Pass-the-hash attacks: Tools and Mitigation

[Nytro]

Pass-the-hash attacks: Tools and Mitigation

Although pass-the-hash attacks have been around for a little over thirteen years, the knowledge of its existence is still poor. This paper tries to fill a gap in the knowledge of this attack through the testing of the freely available tools that facilitate the attack. While other papers and resources focus primarily on running the tools and sometimes comparing them, this paper offers an in-depth, systematic comparison of the tools across the various Windows platforms, including AV detection rates. It also provides exte...

Copyright SANS Institute

Author Retains Full Rights

Pass-the-hash attacks: Tools and Mitigation

GIAC (GCIH) Gold Certification

Author: Bashar Ewaida, bashar9090@live.com

Advisor: Kristof Boeynaems

Accepted: January 21st 2010

Abstract

Although pass-*?the-*?hash attacks have been around for a little over thirteen years, the

knowledge of its existence is still poor. This paper tries to fill a gap in the knowledge of

this attack through the testing of the freely available tools that facilitate the attack.

While other papers and resources focus primarily on running the tools and sometimes

comparing them, this paper offers an in-*?depth, systematic comparison of the tools

across the various Windows platforms, including AV detection rates. It also provides

extensive advice to mitigate pass-*?the-*?hash attacks and discusses the pros and cons of

some of the approaches used in mitigating the attack.

Download: https://www.sans.org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation-33283