Pass-the-Hash

Pass-the-hash (PtH) is a Windows credential-reuse technique in which an attacker authenticates with a stolen NT (NTLM) password hash directly, without ever cracking it to the plaintext password. Because the NTLM challenge-response protocol derives its proof from the hash itself — not from the password — possessing the hash is possessing the credential for NTLM purposes. The hash becomes the secret.

This is what makes NTLM hashes so dangerous to dump: unlike a salted modern password hash (which resists direct use and forces offline cracking), an NT hash is immediately replayable. The canonical source of domain-wide NT hashes is the NTDS.dit database on a domain controller; once you have it, every account in the domain is PtH-able.

Tooling

• Mimikatz — sekurlsa::pth /user:Administrator /domain:corp /ntlm:<hash> /run:cmd.exe injects the hash into a new process’s logon session. See mimikatz.
• Impacket — psexec.py, wmiexec.py, smbexec.py all accept -hashes LMHASH:NTHASH for direct PtH execution. See impacket.
• evil-winrm — evil-winrm -i <host> -u <user> -H <nthash> for a WinRM shell. See evil-winrm.
• CrackMapExec — spray a single hash across an entire subnet to map where it’s valid (cme smb <subnet> -u <user> -H <hash>). See crackmapexec.

Microsoft mitigation guidance (2014)

Microsoft’s Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft white paper (v2, 2014) framed PtH as a credential-theft problem, not a protocol bug you can patch — NTLM is working as designed. The practical mitigations:

1. Protect high-privileged domain accounts — never log on to untrusted (non-DC, end-user) workstations with DA credentials, which is what exposes the hash to theft in the first place.
2. Protect the local Administrator account — randomize local admin passwords (the lineage that became LAPS) so a single stolen local hash doesn’t replay laterally across every host.
3. Restrict inbound lateral movement — host firewall rules blocking workstation-to-workstation SMB/RPC shrink the surface a stolen hash can be used against.

Complementary controls: the Protected Users group (forces Kerberos, disables NTLM), Credential Guard (isolates LSASS secrets), and disabling WDigest plaintext caching.

PtH vs. overpass-the-hash (PtT)

Overpass-the-hash — also called pass-the-key — is the Kerberos sibling: instead of replaying the NT hash against NTLM, you use it to request a legitimate Kerberos TGT from the KDC (the NT hash serves as the user’s Kerberos RC4 key). The result is a full Kerberos ticket, which then enables ticket-based attacks and works even where NTLM is disabled. Distinguishing:

	Pass-the-hash	Overpass-the-hash
Protocol	NTLM	Kerberos (AS-REQ)
You get	NTLM auth as the user	A real TGT
Defeats NTLM-disabled?	No	Yes (RC4 etype must be allowed)

Related MITRE technique: T1550.002 — Use Alternate Authentication Material: Pass the Hash, parent T1550.

Related

• ntlm-hashes — the credential material being passed
• ntds-dit — where domain-wide hashes are dumped from
• mimikatz / impacket / evil-winrm / crackmapexec — the tooling
• ntlm-relay-attacks — reuse without possessing the hash
• golden-and-silver-ticket-attacks — the Kerberos endgame
• passkeys — FIDO2 descendant of the same reuse idea; “Pass-ta-key” puns on PtH/pass-the-key

Sources

• Microsoft — Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, v2
• MITRE ATT&CK T1550.002 — Pass the Hash
• harmj0y — Coding towards chaotic good