What is Pass-the-Hash?
Pass-the-Hash is a credential theft technique in which an attacker uses a stolen NTLM or LM password hash to authenticate to a remote system without knowing the plaintext password. It exploits the way certain authentication protocols accept hashed credentials directly, bypassing the need to crack the hash first.
What it is
Pass-the-Hash (PtH) is an attack technique, not a product or tool category. An attacker who has compromised one machine extracts a password hash from memory, the registry, or a credential store. They then present that hash directly to an authentication protocol, most commonly NTLM, which accepts it as proof of identity. The attacker never needs to know the actual password.
The technique has been documented since the late 1990s. It remains common because NTLM is still widely used in Windows environments, and hashes are often reused across many machines.
A typical attack chain looks like this:
- Attacker gains local admin access on one endpoint.
- A tool such as Mimikatz extracts NTLM hashes from LSASS memory.
- The attacker uses the hash to authenticate laterally to other hosts, file shares, or domain controllers.
- Privilege escalates until the attacker reaches a domain admin hash and owns the environment.
Why it matters
PtH turns a single compromised endpoint into a key that opens many doors. Password rotation does not help immediately because the hash changes only when the password changes, and the attacker may already hold the new hash. The attack bypasses multi-factor authentication on systems that fall back to NTLM. Lateral movement can happen within minutes and leave minimal log evidence if NTLM logging is not enabled.
How tools address it
No single control eliminates PtH, but several layers reduce risk:
- Privileged Access Management (PAM): Rotating local administrator passwords frequently, ideally with a solution like Microsoft LAPS or a PAM vault, limits how long a captured hash is valid and prevents hash reuse across machines.
- Identity Threat Detection and Response (ITDR): Tools in this category monitor authentication logs for NTLM usage patterns, impossible lateral movement, and anomalous logon sequences that indicate PtH in progress.