From a81caa205239ce1425bfeb71b66fc56076d8302c Mon Sep 17 00:00:00 2001
From: rxwx <2202542+rxwx@users.noreply.github.com>
Date: Mon, 31 Oct 2022 08:31:23 +0000
Subject: [PATCH] Add support for specifying passwords in NTLM format

---
 SharpDPAPI/lib/Dpapi.cs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/SharpDPAPI/lib/Dpapi.cs b/SharpDPAPI/lib/Dpapi.cs
index 4bea0a9..d4bba88 100755
--- a/SharpDPAPI/lib/Dpapi.cs
+++ b/SharpDPAPI/lib/Dpapi.cs
@@ -8,6 +8,7 @@ using System.Linq;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
+using System.Text.RegularExpressions;
 
 namespace SharpDPAPI
 {
@@ -1766,7 +1767,9 @@ namespace SharpDPAPI
             else
             {
                 //Calculate NTLM from user password. Kerberos's RC4_HMAC key is the NTLM hash
-                var rc4Hash = Crypto.KerberosPasswordHash(Interop.KERB_ETYPE.rc4_hmac, password);
+                //Skip NTLM hashing if the password is in NTLM format
+                string rc4Hash = Regex.IsMatch(password, "^[a-f0-9]{32}$", RegexOptions.IgnoreCase) ? password : 
+                    Crypto.KerberosPasswordHash(Interop.KERB_ETYPE.rc4_hmac, password);
 
                 var ntlm = Helpers.ConvertHexStringToByteArray(rc4Hash);