Windows Authentication

Windows authentication verifies who a user is before granting access. In domains this happens constantly between clients and the domain controller.

The two main protocols are NTLM (older, challenge-response) and Kerberos (modern, ticket-based). Both are heavily targeted.

Windows never stores plaintext passwords for local accounts; it stores hashes in the SAM database. The key format is the NT hash (an MD4 of the password).

If an attacker dumps these hashes, they can crack them offline or reuse them directly.

NTLM authenticates without sending the password:

• Server sends a random challenge.
• Client encrypts it with the NT hash and replies.
• Server (or DC) verifies the response.

It is legacy but still enabled in many networks for compatibility.

Because NTLM authenticates using the hash rather than the plaintext, an attacker who steals a hash can authenticate without ever cracking it.

This is Pass-the-Hash (PtH) - a powerful lateral movement technique against NTLM.

Kerberos is the default in Active Directory. It uses a trusted Key Distribution Center (KDC) on the domain controller and time-limited tickets instead of repeatedly sending credentials.

Kerberos flow:

• User authenticates and receives a Ticket Granting Ticket (TGT).
• To use a service, the client presents the TGT and gets a Service Ticket (TGS).
• The service validates the ticket - no password sent.

Kerberoasting requests service tickets for accounts running services (SPNs). The ticket is encrypted with the service account's password hash.

An attacker extracts the ticket and cracks it offline to recover the service account password.

Kerberos tickets can also be stolen and reused (Pass-the-Ticket). Worse, if an attacker compromises the krbtgt account hash, they can forge a Golden Ticket - a self-made TGT granting domain-wide access.

Many attacks begin with credential extraction from a compromised host. Tools dump hashes and tickets from lsass.exe memory or the SAM/SECURITY hives.

Mimikatz is the best-known tool; secretsdump is a common remote alternative.

Defenders reduce these risks by:

• Disabling NTLM where possible.
• Enforcing strong, long passwords for service accounts.
• Protecting lsass (Credential Guard, PPL).
• Rotating the krbtgt key and limiting admin reuse.

You can inspect the current authentication context and cached Kerberos tickets from a session.

Recognize the NTLM-specific attack.

You learned how Windows authenticates and is attacked:

• NT hashes in the SAM enable offline cracking and Pass-the-Hash.
• Kerberos uses a KDC, TGTs, and service tickets.
• Kerberoasting, Pass-the-Ticket, and Golden Tickets abuse Kerberos.
• Hardening: disable NTLM, protect lsass, strong service passwords.

Next: offensive PowerShell.