Pass-the-Hash

Pass-the-hash is a lateral-movement technique that exploits the way Windows NTLM authentication works. When a user logs in, Windows stores a cryptographic hash of their password in memory. NTLM authentication uses that hash directly, which means an attacker who can extract it does not need to crack it or know the original password: they can present the hash to another system and be authenticated as that user.

The attack begins after an attacker has gained administrative access to at least one machine. Using tools that read credential material from the memory of the Local Security Authority Subsystem Service, they harvest the hashes of any accounts that have logged into that host. If a domain administrator or other privileged account has ever authenticated there, its hash may now be in the attacker’s hands.

From there, the attacker replays the harvested hash against other systems on the network. Each successful authentication expands their reach, and because privileged accounts often log into many machines, a single compromised host can cascade into control of large parts of a domain. Pass-the-hash is therefore a core enabler of the lateral movement that turns one foothold into a full compromise.

The technique maps to the credential-access and lateral-movement tactics in the MITRE ATT&CK framework and is closely related to other credential-reuse attacks such as pass-the-ticket. It has been a staple of real-world intrusions for well over a decade precisely because it is reliable and needs no password cracking.

Defences aim to limit where privileged credentials are exposed and to contain reuse. Key measures include restricting and tiering administrative accounts so they only log into systems at their trust level, using the protected-users group and credential guard to keep hashes out of reach, enforcing local administrator password randomisation so a single local hash cannot unlock every machine, and segmenting the network so a compromised host cannot reach the whole estate. Monitoring for anomalous authentication patterns helps detect reuse in progress.

Pass-the-hash is closely related to a family of credential-reuse techniques, including pass-the-ticket and overpass-the-hash, that all exploit how Windows authentication trusts cached secrets. Because they abuse legitimate authentication rather than a software bug, they cannot be patched away and must instead be contained through credential hygiene, tiered administration and segmentation. Modern Windows features that keep secrets out of reach, such as Credential Guard, raise the bar considerably where they can be deployed.

Pass-the-hash is routinely demonstrated during internal network and Active Directory penetration tests because it reflects how real intrusions escalate from a single compromised workstation to control of a domain. Seeing the exact chain, from an initial foothold through harvested hashes to privileged access, lets an organisation target the specific credential-exposure and reuse paths that make the attack possible, rather than treating lateral movement as an abstract risk.

Pass-the-hash is routinely demonstrated during internal network and Active Directory penetration tests because it reflects how real attackers escalate from a single compromised workstation. Precursor tests for credential-exposure and reuse paths and shows the exact chain from initial foothold to privileged access, so remediation targets the real weak points.