Here's a scary thought: an attacker can log into your Windows systems as any user whose hash they've stolen, and they never need to know the password. Not even one character of it.
This is the pass-the-hash attack, and it's one of the most powerful techniques in the Windows attacker playbook. It turns the entire concept of password security on its head, because in a pass-the-hash attack, your password strength is irrelevant. The hash is the key.
Let's understand how this attack works, why it's possible, and what you can do about it.
What Is Pass-the-Hash?
A pass-the-hash attack is a technique where an attacker authenticates to a Windows system using a stolen NTLM hash instead of a password. The attacker doesn't crack the hash to recover the password. They don't need to. They use the hash directly in the NTLM authentication protocol.
Here's why this works: the NTLM authentication protocol is designed to accept the hash as proof of password knowledge. In the challenge-response flow, the client computes a response using the NTLM hash. If the attacker has the hash, they can compute the correct response to any challenge the server sends.
The server has no way to distinguish between a legitimate user who knows the password and an attacker who only has the hash. Both produce the same authentication response. The hash is the credential.
This is fundamentally different from how most people think about authentication. We assume that knowing the password is required to authenticate. Pass-the-hash breaks that assumption.
How Attackers Steal NTLM Hashes
Before an attacker can pass the hash, they need to obtain it. There are several common methods:
**LSASS Memory Dumping:** The Local Security Authority Subsystem Service (LSASS) holds credential information in memory, including NTLM hashes, Kerberos tickets, and even plaintext passwords in some configurations. Tools like Mimikatz can dump these credentials from LSASS memory. This is the most common method for hash theft.
To dump LSASS, the attacker needs administrative privileges on the target machine. This typically means they've already compromised the machine through another vector — a phishing attack, a vulnerability exploit, or lateral movement from another compromised system.
**SAM Database Extraction:** The SAM database stores NTLM hashes for local accounts. While Windows protects the SAM file, an attacker with administrative access or physical access to the machine can extract it. Tools like pwdump, samdump2, or Volume Shadow Copy techniques can retrieve the SAM and extract the hashes.
**NTDS.dit Extraction:** On domain controllers, the NTDS.dit file stores NTLM hashes for all domain accounts. If an attacker compromises a domain controller (the crown jewel of a Windows domain), they can extract every user's hash. Techniques include using ntdsutil, Volume Shadow Copy, or tools like secretsdump.
**Network Capture:** In some cases, NTLM authentication exchanges can be captured on the network. While NTLMv2 responses are harder to crack offline, the captured exchange can still be used in relay attacks. Tools like Responder can capture NTLM challenges on the network.
**Credential Stores:** Windows Credential Manager stores credentials for various services. An attacker with access to a user's session can extract these stored credentials, which may include NTLM hashes.
Why You Don't Need to Crack the Password
This is the part that confuses many people. In a traditional attack, you steal a password hash and then try to crack it — guessing passwords, computing their hashes, and comparing. This can take time, especially for strong passwords.
Pass-the-hash eliminates the cracking step entirely. The attacker takes the stolen hash and feeds it directly into the NTLM authentication protocol. The protocol doesn't ask "do you know the password?" It asks "can you produce the correct response to this challenge?" And the hash is all you need to produce that response.
This means: - A 30-character random password is no more resistant to pass-the-hash than "password123" - Password complexity requirements provide zero protection against this attack - The only thing that matters is whether the attacker has the hash
This is why pass-the-hash is so devastating. It renders one of the most common security controls — strong passwords — completely irrelevant.
You can see the hash format yourself using our NTLM Hash Generator. The hash you generate is exactly what an attacker would use in a pass-the-hash attack. Understanding the hash format helps you understand why the attack works.
The Attack in Practice
A typical pass-the-hash attack follows this pattern:
**Initial Compromise:** The attacker gains administrative access to a machine, often through phishing, a vulnerability, or social engineering.
**Hash Dumping:** The attacker dumps credentials from the compromised machine using Mimikatz or similar tools. They obtain NTLM hashes for all users who have logged into that machine.
**Lateral Movement:** The attacker uses the stolen hashes to authenticate to other machines on the network. If a domain administrator has logged into the compromised machine, the attacker now has the domain admin hash and can access any system in the domain.
**Privilege Escalation:** Using stolen hashes, the attacker moves from machine to machine, collecting more credentials and escalating privileges until they reach domain administrator level.
**Persistence and Exfiltration:** With domain admin access, the attacker can access any system, exfiltrate data, create backdoor accounts, or deploy ransomware across the entire domain.
The speed of this process is alarming. In a poorly defended environment, an attacker can go from initial compromise to domain admin in minutes.
Mitigation Strategies
Pass-the-hash is a serious threat, but it's not unpreventable. Here are the key mitigations:
**Disable NTLM Authentication:** The most effective mitigation is to disable NTLM and use Kerberos exclusively. Kerberos doesn't accept raw hashes for authentication — it uses ticket-based authentication that requires the user's actual key (derived from the password). Microsoft has been adding NTLM restriction capabilities to Windows, and Windows 11 includes features for auditing and blocking NTLM.
**Protect LSASS:** Since LSASS memory dumping is the primary hash theft method, protecting LSASS is critical. Enable Protected Process Light (PPL) for LSASS, use Windows Defender Credential Guard (which isolates credential storage in a virtualization-based secure environment), and configure LSASS protection flags to prevent unsigned code from injecting into the process.
**Use LAPS:** Local Administrator Password Solution (LAPS) — now LAPS (Local Administrator Password Solution) in Windows — manages local administrator passwords. It generates unique, random passwords for each machine's local admin account and stores them in Active Directory. If one machine is compromised, the attacker gets one local admin hash, not a hash that works on every machine.
**Implement Tiered Administration:** Don't let domain administrators log into workstations or member servers. Use tiered administration where privileged accounts are only used on secure, isolated systems. This prevents hash theft from less-secure machines.
**Restrict Administrative Logons:** Configure "Deny access to this computer from the network" and "Deny log on locally" for administrative accounts on non-essential systems. This limits where stolen hashes can be used.
**Monitor for Pass-the-Hash:** Windows event logs can detect pass-the-hash activity. Look for Event ID 4624 (successful logon) with Logon Type 3 (network) from unexpected sources, especially when the authentication uses NTLM rather than Kerberos.
**Use Just-in-Time Access:** Instead of permanent admin rights, use just-in-time access models where admin privileges are granted temporarily and revoked after use. This limits the window for hash theft.
Why NTLM Can't Be Fully Removed (Yet)
If disabling NTLM is the best mitigation, why don't organizations just do it? Because NTLM is deeply embedded in the Windows ecosystem:
Many applications still use NTLM authentication, especially older software. Disabling NTLM can break these applications. Some network configurations and appliances require NTLM. Interoperability with non-Windows systems sometimes depends on NTLM. And in some environments, the effort to identify and eliminate all NTLM dependencies is substantial.
Microsoft is working toward a future without NTLM. Windows 11 includes NTLM auditing and restriction policies. But for now, most organizations still have NTLM somewhere in their environment, which means pass-the-hash remains a real threat.
For a broader understanding of how NTLM fits into Windows authentication and why Kerberos is the preferred alternative, read our article on Windows authentication: Kerberos vs NTLM. And to understand the hash format that makes pass-the-hash possible, see our NTLM hash explained article.
Pass-the-hash is a reminder that in security, the weakest link matters more than the strongest. Your passwords can be 50 characters of random gibberish, but if the hash can be stolen and used directly, the password doesn't matter. Defense must be layered, and it must address the full attack chain — not just password strength.
