Skip to main content

💥 Over Pass the Hash

🧠 What’s the Deal?​

This essentially converts an NTLM hash into Kerberos tickets, allowing access to services that don’t accept raw NTLM authentication

Normal Pass-the-Hash (PtH) → You directly authenticate to a remote service (SMB, WMI, RDP) using an NTLM hash, without knowing the plaintext password.

Over-Pass-the-Hash (Pass-the-Key) → Instead of directly authenticating with the NTLM hash, you use the NTLM hash to request a Kerberos TGT (Ticket Granting Ticket) from the Key Distribution Center (KDC).

🎯 How it works ?​

  1. Attacker obtains the NTLM hash of a user.
  2. Uses the hash to derive the user’s NTLM key.
  3. Crafts a Kerberos AS-REQ to the domain controller (KDC), proving knowledge of the NTLM key.
  4. The KDC issues a TGT for that user.
  5. Attacker now has a Kerberos ticket that can be used for lateral movement via Kerberos-authenticated services (SMB, LDAP, MSSQL, HTTP, etc.).

🧰 Gear Up (Prereqs)​

Don’t go in empty-handed. What do you need beforehand?

  • Access to target or vulnerable endpoint
  • Specific app version or config
  • Recon data (subdomain, login page, etc.)
  • Tools (e.g., Burp, nmap, ffuf, etc.)

🚀 Launch Sequence (How-To)​

Here’s how the magic happens — step by step.

# Example flow:
1. Identify the injection point
2. Craft payload: ' OR '1'='1
3. Send request and observe results