Pass-the-hash is a technique in which an attacker authenticates to a system using a stolen password hash instead of the password itself. It works because, in some authentication protocols, the hash is all that is needed to prove identity, so there is no need to crack it.

What is a password hash?

A hash is a fixed-length value computed from a password by a one-way function. Systems store and compare hashes instead of passwords. In Windows environments the NTLM hash of a password is kept in memory and in the directory.

What is NTLM?

NTLM is an older Windows authentication protocol that uses a challenge and response based on the password hash. It has been largely replaced by Kerberos, but it remains enabled in many environments for compatibility with older systems and applications, which keeps this technique alive.

What is credential dumping?

The step that comes before pass-the-hash: extracting hashes and other credentials from the memory of a machine or from local stores. An attacker usually needs administrative rights on the machine to do it, which is why those rights matter so much.

How does pass-the-hash work?

1. The attacker gains access to a machine, often with administrator rights.
2. They extract hashes from memory or from local account stores.
3. They present a hash to another system that accepts NTLM authentication.
4. The system treats it as valid proof of identity and grants access.
5. They repeat the process to reach more systems.

Why does pass-the-hash work?

NTLM authentication uses the hash to answer a challenge. Anyone who holds the hash can answer it, so the hash is effectively equivalent to the password. The attacker never needs to know the original text.

Why is it hard to detect?

The logins use valid hashes and ordinary network authentication. The target systems see a legitimate account signing in. The signs appear in the pattern: the same account on many machines in a short time, or sign-ins from machines the account never uses.

What are the signs of pass-the-hash?

• Network logons using NTLM from unusual sources.
• One account authenticating to many systems in a short time.
• Administrative accounts used on workstations.
• Logons that do not match the person’s normal pattern.
• Authentication that skips the usual Kerberos flow.

How is it different from pass-the-ticket?

Pass-the-hash reuses an NTLM hash. Pass-the-ticket reuses a Kerberos ticket. The idea is the same, valid proof stolen and replayed, but the protocol is different.

Does MFA stop pass-the-hash?

No. The attack uses network authentication that does not involve an interactive login, so there is no prompt to approve. Protection comes from limiting NTLM, protecting credentials in memory and narrowing privileges.

What does pass-the-hash look like in practice?

An attacker compromises a workstation and extracts the hash of an administrator who recently signed in. They use it to authenticate to a file server, then a management server, and then a domain controller. Each login is accepted as the administrator’s, and nobody typed a password.

How do you defend against pass-the-hash?

• Disable or restrict NTLM where possible.
• Protect credentials in memory with credential protection features.
• Give each machine a unique local administrator password.
• Keep administrators from signing in to workstations and lower-trust systems.
• Remove local administrator rights that are not needed.
• Patch systems and monitor for credential theft tools.

How do you detect it?

By comparing authentication with what is normal for each identity: which machines it uses, at what times and how many at once. A valid hash used in an invalid pattern is the signal.

Sharelock monitors behaviour across systems, so an account that begins authenticating to machines it never uses, in a pattern typical of pass-the-hash, is flagged and investigated quickly.

‍