Right now, my RDP honeypot collects only the NTLM response blob from the attacker. I was wondering if these were crackable, e.g., with Hashcat, so I asked ChatGPT. Turns out, they aren't, because the server challenge isn't logged. "If you point me to the source of your honeypot," it said, "I can tell you exactly which lines to patch and how, so that the honeypot logs all the necessary info". Sounds good, so I pointed it at the repo. Its advice?

- Go to the directory rdpy/protocols/rdp/nla. (Doesn't exist; it's "protocol", not "protocols".)

- Edit the file ntlm.py (Okay.)

- Look for a function named "..." (Doesn't exist.)

- Find a line that says "..." (No such line in the entire file.)

- Change it to "..." (I gave up at this point.