Pass-the-Hash - Revision history

Ledhed at 19:43, 11 October 2016

2016-10-11T19:43:50Z

Ledhed at 19:43, 11 October 2016

2016-10-11T19:43:21Z

Ledhed: Created page with "== Overview == Pass the Hash (PtH) is the process of using an NTLM password hash in place of a user's credentials (username/password). It is an exploit commonly used by hacker..."

2016-10-11T18:47:00Z

Created page with "== Overview == Pass the Hash (PtH) is the process of using an NTLM password hash in place of a user's credentials (username/password). It is an exploit commonly used by hacker..."

New page

== Overview ==
Pass the Hash (PtH) is the process of using an NTLM password hash in place of a user's credentials (username/password). It is an exploit commonly used by hackers and penetration testers to gain access to resources. PtH is ideal because it doesn't require a password to be cracked (Brute force cracking a long complex password can take time).

== Mitigation ==
* Install Windows 10 and enable Device Guard & Credential Guard.
* Install a reputable Antivirus and keep it updated.
* Install OS and Application updates regularly.
* Require password changes as often as possible. At least every 90 days for end users and more often for high privilege accounts such as Domain Admins, Server Operators, and Support Desk.
* Employ [https://en.wikipedia.org/wiki/Principle_of_least_privilege Principals of Least Privilege].
* Disable cached logons for workstations (this may not be ideal for laptops).
* Don't allow end users to be Local Admins.
* Require a unique password for every computer's Local Admin account (Use [[LAPS]]).
* Require System Admins to be standard users, and have separate accounts for Domain and Server administration tasks.
* Don't allow Domain Admins to login to workstations or servers (only Domain Controllers).
* Don't allow Server Operators to login to Domain Controllers or Workstations.
* Harden workstations and servers using Security templates like the ones provided by The Center for Internet Security. CIS Benchmarks can be found [https://benchmarks.cisecurity.org/downloads/multiform/index.cfm here].
* ...

== Reference ==
https://technet.microsoft.com/en-us/security/dn785092

[[Category:Security_(Windows)]][[Category:Windows]]

@@ Line 29: / Line 29: @@
 * Harden workstations and servers using Security templates like the ones provided by The Center for Internet Security. CIS Benchmarks can be found [https://benchmarks.cisecurity.org/downloads/multiform/index.cfm here].
 * Use Remote Management Tools that don't leave a password hash on the remote computer (RSAT, MMC, PowerShell). Remote Desktop leaves hashes on remote computers.
-* Firewall critical servers (like Domain Controllers) so that remote access and management is only allowed from Secured Access Workstations. See [[PAW]]
+* Firewall critical servers (like Domain Controllers) so that remote access and management is only allowed from Privileged Access Workstations. See [[PAW]]
 * ...

@@ Line 1: / Line 1: @@
 == Overview ==
 Pass the Hash (PtH) is the process of using an NTLM password hash in place of a user's credentials (username/password). It is an exploit commonly used by hackers and penetration testers to gain access to resources. PtH is ideal because it doesn't require a password to be cracked (Brute force cracking a long complex password can take time).
@@ Line 8: / Line 17: @@
 * Install a reputable Antivirus and keep it updated.
 * Install OS and Application updates regularly.
 * Require password changes as often as possible. At least every 90 days for end users and more often for high privilege accounts such as Domain Admins, Server Operators, and Support Desk.
 * Employ [https://en.wikipedia.org/wiki/Principle_of_least_privilege Principals of Least Privilege].
@@ Line 16: / Line 26: @@
 * Don't allow Domain Admins to login to workstations or servers (only Domain Controllers).
 * Don't allow Server Operators to login to Domain Controllers or Workstations.
 * Harden workstations and servers using Security templates like the ones provided by The Center for Internet Security. CIS Benchmarks can be found [https://benchmarks.cisecurity.org/downloads/multiform/index.cfm here].
 * ...