Pass the Hash
The Pass the Hash technique allows an attacker to authenticate
to a remote system or service
using a user’s NTLM hash instead of the associated plaintext password.
To demonstrate this, we can use wmiexec from the Impacket suite
from our local Kali machine against the local administrator account on FILES04.
We are going to invoke the command by passing the local Administrator hash
that we gathered in a previous Module
and then specifying the username along with the target IP.
In this case, we used NTLM authentication to obtain code execution
on the Windows 2022 server
directly from Kali, armed only with the user’s NTLM hash.