0Pricing
Cyber Security Academy · Lesson

Pass-the-Hash and Pass-the-Ticket

Reusing stolen credentials.

Pass-the-Hash and Pass-the-Ticket is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Credentials Without Passwords

Windows authentication often does not require the plaintext password at the point of use. Both NTLM hashes and Kerberos tickets can authenticate on their own. Attackers exploit this: steal the artifact, reuse it.

  • Pass-the-Hash (PtH) reuses an NTLM hash.
  • Pass-the-Ticket (PtT) reuses a Kerberos ticket.
  • Neither requires cracking the password.

Where Credentials Live

Credential material is cached in memory and on disk during normal operation. Common sources include:

  • LSASS process memory holds hashes and tickets for logged-on users.
  • SAM database stores local account hashes.
  • NTDS.dit on DCs stores every domain hash.
  • DPAPI-protected credential vaults and browser stores.

Dumping LSASS is the most common harvesting step.

# Mimikatz: dump logon passwords and hashes
privilege::debug
sekurlsa::logonpasswords

# Comsvcs minidump of lsass (living-off-the-land)
rundll32 C:\windows\system32\comsvcs.dll, MiniDump <pid> lsass.dmp full

Pass-the-Hash Mechanics

NTLM authentication proves you know the password by using its hash as the secret in a challenge-response. If you have the hash, you can complete the handshake without ever knowing the password.

This makes the NT hash a password equivalent. Any service accepting NTLM is reachable with just the hash.

# Mimikatz pass-the-hash spawns a process with injected creds
sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:<NThash> /run:cmd.exe

# Impacket psexec via hash
psexec.py -hashes :<NThash> corp.local/Administrator@10.0.0.20

Pass-the-Ticket Mechanics

Kerberos tickets are bearer tokens: whoever holds a valid TGT or TGS can use it until it expires. Attackers extract tickets from LSASS and inject them into their own session.

  • Stealing a TGT lets you request service tickets as that user.
  • Stealing a TGS grants access to one specific service.
# Export all tickets, then inject one
Rubeus.exe dump /nowrap
Rubeus.exe ptt /ticket:doIF... (base64 blob)

# Mimikatz
sekurlsa::tickets /export
kerberos::ptt ticket.kirbi

Overpass-the-Hash

Overpass-the-Hash (a.k.a. pass-the-key) bridges NTLM and Kerberos. You use a stolen NTLM (or AES) key to request a legitimate Kerberos TGT, then operate fully within Kerberos.

This is stealthier than raw PtH because the resulting traffic looks like normal Kerberos authentication.

# Rubeus: turn an NTLM hash into a TGT
Rubeus.exe asktgt /user:svc_sql /rc4:<NThash> /ptt

# AES key is even quieter than RC4
Rubeus.exe asktgt /user:svc_sql /aes256:<key> /ptt

Golden and Silver Tickets

With deeper access, attackers forge tickets outright.

  • A Golden Ticket is a forged TGT signed with the krbtgt hash. It grants any identity and is valid until krbtgt is rotated twice.
  • A Silver Ticket is a forged TGS for one service, signed with that service account hash. It never touches the DC, so it is quiet.
  • A Diamond Ticket modifies a legitimately issued TGT to evade ticket-forgery detections.

Lateral Movement Patterns

Reused credentials power lateral movement. Common execution channels include:

  • SMB + service creation (psexec-style).
  • WMI remote process creation.
  • WinRM / PowerShell Remoting.
  • DCOM object instantiation.

The same stolen hash or ticket may unlock many hosts where the account is a local admin.

Why Local Admin Reuse Hurts

A single shared local administrator password across machines is catastrophic. Dump it once and you can PtH into every host that shares it.

LAPS solves this by setting a unique, rotated local admin password per machine, stored in AD with restricted read access.

Detection

These attacks leave telemetry if you watch for it.

  • Logon type 3 / 9 with NTLM where Kerberos is expected.
  • Event 4624 with seclogon or unusual NTLM from privileged accounts.
  • Ticket anomalies: TGS without a preceding TGT (Silver Ticket), or tickets with abnormal lifetimes (Golden Ticket).
  • LSASS access from non-standard processes (Sysmon event 10).

Defenses

Hardening focuses on protecting and isolating credentials.

  • Enable Credential Guard to isolate LSASS secrets in a VBS enclave.
  • Add sensitive accounts to Protected Users (no NTLM, no delegation, short ticket life).
  • Deploy LAPS and enforce admin tiering so Tier 0 creds never land on workstations.
  • Rotate krbtgt twice on suspected Golden Ticket compromise.

Testing Responsibly

Dumping LSASS and forging tickets are high-impact actions. Only perform them with explicit authorization and on agreed targets. Avoid dumping production DCs unless scoped, and securely destroy harvested hashes and tickets after reporting.

Document each credential reuse so blue teams can validate their detections fired.

Quick Check

Check your understanding of credential reuse attacks.

Recap

You saw how stolen hashes and tickets bypass passwords entirely.

  • PtH reuses NTLM hashes; PtT reuses Kerberos tickets.
  • Overpass-the-hash converts a hash into a clean Kerberos TGT.
  • Golden/Silver/Diamond tickets are forged for persistence.
  • Credential Guard, LAPS, Protected Users, and krbtgt rotation are the core defenses.

Next: turning a foothold into full domain dominance.

Frequently asked questions

Is the “Pass-the-Hash and Pass-the-Ticket” lesson free?

Yes — the full text of “Pass-the-Hash and Pass-the-Ticket” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Pass-the-Hash and Pass-the-Ticket”?

Reusing stolen credentials. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Pass-the-Hash and Pass-the-Ticket” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Active Directory Attack Surface
  2. Kerberos and Kerberoasting
  3. Pass-the-Hash and Pass-the-Ticket
  4. Privilege Escalation and Domain Dominance
← Back to Cyber Security Academy