> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/ad/movement/kerberos/opth.md).

# Overpass the hash

This technique is a form of [pass the key](/ad/movement/kerberos/ptk.md).

Kerberos offers 4 different key types: DES, RC4, AES-128 and AES-256.

When attackers know the RC4 key (which is in fact the user's NT hash), and when the RC4 etype is not disabled, they can use it to obtain Kerberos tickets.

{% content-ref url="/pages/6IV8jltazXYvBG3FI1qh" %}
[Pass the key](/ad/movement/kerberos/ptk.md)
{% endcontent-ref %}