Pass-the-Hash Techniques Enable Windows Active Directory Lateral Movement
Summary
A technical walkthrough demonstrates NTLM hash-based lateral movement across Windows Active Directory services using tools including NetExec, Impacket, Mimikatz and Rubeus, and outlines mitigations such as Credential Guard and restricting NTLM.
Key points
- Pass-the-Hash uses an NTLM hash to authenticate without the plaintext password.
- The lab walkthrough demonstrates hash-based access and command execution across SMB, WinRM, WMI, MSSQL, RDP and LDAP.
- Examples use NetExec, Impacket, Metasploit, Evil-WinRM, Mimikatz and Rubeus.
- The article describes Overpass-the-Hash with Rubeus to request a Kerberos ticket using an NTLM hash.
- Suggested defenses include Credential Guard, restricting NTLM, least privilege, tiered administration and limiting WinRM access.
Article Details
- Topic
- Pass-the-Hash lateral movement across Windows Active Directory services, including SMB, WinRM, WMI, MSSQL, RDP, and LDAP.
MITRE ATT&CK
T1003.006 · DCSyncThe article refers to DCSync credential dumping in its description of the attack chain.T1021.001 · Remote Desktop ProtocolThe article demonstrates establishing an RDP session using an NTLM hash.T1021.002 · SMB/Windows Admin SharesThe article demonstrates remote command execution over SMB using NTLM hashes.T1021.006 · Windows Remote ManagementThe article demonstrates remote access and command execution over WinRM using NTLM hashes.T1047 · Windows Management InstrumentationThe article demonstrates remote command execution through WMI using NTLM hash authentication.T1550.002 · Pass the HashThe article demonstrates authenticating to Windows systems using captured NTLM hashes without plaintext passwords.
Vendors
Products
Credential Guardcommand examples for lateral movement and credential dumping, and mitigation strategies such as Credential Guard, NTLM restrictions, and tiered administration.Microsoft Active DirectoryThis article provides a technical walkthrough of Pass-the-Hash (PtH) attacks against Windows Active Directory, demonstrating exploitation across SMB, WinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket,Windows 10Target OS Build: Windows 10 / Server 2019 Build 17763 x64Windows Server 2019It includes a lab setup (ignite.local with a Windows Server 2019 DC), detailed command examples for lateral movement and credential dumping, and mitigation strategies such as Credential Guard, NTLM restrictions, and
Tools
Evil-WinRMexploitation across SMB, WinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.ImpacketDirectory, demonstrating exploitation across SMB, WinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.ldeepldeep is a Python-based Active Directory enumeration tool designed specifically for LDAP recon.Metasploit Frameworkdemonstrating exploitation across SMB, WinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.MimikatzWinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.NetExecWe demonstrate the attack using multiple popular offensive security tools including NetExec (nxc), Impacket, Metasploit, Evil-WinRM, and pth-winexe.pth-sqshThe pth-sqsh command allows attackers to authenticate to MSSQL using NTLM hashes, bypassing the need for plaintext credentials.pth-winexeacross SMB, WinRM, WMI, MSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.RubeusMSSQL, RDP, and LDAP using tools like nxc, Impacket, Metasploit, Evil-WinRM, pth-winexe, Mimikatz, and Rubeus.xfreerdp3The xfreerdp3 /pth command enables attackers to establish a full RDP session using only an NTLM hash.