This is a static archive of our old Q&A Site. Please post any new questions and answers at

DCE/RPC with NTLMSSP decryption


Hi, I have pcap containing DCE/RPC traffic whith authentication over NTLMSSP at the beginning. Is it possible with Wireshark to decrypt DCE/RPC communication provided I have NTLMSSP NT password?

asked 09 Oct '17, 04:36

berma's gravatar image

accept rate: 0%

EDIT: In NTLMSSP protocol preferences I entered the NT Password, but still in DCE/RPC packets I see "Ecrypted stub data" instead of decrypted content.

(09 Oct '17, 05:41) berma