Question

During an internal engagement, you have dumped an NTLM hash for a domain user from a compromised Windows workstation but cannot crack the password offline. Kerberos authentication is enforced across the environment, and you want to move laterally to a file server that only accepts Kerberos, not NTLM. Which technique lets you leverage the NTLM hash to obtain a Kerberos TGT for that user?

Accepted Answer

Overpass-the-hash (pass-the-key) to request a TGT using the NTLM hash as the Kerberos key

Answer

Standard pass-the-hash over SMB directly against the file server

Answer

ASREP-roasting the target user to extract a crackable ticket

Answer

Kerberoasting the file server's machine account to obtain a service ticket