Lateral Movement: Pass-the-Hash and Pass-the-Ticket

Lateral movement refers to techniques attackers use to progressively move through a network after establishing an initial foothold, aiming to reach higher-value targets such as domain controllers, databases, and administrative workstations. Unlike initial access (which usually targets a single endpoint), lateral movement exploits trust relationships between systems — authentication mechanisms, shared credentials, network connectivity, and administrative tools — that legitimate users rely on daily. Effective lateral movement allows a single compromised low-privilege account to eventually reach every system in an environment.

NTLM (NT LAN Manager) is a legacy Windows authentication protocol based on a challenge-response mechanism. When a client authenticates to a server, the server sends a random challenge; the client responds by hashing the challenge with the user's NT hash (a fixed hash derived from the password). The critical design flaw: the NT hash itself is sufficient to authenticate — not the password. The NT hash is stored in the Security Account Manager (SAM) database on workstations and in NTDS.DIT on domain controllers. If an attacker obtains the NT hash, they can authenticate as that user without ever knowing the password.

Pass-the-Hash (PtH) is an attack technique where an attacker uses a captured NTLM hash to authenticate to other systems without knowing the underlying plaintext password. After compromising one system and extracting hashes from memory (LSASS) or the SAM database, the attacker replaces their own credential material with the stolen hash in authentication requests. This is particularly devastating because shared local administrator passwords (common in environments without LAPS) mean one hash compromises hundreds or thousands of machines. Tools like Mimikatz, Impacket's psexec.py, and CrackMapExec automate PtH attacks.

Several mitigations reduce PtH attack effectiveness: Local Administrator Password Solution (LAPS) — Microsoft's tool that assigns unique, rotated local admin passwords to each machine, so a hash stolen from one machine only unlocks that machine; Credential Guard (Windows 10/11) — uses virtualization-based security to isolate LSASS in a secure enclave where hashes cannot be extracted; Disabling NTLM in favor of Kerberos where possible; restricting administrative access through Privileged Access Workstations (PAWs) and tiered admin models; and Protected Users security group in Active Directory that prevents hash caching for member accounts.

Kerberos is the default authentication protocol in Active Directory environments and avoids sending passwords or hashes over the network by using encrypted tickets. The process: (1) the client authenticates to the Key Distribution Center (KDC) — a role held by the domain controller — and receives a Ticket Granting Ticket (TGT) encrypted with the KRBTGT account's hash; (2) when the client needs to access a service, it presents the TGT to receive a Service Ticket (TGS/ST) encrypted with the target service's key; (3) the client presents the service ticket to the target, which validates it without contacting the KDC. Tickets have a default lifetime of 10 hours.

Pass-the-Ticket (PtT) is the Kerberos equivalent of Pass-the-Hash: an attacker extracts a valid Kerberos ticket from a compromised system's memory and imports it into their own session to authenticate as the ticket's owner. Kerberos tickets are stored in memory on Windows and can be extracted with Mimikatz's kerberos::list and kerberos::ptt commands. Stolen TGTs are most valuable because they can be used to request service tickets for any service the ticket's owner can access. Stolen Service Tickets (TGS) are more limited — they only grant access to the specific service they were issued for.

Over-Pass-the-Hash (oPtH), also called Pass-the-Key, bridges the gap between NTLM hash theft and Kerberos ticket acquisition. An attacker uses a stolen NT hash or AES key to request a Kerberos TGT from the domain controller, even without knowing the plaintext password. This converts a stolen hash into a full Kerberos TGT, granting all the flexibility of PtT attacks. This technique is valuable because many organizations have disabled NTLM in favor of Kerberos — oPtH allows hash-based attacks to succeed against Kerberos-only environments. Mimikatz implements this as sekurlsa::pth.

Attackers use several protocols to move laterally with stolen credentials or tickets: SMB (Server Message Block) allows executing commands remotely via PsExec, providing remote file access and service creation; WMI (Windows Management Instrumentation) allows remote command execution and is heavily used by both administrators and attackers due to its ubiquity and logging gaps; RDP (Remote Desktop Protocol) provides an interactive desktop session; and WinRM/PowerShell Remoting allows executing PowerShell commands on remote systems. Defenders should baseline which systems legitimately use these protocols and alert on anomalous usage patterns.

BloodHound is an open-source tool used by both red teamers and defenders to visualize Active Directory privilege escalation and lateral movement paths. It collects relationship data (who is a member of which group, who has admin rights on which machine, which accounts have delegation enabled) and displays it as a graph where nodes are users/machines/groups and edges are permissions. BloodHound's 'Find Shortest Paths to Domain Admins' query can show attackers — and defenders — exactly which sequence of compromises could lead to full domain control. Defenders use BloodHound to eliminate unnecessary privilege paths before attackers exploit them.

Detecting lateral movement requires correlating events across multiple systems. Key detection signals: Windows Event ID 4648 (logon with explicit credentials — common in PtH/PtT); Event ID 4769 (Kerberos service ticket requested — abnormal if requesting tickets for rarely-accessed services); Event ID 7045/4697 (new service installed — common in PsExec-based lateral movement); unusual administrative tool usage from non-admin workstations (wmic.exe, psexec.exe); and SMB authentication anomalies where workstations authenticate to other workstations (normal traffic flows from workstations to servers, not peer-to-peer). EDR platforms with behavioral detection catch these patterns across the network.

The tiered administration model (Microsoft's recommended Active Directory design) prevents credential theft from one tier from compromising higher tiers: Tier 0 (identity control plane — domain controllers, Azure AD) — only Tier 0 admin accounts can administer these, and these accounts never log into Tier 1 or 2 systems; Tier 1 (servers and cloud services) — dedicated Tier 1 admin accounts; Tier 2 (workstations and devices) — helpdesk and standard admin accounts. By isolating credentials into tiers, a compromised workstation admin account cannot be used to attack domain controllers. This directly counters PtH and PtT lateral movement.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: Pass-the-Hash exploits NTLM's hash-as-credential design — the NT hash alone authenticates without the password, defeated primarily by LAPS and Credential Guard, Pass-the-Ticket steals valid Kerberos tickets from memory to authenticate as another user, with stolen TGTs being particularly powerful as they can generate service tickets for any service, and the tiered administration model prevents credential theft at one tier from enabling lateral movement to higher-privilege tiers. Next up we explore Kerberoasting and Golden Ticket attacks targeting Active Directory's Kerberos implementation.