Pass The Hash (PTH)
Pass The Hash
Note: Requires Elevated Privileges
Cobalt Strike
Beacon has a built-in pth command that runs mimikatz in the background.
We'll first attempt to access resources we don't have permission to
Execute PTH with NTLM hash
We can execute Pass-The-Hash like so:
List resources as impersonated user
Drop Impersonation
Use rev2self to drop impersonation.
OPSEC
When running the pth command, a named pipe command is run that looks like:
Note: This can be found via the "Suspicious Named Pipe Impersonation" search, which queries process events where the arguments contain "echo", ">" and "\.\pipe".
Note: Mimikatz also opens a suspicious handle to LSASS.
PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_WRITE (0x0020), PROCESS_VM_READ (0x0010) and PROCESS_VM_OPERATION (0x0008).
Last updated