Internal-Monologue

Windows C# proof-of-concept that uses SSPI to elicit NetNTLM challenge-response material for the current user and, when elevated, can temporarily lower NTLM client settings, enumerate process tokens, impersonate eligible logged-on users, and restore the previous registry values. It does not read LSASS memory or send the challenge over the network. The output is a NetNTLM response, not the underlying NT hash; it may be NetNTLMv1 when downgrade succeeds or NetNTLMv2 when it does not. Without elevation, the program handles only the current user under existing NTLM settings.