NTLM Hashes
The Windows NT family stores account passwords as NT hashes: the MD4 hash of the
UTF-16-LE (little-endian) encoding of the password, with no salt. The “NTLM”
name is a widespread misnomer — NTLM is the challenge-response authentication
protocol; the stored 16-byte value is the NT hash — but “NTLM hash” has stuck
in practitioner vocabulary. The older LM hash (pre-NT Lan Manager) is a
DES-based construction applied to the password uppercased, truncated/padded to 14
bytes, and split into two 7-byte halves used as DES keys — dramatically weaker
than the already-weak NT hash. Both are stored in the local SAM database (or in
NTDS.dit on domain controllers), in separate data structures, and can coexist
on the same system.
Because NT hashes are unsalted and used directly as the shared secret in NTLM authentication, they are password-equivalent: possessing the hash is enough to authenticate as the account without ever cracking it. This is the foundation of pass-the-hash (MITRE ATT&CK T1550.002)1 — the hash is passed directly to a service that accepts NTLM authentication. Tools like Evil-WinRM and PsExec accept an NT hash in place of a password for exactly this purpose. Cracking (e.g. with hashcat mode 1000) is only needed when the plaintext itself is required.
Construction
NT hash = MD4(UTF-16LE(password)) # 16 bytes, unsalted
LM hash = DES-based, 14-byte pw ceiling # legacy, trivially broken
- SAM (local accounts) and NTDS.dit (domain accounts) store these values.
- NTLMv1/v2 network responses are derived from the NT hash plus challenges — the value on the wire is not the same as the stored hash, but the stored hash is sufficient to compute valid responses (hence pass-the-hash).
- Overpass-the-hash extends the idea: use the NT hash to request a legitimate Kerberos TGT from the KDC, converting NTLM material into ticket-based access.
Offensive uses
| Technique | How the hash is used |
|---|---|
| Pass-the-hash | Direct NTLM auth to SMB, WinRM, WMI, RDP (restricted admin), MSSQL |
| Overpass-the-hash | Request Kerberos TGT using the NT hash as the long-term key |
| [[golden-and-silver-ticket-attacks | Golden ticket]] |
| [[ntlm-relay-attacks | NTLM relay]] |
| Offline cracking | hashcat -m 1000 (NT), -m 3000 (LM), -m 5600 (Net-NTLMv2) |
Dumping sources: mimikatz (sekurlsa::logonpasswords, lsadump::sam,
lsadump::dcsync), Impacket secretsdump.py, Volume Shadow Copy of SAM/SYSTEM.
Defensive notes
- KB2871997 + “Restrict NTLM” policies reduce PtH exposure; Credential Guard isolates LSASS secrets in VSM so hashes can’t be read even by SYSTEM.
- Disable LM storage (
Network security: Do not store LAN Manager hash value). - Tier administration so tier-0 hashes never touch lower-tier machines — see active-directory-weak-permissions for the ACL side and active-directory-lateral-movement for where PtH fits in movement chains.
Sources
- MITRE ATT&CK T1550.002 — Pass the Hash
- CAPEC-644: Use of Captured Hashes (Pass The Hash)
- Microsoft NTLM — Win32 apps | Microsoft Learn
- NTLM — Wikipedia
Related: ntlm-relay-attacks, evil-winrm, kerberos, kerberoasting, golden-and-silver-ticket-attacks, hashcat, mimikatz, impacket.