One Day Sec

What is the role of Overpass-the-hash in remotely reading DNS records with dnscmd?

Overpass-the-hash from mimikatz allows executing a command under the security context of a domain admin by supplying their NTLM hash. Since dnscmd does not accept explicit credentials for remote connections, this technique creates a token that dnscmd uses for authentication. The article demonstrates using it to run `Dnscmd WIN-F08C969D7FM.test.com /EnumZones` from a non-server machine, leveraging the hash obtained via methods like dcsync for NTDS.dit extraction.
Overpass-the-hashmimikatzdnscmd remoteNTLM hashdomain admin

Browse all Q&A →