In cybersecurity, "decoding" an NTLM hash often means it. NTLM hashes (MD4-based) are technically one-way functions, meaning they cannot be "undone". Instead, you must guess the password, hash it, and see if it matches the target. Common Tools & Techniques NTLM Explained: Definition, Protocols & More | CrowdStrike
If you don't have the password but have the NT hash , you can actually provide it in a Kerberos keytab file ; Wireshark will use it to derive the session keys and decrypt the traffic. 3. Decoding (Cracking) NTLM Hashes ntlm decode
# Create an NTLM object ntlm = NTLM()
The decoding process involves: