166 terms · 75/46/45
Technique № 021 · class: privileges

Pass-the-Hash

Using NTLM hashes instead of plaintext passwords for authentication.

Term

description · examples · notes

Using NTLM hashes instead of plaintext passwords for authentication.

Description

Hashes are extracted from memory of compromised systems (LSASS process).

Enables lateral movement without cracking the password.

Effective in networks using NTLM instead of Kerberos authentication.

Tools like Mimikatz and Impacket automate the entire process.

Examples

  • Mimikatz sekurlsa::pth module
  • Impacket psexec for lateral movement via hashes

Notes

  • Technique (how) for the pass-the-hash threat.
  • Differs from kerberos-attacks in the targeted protocol.
tags
ntlm credential lateral movement mimikatz
◳Composite

Threats

used by 1

Threats that use it. Select one to open its page.

Defenses

countered by 4

How it is countered. Select one to open its page.