Pass-the-whatever

This section is about impersonation. Let's say an attacker compromised a machine and dumped hashed credentials from the LSASS process using one of many available ways. Usually, the next step is to perform lateral movement by starting a new logon session and trying to access other company resources. We will discuss the most common ways to perform such an activity together with OpSec considerations. Pass the certificate will be covered in Chapter 8 related to Active Directory Certificate Services.

Pass-the-hash

We are going to start with good old pass-the-hash. This method of authentication itself is quite straightforward. It relies only on the NTLM protocol, not touching Kerberos at all. This technique can be used for local and domain accounts. To perform a pass-the-hash attack, the attacker needs to have administrative privileges on the box.

Note

There is a detailed and well-written description of what is happening under the hood by hackndo in his...