> For the complete documentation index, see [llms.txt](https://leo4j.gitbook.io/amnesiac/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://leo4j.gitbook.io/amnesiac/sessions/local-actions/hashgrab.md).

# HashGrab

Retrieve the Hash of the current user

`HashGrab` requests a certificate from a Windows Certificate Authority (CA) for the User Account TGT held in your current session, uses PKINIT to obtain a TGT for the same Account, then performs the UnPAC-the-Hash technique to extract the Account's NTLM hash.

<figure><img src="https://1622982705-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxZYmkSsz78lM8RvvHGKL%2Fuploads%2FtqACFoCLBkjCHRhV61kl%2Fimage.png?alt=media&amp;token=d38be15f-78bf-422d-a347-dc604948b85f" alt=""><figcaption></figcaption></figure>

This approach can be valuable in situations where an account's TGT has been compromised.

Gaining access to the account's NTLM hash opens up various possibilities, including:

* Cracking the hash to retrieve the plaintext password associated with the account.
* Conducting pass-the-hash attacks, where the hash is used for unauthorized access.
* Acquiring a new TGT if the existing one has expired, potentially granting further access.

**Limitations**

`HashGrab` relies on the presence of a Windows Certificate Authority (CA) in the environment. Without a functioning CA, the command will not be able to request the necessary certificate and will fail to operate.

`HashGrab` executes Rubeus behind the scenes to perform the UnPAC-the-Hash technique. It's important to note that some antivirus (AV) solutions may block Rubeus. This can result in HashGrab failing to achieve its intended purpose if AV interference occurs.