Pass-the-Hash

Description

To get the hash the attacker needs administrator or SYSTEM rights and a tool such as Mimikatz. Once they have it, they can try logging in to the other machines on the network. Wherever the same account exists, Windows accepts the login as legitimate. That way an attacker can compromise a whole network if the same account sits everywhere — and that is not a rare case.

The defense has one aim: that one hash does not unlock every door. Unique administrator passwords per machine (LAPS), so a stolen hash works on one computer only; least privilege, so high-level accounts are not used to log in everywhere; protection of the memory the hash lives in (Credential Guard); network segmentation; a move from NTLM to Kerberos. The main recommendation is that privileged accounts are not used across the whole network.

Examples

• Mimikatz pulls the hash of a local administrator account out of the memory of an infected workstation, and it is then passed to the other machines on the network where that account exists.
• A help-desk administrator account used on a large number of machines: if the attacker gets the hash on one computer, every other one is at high risk of compromise.
• CrackMapExec is a tool that automates lateral movement and the passing of collected hashes towards the domain controller.

Notes

• The attacker does not need a readable password, only its hash. A strong, long password does not help against this one.
• It differs from cracking: nothing is broken offline, the hash is used as it is. The cure is not a stronger password but not recycling administrator passwords. Every machine needs its own local administrator, not a shared one.