Overpass the Hash
With overpass the hash, we can “over” abuse an NTLM user hash
to gain a full Kerberos Ticket Granting Ticket.
Then we can use the TGT to obtain a Ticket Granting Service (TGS).
To demonstrate this, let’s assume we have compromised a workstation (or server)
that jen has authenticated to.
We’ll also assume that the machine is now caching their credentials and therefore,
their NTLM password hash.
To simulate this cached credential,
we will use the Windows 10 CLIENT76 machine as jeff
and run a process as jen, which prompts authentication.
The simplest way to do this is to hold shift and right-click the Notepad icon,
then select “Run as different user”.
From here, we enter jen as the username along with the associated password,
which will launch Notepad in the context of that user.
After successful authentication,
jen’s credentials will be cached on this machine.
We can validate this with the sekurlsa::logonpasswords command
from mimikatz after having spawned an Administrative shell.
The command will dump the cached password hashes.
This output shows Jen’s cached credentials on the computer.
It includes the NTLM hash, which we will leverage to overpass the hash.
The essence of the overpass the hash lateral movement technique is to turn
the NTLM hash into a Kerberos ticket and avoid the use of NTLM authentication.
A simple way to do this is with the sekurlsa::pth command from Mimikatz.
The command requires a few arguments
and creates a new PowerShell process in the context of jen.
This new PowerShell prompt will allow us to obtain Kerberos tickets
without performing NTLM authentication over the network,
making this attack different than a traditional pass-the-hash.
As the first argument, we specify /user: and /domain:,
setting them to jen and corp.com respectively.
We’ll specify the NTLM hash with /ntlm: and finally,
and finally, use /run:
to specify the process to create (in this case, PowerShell).
At this point, we have a new PowerShell session
that allows us to execute commands as jen.
Let’s list the cached Kerberos tickets with klist.
No Kerberos tickets have been cached,
but this is expected since jen has not yet performed an interactive login.
Let’s generate a TGT by authenticating to a network share
on the files04 server with net use.
The output indicates that the net use command was successful.
We then used klist to list the newly requested Kerberos tickets,
including a TGT and a TGS for the Common Internet File System (CIFS) service.
We have now converted our NTLM hash into a Kerberos TGT,
allowing us to use any tools that rely on Kerberos authentication,
such as the official PsExec application from Microsoft.
PsExec can run a command remotely but does not accept password hashes.
Since we have generated Kerberos tickets and operate in the context of jen
in the PowerShell session,
we may reuse the TGT to obtain code execution on the files04 host.
Let’s try that now, running .\PsExec.exe
to launch cmd remotely on the \\files04 machine as jen.
As evidenced by the output, we have successfully reused
the Kerberos TGT to launch a command shell on the files04 server.
Excellent! We have successfully upgraded a cached NTLM password hash
to a Kerberos TGT to gain remote code execution on behalf of another user.