A penetration tester has compromised a Windows workstation in a domain environment and wants to move laterally to a domain controller. The tester has obtained the NTLM hash of a domain administrator account. Which technique would allow authentication to the domain controller without cracking the hash?

Question

Accepted Answer

B. Pass-the-hash using a tool like Impacket's psexec.py. Pass-the-hash allows authentication to Windows systems using the NTLM hash directly. Tools like Impacket's `psexec.py` accept NTLM hashes as authentication credentials, enabling the tester to execute commands on remote systems (such as the domain controller) without needing the plaintext password. This is a key lateral movement technique in Windows environments.

Related Questions

Discussion