO: 2
Encryption type: AES256 / 18
Key:

5. CyberChef outputs:

• Binary .keytab file
• Optional Base64 representation
• Optional hex representation
• Optional summary table

6. The analyst loads the generated keytab into Wireshark:

Edit → Preferences → Protocols → KRB5
Enable Kerberos decryption
Select the generated keytab file

This would be helpful because Wireshark can use keytab files to decrypt Kerberos traffic when the correct keys are available. It can also help with some NTLMSSP-related workflows where an NT hash is placed into a keytab as RC4-HMAC / etype 23.

Useful options could include:

• Add one key
• Add multiple keys
• Import keys from CSV
• Import keys from JSON
• Import keys from lines in the format:
  principal,realm,kvno,etype,key
• Export binary .keytab
• Export CyberChef-friendly hex/base64
• Validate key length for the selected encryption type
• Warn if the key length does not match the selected encryption type
• Show a Wireshark usage note after generation

Example validation rules:

• etype 23 / RC4-HMAC: 16-byte key / 32 hex characters
• etype 17 / AES128: 16-byte key / 32 hex characters
• etype 18 / AES256: 32-byte key / 64 hex characters

This would make the feature beginner-friendly and reduce common mistakes.

Combined workflow

Together, these operations would create a very useful CyberChef workflow for authorized Windows network forensics:

1. The analyst collects or extracts authorized NTLMv2, SMB, Kerberos, or key material.
2. CyberChef calculates the SMB session key or builds the Kerberos keytab.
3. CyberChef outputs Wireshark-ready values.
4. The analyst imports the result into Wireshark.
5. Wireshark decrypts SMB2/SMB3 or Kerberos traffic where the provided keys are valid.

These features would be useful for:

• Windows network forensics
• Active Directory traffic analysis
• Kerberos research
• SMB2/SMB3 traffic decryption
• DFIR investigations
• SOC packet analysis
• CTF challenges
• Wireshark training
• Windows protocol learning
• Decrypting authorized lab captures
• Creating keytabs without installing extra tooling
• Validating NTLMv2 and Kerberos-related calculations

Important safety boundaries

These operations should remain purely local, static, and defensive in nature.

They should not:

• Crack passwords
• Extract secrets from systems
• Perform DCSync
• Attack Kerberos
• Request Kerberos tickets
• Attempt authentication
• Connect to any network service
• Perform live capture or sniffing
• Automate login attempts
• Access remote systems

They should only:

• Calculate values from user-provided inputs
• Generate Wireshark-compatible outputs
• Work locally/browser-side
• Include a clear warning that users must only use keys, hashes, and captures they are authorized to analyze

This would fit CyberChef very well because CyberChef is already excellent at transforming structured data, binary data, hex, Base64, and cryptographic material. These operations would package existing low-level building blocks into reliable, documented, repeatable, analyst-friendly workflows.

References

Microsoft NTLM / MS-NLMP session key logic:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/c0250a97-2940-40c7-82fb-20d208c71e96

Microsoft SMB2 session key handling:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/7fd079ca-17e6-4f02-8449-46b606ea289c

Microsoft SMB2 GSS-API authentication notes:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/5ed93f06-a1d2-4837-8954-fa8b833c2654

Samba Wireshark decryption notes:
https://wiki.samba.org/index.php/Wireshark_Decryption

Wireshark Kerberos wiki:
https://wiki.wireshark.org/Kerberos

Wireshark NTLMSSP wiki:
https://wiki.wireshark.org/NTLMSSP

MIT Kerberos ktutil documentation:
https://web.mit.edu/kerberos/krb5-devel/doc/admin/admin_commands/ktutil.html

MIT Kerberos keytab documentation:
https://web.mit.edu/kerberos/krb5-latest/doc/basic/keytab_def.html

Linux ktutil man page:
https://linux.die.net/man/8/ktutil

Decrypting SMB3 Traffic with just a PCAP:
https://medium.com/maverislabs/decrypting-smb3-traffic-with-just-a-pcap-absolutely-maybe-712ed23ff6a2

SMB session key generator example:
https://github.com/jozwikaleksander/smb-sessionkey-gen

Random session key calculation examples:
https://gist.github.com/khr0x40sh/747de1195bbe19f752e5f02dc22fce01
https://gist.github.com/h4sh5/1cc22aa46037f253ca6c785d846b8cf3
https://gist.github.com/cicero343/b8eac1a5e5ac46d15ac8dee805388fc4

Dirk-jan Mollema keytab.py example:
https://github.com/dirkjanm/forest-trust-tools/blob/master/keytab.py

Tenable article about decrypting Kerberos/NTLM encrypted stub data in Wireshark:
https://medium.com/tenable-techblog/decrypt-encrypted-stub-data-in-wireshark-deb132c076e7

KeyTabExtract:
https://github.com/sosdave/KeyTabExtract

Thank you very much for considering this feature request.

I believe these additions would make CyberChef even more valuable for Windows network forensics, Active Directory analysis, SMB/Kerberos learning, Wireshark training, and authorized DFIR workflows.

[mansiverma897993]

@GCHQDeveloper581 @solcoteh can you assign this issue to me !1

[GCHQDeveloper581]

I'd want to see this broken down into multiple smaller PRs rather than receive the whole thing as one massive chunk.

Smaller PRs are much more likely to be reviewed/merged in a timely manner.

[mansiverma897993]

@GCHQDeveloper581

I have broken down the implementation into two smaller, separate pull requests as requested:
NTLMv2 / SMB Session Key Generator: Raised in PR #2663.
Kerberos / KRB5 Keytab Generator: Raised in PR #2664.
Both pull requests include complete operational test coverage and are fully passing all build and linter checks. Please let me know if you have any feedback!