Skip to main content
Pass-the-Hash is a credential theft technique targeting Windows systems: an attacker who obtains a user’s NTLM password hash authenticates as that user directly with the hash, without ever cracking it back to plaintext.
  • It typically starts with access to a compromised host where the target user’s hash is stored, LSASS memory or the SAM database, see Windows Credentials Attacks for the extraction side.
  • The hash is then passed to Windows’ own NTLM authentication, no password needed, to any service that accepts NTLM: SMB, WinRM, RDP.
  • This lets an attacker move laterally, escalate privileges, and reuse that access across the domain, all without the hash ever being cracked.
PtH works because NTLM authentication only ever needs the hash, not the plaintext. It does not work against services that require a Kerberos ticket instead, that’s Pass-the-Ticket

​
Using the Hash

​
Mimikatz (On-Host)

Opens a new process (here, a PowerShell session) under the target user’s identity by patching the hash directly into the current LSASS session, rather than connecting out over the network.

​
RDP

RDP normally requires a plaintext password, Restricted Admin Mode is what allows PtH to work against it instead.
If the RDP session fails, Restricted Admin Mode may be disabled on the target. Enable it (needs local admin / a way to write to the registry first):

​
Quick Reference Tools

Windows Credentials Attacks

Where the NTLM hash used here usually comes from (LSASS, SAM).

Pass-the-Ticket

The Kerberos-ticket equivalent, for services that won’t accept NTLM.

Invoke-TheHash

PowerShell PtH implementation for WMI/SMB without needing Mimikatz on disk.