Overpass the Hash
Overpass the Hash
To execute this attack, the initial step involves acquiring the NTLM hash or password of the targeted user's account. Upon securing this information, a Ticket Granting Ticket (TGT) for the account can be obtained, allowing the attacker to access services or machines to which the user has permission.
Step-by-Step Guide for Generating TGT and Using Mimikatz:
Step 1: Run a Process Under the Target User (if Needed)
If the victim user has no processes running under their account, run a process as that user. This is to cache the credentials in memory for Mimikatz to retrieve.
Note: This step is primarily for demonstration or testing purposes and is not necessary in real-world scenarios where processes are already running under the user.
Step 2: Run Mimikatz to Fetch the User's Hash
Launch Mimikatz with elevated privileges (System or Administrative rights are required).
Execute the following commands within Mimikatz:
.\mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords" "exit"Explanation:
privilege::debug: Grants the necessary debug privileges.log: Saves output to a log file.sekurlsa::logonpasswords: Extracts credentials (including hashes) of users logged on to the system.exit: Exits Mimikatz.
Step 3: Collect the User's Hash
Identify and collect the NTLM hash for the target user from the Mimikatz output. For example:
Step 4: Generate a TGT Using Mimikatz
Use Mimikatz to generate a Kerberos Ticket Granting Ticket (TGT) for the account.
Run the following command:
Explanation:
sekurlsa::pth: Pass-the-hash technique to authenticate with the target NTLM hash./user:jen: Specifies the target user./domain:corp.com: Specifies the domain of the account./ntlm:<hash>: Specifies the NTLM hash of the account./run:powershell: Launches PowerShell with the generated TGT.
The hash should correspond to the user whose username you have mentioned. 😶
Step 5: Verify Cached Kerberos Tickets
In the PowerShell session that opens, check for cached Kerberos tickets:
If no TGT is found, establish a connection with a network resource to generate the ticket:
List the tickets again:
Step 6: Use the Generated TGT to Access Resources
If the TGT is successfully generated, use it to access resources.
For example, use
PsExecto run a command shell on a remote system:
Last updated