Kevin-Robertson/Invoke-TheHash

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1803 stars · 313 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of PowerShell functions for performing pass-the-hash attacks over WMI and SMB using NTLM hash authentication. It implements raw NTLMv2 authentication through .NET TCPClient without requiring local administrator privileges on the client side.

Use cases

• execute commands on remote windows hosts with ntlm hash
• pass the hash wmi and smb
• lateral movement in active directory pentest
• check if credentials have access to remote host
• enumerate smb shares with stolen hash
• test smb signing and authentication

When to choose

• you need pass-the-hash tooling in pure PowerShell without external binaries
• you are doing authorized penetration testing or red teaming on Windows networks
• you need WMI or SMB command execution with only an NTLM hash

When to avoid

• you need actively maintained tooling - the last release was 2018
• you need modern protocol support beyond SMB1/SMB2.1
• you are not working in a Windows/PowerShell environment

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing windows windows cli pass-the-hash ntlm powershell smb wmi red-team lateral-movement command-line

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Kevin-Robertson/Invoke-TheHash")