Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB services are accessed through .NET TCPClient connections. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.

Requirements

Minimum PowerShell 2.0

Download

git clone https://github.com/Kevin-Robertson/Invoke-TheHash.git

Import

Import-Module ./Invoke-TheHash.psd1

or

. ./Invoke-WMIExec.ps1
. ./Invoke-SMBExec.ps1
. ./Invoke-SMBClient.ps1
. ./Invoke-TheHash.ps1

Functions

• Invoke-WMIExec
• Invoke-SMBExec
• Invoke-SMBClient
• Invoke-TheHash
• ConvertTo-TargetList

Invoke-WMIExec

• WMI command execution function.

Parameters:

• Target – Hostname or IP address of the target.
• Username – Username to use for authentication.
• Domain – Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
• Hash – NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
• Command – Command to execute on the target. If a command is not specified, the function will just check to see if the username and hash have access to WMI on the target.
• Sleep – Default = 10 Milliseconds: Sets the function’s Start-Sleep values in milliseconds.

Example:

Invoke-WMIExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Command “command or launcher to execute” -verbose

Screenshot:

Invoke-SMBExec

• SMB (PsExec) command execution function supporting SMB1, SMB2 (2.1), and SMB signing.

Parameters:

• Target – Hostname or IP address of the target.
• Username – Username to use for authentication.
• Domain – Domain to use for authentication. This parameter is not needed with local accounts or when using @domain after the username.
• Hash – NTLM password hash for authentication. This function will accept either LM:NTLM or NTLM format.
• Command – Command to execute on the target. If a command is not specified, the function will just check to see if the username and hash have access to SCM on the target.
• CommandCOMSPEC – Default = Enabled: Prepend %COMSPEC% /C to Command.
• Service – Default = 20 Character Random: Name of the service to create and delete on the target.
• SMB1 – (Switch) Force SMB1. The default behavior is to perform SMB version negotiation and use SMB2 if supported by the target.
• Sleep – Default = 150 Milliseconds: Sets the function’s Start-Sleep values in milliseconds.

Example:

Invoke-SMBExec -Target 192.168.100.20 -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0 -Command “command or launcher to execute” -verbose

Screenshot:

Tutorial

Copyright (c) 2017, Kevin Robertson All rights reserved.