Pass-the-Hash (PTH)
Authenticate to remote systems using NTLM password hashes without knowing the cleartext password.
PTH is a powerful lateral movement technique that works because Windows accepts NTLM hashes for authentication.
Quick Reference
# Impacket psexec |
Impacket PTH
# psexec |
NetExec PTH
# Single host |
Mimikatz PTH (Windows)
# Start Mimikatz |
Invoke-TheHash (PowerShell)
# Import module |
RDP Pass-the-Hash
Enable Restricted Admin Mode
# Add registry key |
Connect with PTH
# xfreerdp |
Evil-WinRM PTH
# Connect with hash |
Common Workflow
# Step 1: Obtain NTLM hash |
Lateral Movement with PTH
# Spray hash across subnet |
Notes
How PTH Works:
Windows NTLM authentication accepts password hashes directly:
- Client sends username to server
- Server sends challenge
- Client encrypts challenge with password hash
- Server verifies encrypted challenge
Since the hash itself is used for encryption, knowing the hash is equivalent to knowing the password for NTLM authentication.
Requirements:
- NTLM hash of target account
- SMB (445/TCP) or other service accepting NTLM auth
- Account must have appropriate permissions
- Target must allow NTLM authentication
UAC Limitations:
UAC restricts PTH for local accounts:
- Only RID 500 (built-in Administrator) can PTH by default
- Other local admins blocked unless
LocalAccountTokenFilterPolicy=1 - Domain accounts not affected by this restriction
- Exception: If
FilterAdministratorToken=1, even RID 500 is blocked
Registry Keys:
# Allow PTH for all local admins |
Hash Formats:
# Full format (LM:NTLM) |
Common Hash Sources:
- SAM database dump
- NTDS.dit extraction
- LSASS memory dump
- DCSync attack
- Kerberoasting (after cracking)
- ASREP roasting (after cracking)
Restricted Admin Mode (RDP):
Required for RDP PTH:
- Disabled by default
- Must be enabled via registry
- Credentials not sent to remote system
- More secure but enables PTH
Tools Comparison:
| Tool | Protocol | Shell Type | Notes |
|---|---|---|---|
| psexec | SMB | Interactive | Creates service |
| wmiexec | WMI | Semi-interactive | Fileless |
| smbexec | SMB | Semi-interactive | Uses cmd.exe |
| atexec | Task Scheduler | Non-interactive | Single command |
| evil-winrm | WinRM | Interactive | PowerShell remoting |
Detection:
Event IDs to monitor:
- 4624: Logon (Type 3 = Network)
- 4672: Special privileges assigned
- 4648: Logon using explicit credentials
- 4768/4769: Kerberos ticket requests (if Kerberos used)
Indicators:
- Logon from unusual source IPs
- Lateral movement patterns
- Multiple failed then successful logons
- Admin account used from workstation
LAPS Mitigation:
Local Administrator Password Solution (LAPS):
- Randomizes local admin passwords
- Different password per machine
- Prevents password reuse
- Mitigates PTH lateral movement
Best Practices:
- Test hash before full attack
- Use local-auth flag for local accounts
- Check for Pwn3d! indicator (admin access)
- Document all systems accessed
- Clean up artifacts (services, tasks)
- Prefer WMI/WinRM over SMB (less artifacts)
Kerberos vs NTLM:
PTH only works with NTLM:
- Kerberos uses tickets, not hashes
- Use Pass-the-Ticket for Kerberos
- Many environments still support NTLM
- NTLM often fallback when Kerberos fails
Privilege Levels:
- Local Admin: Full control of single machine
- Domain Admin: Full control of domain
- Enterprise Admin: Full control of forest
- Service accounts: Varies by permissions
Common Targets:
- Workstations (lateral movement)
- Servers (data access)
- Domain Controllers (domain compromise)
- File servers (data exfiltration)
- Database servers (sensitive data)
Troubleshooting:
- If PTH fails: Check UAC settings
- If “Access Denied”: Account may not have admin rights
- If “Network path not found”: Check firewall/SMB
- If RDP fails: Enable Restricted Admin Mode
Defensive Recommendations:
- Implement LAPS
- Disable NTLM where possible
- Enable SMB signing
- Monitor for lateral movement
- Use tiered admin model
- Implement credential guard
- Regular password rotation
- Least privilege principle