getnthash.py
UnPAC-the-hash: recovers the NT hash from a PKINIT TGT.
A PKINITtools utility for the UnPAC-the-hash attack: from a TGT obtained via PKINIT it recovers the account's NT hash, later usable for pass-the-hash or overpass-the-hash.
Family Kerberos & tickets
Flags -key <as-rep-key> -dc-ip
Concepts Shadow Credentials
Cheatsheet Kerberos
Installation
pipx install pkinittoolsUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- CertifiedHackTheBox