passthehash

Pass-the-hash is a post-exploitation technique used in computer security. It allows an attacker who has already gained some level of administrative access to a network to authenticate to other systems without needing to know the plaintext passwords. Instead, the attacker captures and reuses the authentication tokens, specifically the NTLM hashes, of legitimate users.

This technique typically involves obtaining password hashes from memory, a SAM file, or via other means after compromising a machine. Once the hash is obtained, the attacker can use it with tools like Mimikatz or PsExec to authenticate to other systems on the network. This bypasses the need for traditional password cracking or brute-force attacks, as the hash itself serves as the credential.

The effectiveness of pass-the-hash relies on the fact that many Windows systems are configured to allow authentication using NTLM hashes. When a user logs into a machine, their password hash is often stored in memory, making it accessible to attackers with sufficient privileges. This technique is a significant threat because it enables lateral movement across a network, allowing an attacker to escalate their privileges and compromise more systems. Defenses against pass-the-hash include disabling NTLM authentication where possible, implementing strong account lockout policies, and using network segmentation.