What is Pass-the-Hash used for?

Pass-the-Hash pass-the-Hash (PtH) is an attack technique that uses a stolen password hash (instead of plaintext password) for authentication. In Windows environments, NTLM hashes can be used directly for authentication without knowing the actual password. Learn more in the full article above.

How does Pass-the-Hash work?

Pass-the-Hash (PtH) is an attack technique that uses a stolen password hash (instead of plaintext password) for authentication. In Windows environments, NTLM hashes can be used directly for authentication without knowing the actual password. Detailed explanation can be found in the article above.

What is Pass-the-Hash?

Pass-the-Hash Definition

Pass-the-Hash (PtH) is an attack technique that exploits the NTLM authentication protocol in Windows. An attacker who has obtained a password hash (e.g., via Mimikatz) can use this hash directly for authentication without needing to know or crack the actual password.

How Does NTLM Authentication Work?

User enters password
System generates NTLM hash
Hash is used for challenge-response
Server verifies response

The key: The hash itself is the authentication secret.

Pass-the-Hash Attack

Access: Attacker gains access to system (e.g., phishing)
Hash extraction: Mimikatz, secretsdump from memory/SAM
Pass-the-Hash: Using hash to authenticate to other systems
Lateral movement: Access to SMB, WMI, RDP

PtH Tools

Mimikatz: sekurlsa::pth
Impacket: psexec.py, wmiexec.py
CrackMapExec: SMB lateral movement
Metasploit: PtH modules

Why Is PtH Possible?

NTLM design: Hash = authentication secret
Hash caching: Hashes stored in memory
Reusability: Same hash works everywhere
Backward compatibility: NTLM still widely used

Pass-the-Hash Detection

Indicators:

NTLM authentication from unusual sources
Lateral movement patterns
Type 3 logons (network) from interactive sessions
Anomalous SMB activity

Detection tools:

EDR with PtH detection
Windows event log analysis (4624, 4625)
Network traffic monitoring

Pass-the-Hash Mitigation

Technical:

Credential Guard: Hash protection in VSM
Protected Users group: No NTLM caching
Disable NTLM: Where possible (Kerberos only)
LAPS: Unique local admin passwords
Tiering model: Admin account separation

Architectural:

Network segmentation
Privileged Access Workstations (PAW)
Just-in-Time administration

PtH vs Pass-the-Ticket

Aspect	Pass-the-Hash	Pass-the-Ticket
Protocol	NTLM	Kerberos
Secret	NTLM hash	TGT/TGS ticket
Scope	Single domain	Can be cross-domain
Mitigation	Credential Guard	Time-limited tickets

Pass-the-Hash is one of the fundamental lateral movement techniques in Windows environments, requiring defense-in-depth approach.