This article introduces ntlmrain, a project designed to optimize NetNTLMv1 rainbow table lookups. By implementing a custom lossless compression format called GRTB, the project reduces the original 8 TiB dataset to fit on a standard 4 TB consumer disk. This format utilizes 39-bit packed starts, Rice-16 coding for endpoint differences, and adaptive 4 KiB pages to ensure fast random-access lookups on common SSDs.
In addition to storage optimizations, the project provides a browser-based WebGPU client and a native CLI tool. These tools allow for local precomputation and candidate verification, ensuring that the actual NetNTLMv1 responses and cracked hashes never leave the user's environment. A central lookup service is also hosted, enabling security professionals to recover NT hashes without needing to download or maintain the multi-terabyte table collection themselves.
Top comments (0)