Pass-the-Hash

Pass-the-Hash (PtH) is a technique where an attacker authenticates using a user's NTLM password hash instead of the plaintext password.

Because Windows NTLM authentication uses the hash itself as the secret, you never need to crack it to log in as that user.

Windows stores account passwords as NTLM hashes (an MD4 of the UTF-16 password). During NTLM authentication, the hash, not the password, is what proves identity.

This design flaw means stealing the hash is functionally equivalent to stealing the password for NTLM-based logins.

Hashes can be harvested from several places:

• The SAM database on local machines.
• LSASS process memory for logged-on users.
• The NTDS.dit file on domain controllers.

Each source requires different privileges, but all yield reusable hashes.

Mimikatz is the classic tool for extracting credentials from LSASS memory. The sekurlsa::logonpasswords command reveals NTLM hashes of currently logged-on users.

Local admin (and often SeDebugPrivilege) is required to read LSASS.

Impacket's secretsdump.py remotely extracts hashes from the SAM and the domain database using valid credentials.

It can also perform a DCSync to pull hashes straight from a domain controller if you have the right replication rights.

Once you have a hash, tools let you authenticate with it directly. Impacket's psexec.py accepts a hash with the -hashes flag and gives you a remote shell.

The format is LMHASH:NTHASH; the LM portion is usually blank zeros on modern systems.

Many tools support PtH:

• CrackMapExec / NetExec: spray hashes across many hosts.
• evil-winrm: WinRM shell with a hash.
• wmiexec.py / smbexec.py: alternative execution methods.

Spraying a single local admin hash across a subnet can rapidly expand access.

Pass-the-Hash is a core lateral movement technique. By reusing one machine's local admin hash on others (a problem when the same local admin password is shared), attackers hop from host to host.

Each new host may hold the hashes of more privileged users in memory.

Mitigations include:

• LAPS: unique random local admin passwords per machine.
• Credential Guard: isolates LSASS secrets.
• Restricting where privileged accounts log in (tiering).
• Disabling NTLM in favor of Kerberos where possible.

Pass-the-Hash has cousins:

• Pass-the-Ticket: reuse a stolen Kerberos ticket.
• Overpass-the-Hash: use an NTLM hash to request a Kerberos TGT.

These extend credential reuse into the Kerberos world.

Pass-the-Hash specifically abuses NTLM authentication. Environments that enforce Kerberos and disable NTLM shrink the attack surface considerably.

However, NTLM lingers in most networks for compatibility, so PtH remains broadly effective. This is why disabling NTLM is a recommended hardening step.

Recall why PtH does not require cracking.

You now understand Pass-the-Hash:

• NTLM authentication accepts the hash as the secret, so no cracking is needed.
• Hashes are dumped from SAM, LSASS, or NTDS.dit using Mimikatz or secretsdump.
• Tools like psexec.py, NetExec, and evil-winrm reuse hashes for lateral movement.
• Defend with LAPS, Credential Guard, and tiering.

Next you will map attack paths with BloodHound.