Pass The Hash

Pass the Hash

Use the hash to login in another machine as a local user without knowing its password. Works because NTLM hashes are static so if a user logs into different machines his hash will remain the same on each host.

  • NTLM based

  • Requires the SMB port to be reachable on the target

  • The user/service must have admin rights on the target machine

lsadump::sam 
lsadump::lsa /inject /name:<user>
sekurlsa::logonpasswords

Exploit

sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<NTLM or :NT> /run:<cmd>

Pass the Ticket

Loads a ticket in memory granting the current user access to the remote machine/service within the context of the current session.

  • Kerberos based

  • Alternative to PTH if NTLM authentication is disabled

  • Can be exploited even if the current user/service is not an admin on the target machine

Exploit

OverPass the Hash / Pass the Key

Obtain a TGT ticket by providing a valid NTLM hash, AES keys, DES keys or password. The obtained TGT token can then be used to access other machines.

  • Kerberos Based

  • Alternative to PTH if NTLM authentication is disabled

  • Can be exploited starting from NTLM, secret keys or password (see password to NTLM)

  • Can be exploited even if the current user/service is not an admin on the target machine

  • Requests a new TGT, as such the attack is not limited to the tickets stored in memory

Exploit

PreviousConnectionNextKerberoast

Last updated