Pass-the-hash (PtH) is an attack in which an adversary authenticates to remote systems using a stolen password hash instead of the plaintext password.
How pass-the-hash works
Windows NTLM authentication never needs the actual password – it uses the NT hash of the password to answer a challenge from the server. Whoever holds the hash can therefore log in as the user. A typical attack looks like this:
- The attacker gains administrative rights on one machine, for example via phishing and privilege escalation.
- Tools such as Mimikatz dump NTLM hashes from LSASS memory or the local SAM database.
- The hash is “passed” to other servers over SMB, WMI or remote management, with tools such as Impacket or PsExec-style utilities.
The technique was first described publicly in 1997 and is listed in MITRE ATT&CK as T1550.002 (Use Alternate Authentication Material). A Kerberos counterpart, pass-the-ticket, reuses stolen Kerberos tickets in the same way.
Why pass-the-hash matters
PtH is one of the main enablers of lateral movement in Windows networks. A single cached hash of a domain administrator can give an intruder control of the whole Active Directory forest. Ransomware operators and APT groups use it routinely, and the 2017 NotPetya outbreak spread inside networks partly by reusing credentials harvested with Mimikatz-style code. Cracking the hash is unnecessary, so long and complex passwords do not prevent the attack.
How to defend against pass-the-hash
- Use unique local administrator passwords on every machine (Windows LAPS).
- Enable Credential Guard and LSA protection, and add privileged accounts to the Protected Users group.
- Restrict or disable NTLM where possible and follow a tiered administration model.
- Monitor for NTLM logons with administrative accounts from unusual hosts.
