Question

During a post-exploitation phase, you have compromised a Windows workstation and obtained a domain user's NTLM hash. You want to move laterally to a file server that requires Kerberos authentication, but you do not have the user's cleartext password and cannot yet elevate to domain admin. Which technique lets you use the captured hash to obtain a Kerberos TGT and authenticate to the file server?

Accepted Answer

Overpass-the-hash (pass-the-key) to request a TGT using the NTLM hash, then use the ticket to access the file server

Answer

Forge a golden ticket using the krbtgt hash and inject it into the current session

Answer

Perform an SMB relay attack against the file server using the captured hash

Answer

Run a DCSync against the domain controller to replicate the target user's credentials