Home / .NET / Cryptography

PowerShell Pass The Hash Utils

Invoke-TheHash Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into

Information

Category: .NET / Cryptography
Watchers: 62
Star: 1.3k
Fork: 301
Last update: Mar 21, 2023

Resource links

https://github.com/Kevin-Robertson/Invoke-TheHash

README
Issues 11

Invoke-TheHash

Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.

Requirements

Minimum PowerShell 2.0

Import

Import-Module ./Invoke-TheHash.psd1

or

. ./Invoke-WMIExec.ps1
. ./Invoke-SMBExec.ps1
. ./Invoke-SMBEnum.ps1
. ./Invoke-SMBClient.ps1
. ./Invoke-TheHash.ps1

Functions

Invoke-WMIExec
Invoke-SMBExec
Invoke-SMBEnum
Invoke-SMBClient
Invoke-TheHash

Invoke-WMIExec

WMI command execution function.

Parameters:

Target - Hostname or IP address of target.
Username - Username to use for authentication.
Domain - Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
Hash - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
Command - Command to execute on the target. If a command is not specified, the function will just check to see if the username and hash has access to WMI on the target.
Sleep - Default = 10 Milliseconds: Sets the function's Start-Sleep values in milliseconds.

Example:

Invoke-WMIExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Command "command or launcher to execute" -verbose

Screenshot:

Invoke-SMBExec

SMB (PsExec) command execution function supporting SMB1, SMB2.1, with and without SMB signing.

Parameters:

Target - Hostname or IP address of target.
Username - Username to use for authentication.
Domain - Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
Hash - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
Command - Command to execute on the target. If a command is not specified, the function will just check to see if the username and hash has access to SCM on the target.
CommandCOMSPEC - Default = Enabled: Prepend %COMSPEC% /C to Command.
Service - Default = 20 Character Random: Name of the service to create and delete on the target.
Sleep - Default = 150 Milliseconds: Sets the function's Start-Sleep values in milliseconds.
Version - Default = Auto: (Auto,1,2.1) Force SMB version. The default behavior is to perform SMB version negotiation and use SMB2.1 if supported by the target.

Example:

Invoke-SMBExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Command "command or launcher to execute" -verbose

Example:

Check SMB signing requirements on target. Invoke-SMBExec -Target 192.168.100.20

Screenshot:

Invoke-SMBEnum

Invoke-SMBEnum performs User, Group, NetSession and Share enumeration tasks over SMB2.1 with and without SMB signing.

Parameters:

Target - Hostname or IP address of target.
Username - Username to use for authentication.
Domain - Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
Hash - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
Action - (All,Group,NetSession,Share,User) Default = Share: Enumeration action to perform.
Group - Default = Administrators: Group to enumerate.
Sleep - Default = 150 Milliseconds: Sets the function's Start-Sleep values in milliseconds.
Version - Default = Auto: (Auto,1,2.1) Force SMB version. The default behavior is to perform SMB version negotiation and use SMB2.1 if supported by the target. Note, only the signing check works with SMB1.

Example:

Invoke-SMBEnum -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -verbose

Screenshot:

Invoke-SMBClient

SMB client function supporting SMB2.1 and SMB signing. This function primarily provides SMB file share capabilities for working with hashes that do not have remote command execution privilege. This function can also be used for staging payloads for use with Invoke-WMIExec and Invoke-SMBExec. Note that Invoke-SMBClient is built on the .NET TCPClient and does not use the Windows SMB client. Invoke-SMBClient is much slower than the Windows client.

Parameters:

Username - Username to use for authentication.
Domain - Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
Hash - NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
Action - Default = List: (List/Recurse/Delete/Get/Put) Action to perform.
1. - List: Lists the contents of a directory.
2. - Recurse: Lists the contents of a directory and all subdirectories.
3. - Delete: Deletes a file.
4. - Get: Downloads a file.
5. - Put: Uploads a file and sets the creation, access, and last write times to match the source file.
Source
1. - List and Recurse: UNC path to a directory.
2. - Delete: UNC path to a file.
3. - Get: UNC path to a file.
4. - Put: File to upload. If a full path is not specified, the file must be in the current directory. When using the 'Modify' switch, 'Source' must be a byte array.
Destination
1. - List and Recurse: Not used.
2. - Delete: Not used.
3. - Get: If used, value will be the new filename of downloaded file. If a full path is not specified, the file will be created in the current directory.
4. - Put: UNC path for uploaded file. The filename must be specified.
Modify
1. - List and Recurse: The function will output an object consisting of directory contents.
2. - Delete: Not used.
3. - Get: The function will output a byte array of the downloaded file instead of writing the file to disk. It's advisable to use this only with smaller files and to send the output to a variable.
4. - Put: Uploads a byte array to a new destination file.
NoProgress - Prevents displaying an upload and download progress bar.
Sleep - Default = 100 Milliseconds: Sets the function's Start-Sleep values in milliseconds.
Version - Default = Auto: (Auto,1,2.1) Force SMB version. The default behavior is to perform SMB version negotiation and use SMB2.1 if supported by the target. Note, only the signing check works with SMB1.

Example:

List the contents of a root share directory.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Source \\server\share -verbose

Example:

Recursively list the contents of a share starting at the root.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Recurse -Source \\server\share

Example:

Recursively list the contents of a share subdirectory and return only the contents output to a variable.
$directory_contents = Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Recurse -Source \\server\share\subdirectory -Modify

Example:

Delete a file on a share.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Delete -Source \\server\share\file.txt

Example:

Delete a file in subdirectories within a share.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Delete -Source \\server\share\subdirectory\subdirectory\file.txt

Example:

Download a file from a share.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\file.txt

Example:

Download a file from within a share subdirectory and set a new filename.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\subdirectory\file.txt -Destination file.txt

Example:

Download a file from a share to a byte array variable instead of disk.
$password_file = Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Get -Source \\server\share\file.txt -Modify

Example:

Upload a file to a share subdirectory.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Put -Source file.exe -Destination \\server\share\subdirectory\file.exe

Example:

Upload a file to share from a byte array variable.
Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Action Put -Source $file_byte_array -Destination \\server\share\file.txt -Modify

Screenshot:

Invoke-TheHash

Function for running Invoke-TheHash functions against multiple targets.

Parameters:

Type - Sets the desired Invoke-TheHash function. Set to either SMBClient, SMBEnum, SMBExec, or WMIExec.
Target - List of hostnames, IP addresses, CIDR notation, or IP ranges for targets.
TargetExclude - List of hostnames, IP addresses, CIDR notation, or IP ranges to exclude from the list or targets.
PortCheckDisable - (Switch) Disable WMI or SMB port check. Since this function is not yet threaded, the port check serves to speed up he function by checking for an open WMI or SMB port before attempting a full synchronous TCPClient connection.
PortCheckTimeout - Default = 100: Set the no response timeout in milliseconds for the WMI or SMB port check.
Username - Username to use for authentication.
Domain - Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
Hash - NTLM password hash for authentication. This module will accept either LM:NTLM or NTLM format.
Command - Command to execute on the target. If a command is not specified, the function will just check to see if the username and hash has access to WMI or SCM on the target.
CommandCOMSPEC - Default = Enabled: SMBExec type only. Prepend %COMSPEC% /C to Command.
Service - Default = 20 Character Random: SMBExec type only. Name of the service to create and delete on the target.
SMB1 - (Switch) Force SMB1. SMBExec type only. The default behavior is to perform SMB version negotiation and use SMB2 if supported by the target.
Sleep - Default = WMI 10 Milliseconds, SMB 150 Milliseconds: Sets the function's Start-Sleep values in milliseconds.

Example:

Invoke-TheHash -Type WMIExec -Target 192.168.100.0/24 -TargetExclude 192.168.100.50 -Username Administrator -Hash F6F38B793DB6A94BA04A52F1D3EE92F0

Screenshot:

5 Open More issues

Closed

Failed with error code 0x1C01000B

when, i send it command more than 3847 length, im getting this error

Any idea to fix this?

opened Feb 23, 2017 by projectboot 9

Closed

SMB enumeration exception then ran with Invoke-TheHash

So it seems Invoke-SMBEnum fails when passing target inputs that are processed in Invoke-TheHash, but not when a single target is passed directly to Invoke-SMBEnum.

So when debugging I can see in Get-TargetList the $target_list.Add($entry) line actually adds a string, which is the correct type.

However when checking the target type later in the flow it's an object array which errors out when attempting to convert to String when passed to Invoke-SMBEnum.

I have no idea about this powershell voodoo, but a quick fix I found is to manually convert to string before passing to Invoke-SMBEnum.

Note I have not tested other functions (SMBClient, SMBExec, etc.), just needed this one to work on a pentest.

opened Dec 7, 2018 by Vokaysh 3

Closed

Customize the pipe name

So I tried fussing around in the code to change the name of the pipe from \svcctl to a different value. My test target is SMB2, so I didn't fuss with the pipe name encoded in the SMB1 section. I put the nulls in to account for the UTF-16LE. However, when I run the script, I just get:

Hash being used: 79D6ED02F83D0E3862B2755AB5487933
user successfully authenticated on <machinename>
Something went wrong with <machinename>

I saw this $SMB_named_pipe_UUID value, but when I tried to decode it I just got binary-looking gibberish. Do I need to change this value as well? And if so, how do I derive the correct value?

Any pointers would be appreciated.

opened Mar 7, 2019 by jmhickman 2

Closed

Question: use Invoke-WMIExec to query stuff

Hi Kevin,

thanks for sharing your work, it really is a great tool.

I figured it would be interesting to tweak Invoke-WMIExec so it can also query stuff via WMI and not only execute. I had a look at the source code but I couldn't quite figure out where you define the actual WMI class you use for command execution ("Win32_Process" ?). Could you point me in the right direction?

Thanks in advance!

Christoph

opened Apr 12, 2017 by cfalta 2

Closed

SMB-Finger in powershell

Kevin, Trying to recreate https://github.com/lgandx/Responder/blob/master/tools/RunFinger.py in powershell. According to the SMBFinger function need to send command 72, flag1 x18, flag2 x53 xC8. I think I got that but not sure how to send and pull the data. Here is what I got so far, but I could be way off:

function Get-SmbFinger() { $SMB_client_stream = $SMB_client.GetStream() $SMB_client_receive = New-Object System.Byte[] 81920 $packet_SMB_header = Get-PacketSMBHeader 0x72 0x18 0x53,0xC8 0xff,0xff $process_ID_bytes[0,1] 0x00,0x00
$packet_SMB_data = Get-PacketSMBNegotiateProtocolRequest $SMB_version $SMB_header = ConvertFrom-PacketOrderedDictionary $packet_SMB_header $SMB_data = ConvertFrom-PacketOrderedDictionary $packet_SMB_data $packet_NetBIOS_session_service = Get-PacketNetBIOSSessionService $SMB_header.Length $SMB_data.Length $NetBIOS_session_service = ConvertFrom-PacketOrderedDictionary $packet_NetBIOS_session_service $SMB_client_send = $NetBIOS_session_service + $SMB_header + $SMB_data $SMB_client_stream.Write($SMB_client_send,0,$SMB_client_send.Length) $SMB_client_stream.Flush()
$SMB_client_stream.Read($SMB_client_receive,0,$SMB_client_receive.Length)

}

Let me know what you think.

opened Nov 8, 2017 by lordsaibat 1

Closed

Fix for issue 8

$Target defined as an array. Reused later, still treated as an array, exception on conversion attempt to string. Fixed by changing $target to $target_host (thanks Kevin!).

opened Dec 8, 2018 by Vokaysh 0

Open

local Pass The Hash

how can i create process or execute command on local computer (127.0.0.1) with another credential?

mimikatz:

sekurlsa::pth /user:admin /domain:workgroup /ntlm:3DBDE697D71690A769204BEB12283678 /run:"cmd.exe /c whoami"

Invoke-WMIExec:

Invoke-WMIExec -Target 127.0.0.1 -Domain workgroup -Username admin -Hash 3DBDE697D71690A769204BEB12283678 -Command 'whoami' -verbose

opened Sep 20, 2020 by ffcommax 0

Open

"Sleep" does not work when using Invoke-thehash

Hey, when using TheHash, the sleep function doesn't seem to work, there is zero delay between access attempts.

thank you!

opened Apr 29, 2019 by Qayinz 2

Open

WriteAndX Offset

Hello Kevin, I was looking your SMBExec code and I realize that you have constant offset(1002) at WriteAndX part. I am cofused about it. I think it is about svcctl pipe but I don't know the reason. Can you explain the reason?

opened Sep 2, 2018 by beratozbay 1

Open

User is not local administrator

Hey i added X user on 2012 R2.

i added local administrator groups too.

But when i trying to pass the hash with smb. i getting "X user not local administrator on x.x.x.x"

But kali PTH working fine

opened Sep 22, 2017 by projectboot 3

Open

Question: Mapping an SMB drive

Hi Kevin,

Thanks for sharing your fantastic work. Been testing it successfully in my own lab environment, it's amazing.

I was wondering if there's any chance that your tools can be extended/modified to simply map a network share on a server that is not a Windows one, but still uses Windows domain credentials and SMB/NTLM authentication, typically a SAMBA server integrated to ActiveDirectory.

Thanks, Regards, Arno

opened Jan 5, 2017 by Arno0x 4

Pass for iOS - an iOS client compatible with Pass command line application.

A toolkit to crack hash value which works on dictionary attack..Supported most common hash algorithm.Also able to create hash and crack salted hash.

C++ hash map and hash set which preserve the order of insertion

C++ implementation of a memory efficient hash map and hash set

AWS PowerShell Python Lambda, or PSPy for short, is a simple Python 2.7 AWS Lambda function designed to execute the PowerShell binary and marshal input/output to PowerShell.

vue-test-utils - Official utilities for testing Vue components.

This repository has been archived, use Enquirer instead.

Get the hash of a string

Official version of the Meow hash, an extremely fast level 3 hash

A Flask extension for easily hashing data with a variety of hash functions

crypto-hash - A wrapper for OS-level cryptographic hash functions

Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 3000+ other hashes

A simple single header 64 and 32 bit hash function using only add, sub, ror, and xor.

Pass the Hash to a named pipe for token Impersonation

Pass the Hash to a named pipe for token Impersonation

This PowerShell module lets you create very simple but clickable menus in the PowerShell console.

ironmansoftware

PowerShell Explorer shows information about the PowerShell environment on your machine.

Compute xxHash hash codes for 8 keys in parallel

rustc-hash - speed, non-cryptographic hash used in rustc

Advanced Hash Manipulation

java-diff-utils

Diff Utils library is an OpenSource library for performing the comparison / diff operations between texts or some kind of data: computing diffs, applying patches, generating unified diffs or parsing them, generating diff output for easy future displaying (like side-by-side view) and so on.

Share this repo

Related Repos

121

Unlocking Serverless Computing to Assess Security Controls

Cloud Katana is a cloud native tool developed from the need to automate the execution of simulation steps in multi-cloud and hybrid cloud environments.

34

Out-of-the-Box Tool to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & B...

Out-of-the-Box Tool to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & BoundSheets

467

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (...

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)

1.3k

LettuceEncrypt provides API for ASP.NET Core projects to integrate with a certificate auth...

LettuceEncrypt provides API for ASP.NET Core projects to integrate with a certificate authority (CA), such as Let's Encrypt, for free, automatic HTTPS (SSL/TLS) certificates using the ACME protocol.

10

ASP.NET Library that allows developers to add an extra layer of security on top of their e...

ASP.NET Library that allows developers to add an extra layer of security on top of their existing endpoints

30

A Silent (Hidden) Ethereum (ETH) Miner Builder

SilentETHMiner v1.3.3 - Based on Lime Miner v0.3

1.4k

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

198

OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# too...

OffensivePipeline allows to download, compile (without Visual Studio) and obfuscate C# tools for Red Team exercises.

71

The toy cryptocurrency Ameow

Ameow is a toy cryptocurrency. It was made as a hobby project and named by its author's girlfriend.

37

Blake3.NET is a fast managed wrapper around the SIMD Rust implementations of the BLAKE3 cr...

Blake3.NET is a fast managed wrapper around the SIMD Rust implementations of the BLAKE3 cryptographic hash function.

45

DecryptRDCManager is a .NET 4.0 Remote Desktop Manager Password Gatherer

DecryptRDCManager is a .NET port of Decrypt-RDCMan.ps1 which was written by Ben Turner and Rich Hicks. This tool will decrypt credentials from Remote Desktop Manager by using the functionality from the RDCMan.DLL as done here.

10

Decrypt gecko based browsers passwords, cookies, history, bookmarks.

Decrypt gecko based browsers passwords, cookies, history, bookmarks.

67

Game Vuln. Auto-Scanning Tool for Unity based Game

DragonFist DragonFist is an automated tool for checking vulnerability and making report on Unity Engine based Games. This program works in Android environment and also supports Android emulator environment. It can check vulnerabi

316

A modern and easy-to-use cryptographic library for .NET Core based on libsodium

NSec NSec is a new cryptographic library for .NET Core based on libsodium ❤. It provides modern cryptographic primitives in a modern API based on the new Span<T> and ReadOnlySpan<T> types. NSec aims to be e

51

This project is a JWT Authorize based on Ocelot API Gateway

Ocelot.JWTAuthorize This library is used in the verification project when Ocelot is used as an API gateway. In the Ocelot project, the API project, the verification project, and the injection function can be used.