During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it is possible to access (non administrative) SMB shares as that user (assuming some exist), but is it possible to obtain a low level shell as that user? Or does obtaining a shell (via an NTLM hash or Kerberos ticket) always necessitate the user to be an administrator of whatever Windows machine you are targeting?

From some research, it seems you can weaken Windows security to allow PowerShell Remoting by non-administrative users but that seems like an unlikely scenario one would encounter. I am curious about things you can normally expect to be able to do (i.e. things that dont require stupid/unlikely configurations to work) with a TGT or NTLM hash when the user is not an administrative user on a workstation or server. Assume Windows 10/2012 or later.

  • We have several questions on the site regarding NTLM hashes and what you can do with them. You should do some research and then try to narrow down your question.
    – Tom K.
    Commented Apr 30, 2019 at 13:33
  • Thanks for the reply. I am familiar with (SMB) PTH attacks. Those require the user be an administrator. This question is purposely broad to understand the possible risk of a non-administrators ticket or hash. If you feel like other questions answer that question, please link them here as I am not finding questions which address this.
    – n00b
    Commented Apr 30, 2019 at 13:38
  • You don't have to be an admin or capture admin NTLM hashes to pass them on. You can search for responder, golden ticket, silver ticket and ticket forging to get a better idea.
    – Tom K.
    Commented Apr 30, 2019 at 13:44
  • You are right. You can pass them, but you cant use them to get a shell. You can use them to read shares as the user, which is what I addressed in the question. I am familiar with all those topics you mentioned. Which one of them specifically addresses my question? Golden tickets is related to domain admins. Silver ticket and ticket forging get closer to the question, but again, most of the articles that ive read assume the user is an administrator on the workstation they are attacking to do whatever they are trying (typically to get a shell).
    – n00b
    Commented Apr 30, 2019 at 13:46
  • I dont mean to be argumentative, but your response, seems like one of "google it". If you have an article or stackexchange question which you feel like adequetly addresses my specific question (related to NON-administrator tickets/hashes), then please link it but as far as I've seen none of them have.
    – n00b
    Commented Apr 30, 2019 at 13:49


You must log in to answer this question.