thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Pass-the-Hash (PtH)

Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.

Definition

Because NTLM authentication uses the hash itself, an attacker who dumps hashes from memory or the SAM can authenticate as that user to other systems. It is a major lateral movement technique (T1550.002). Mitigations include Credential Guard, LAPS for unique local admin passwords, restricting admin logons and disabling NTLM.

Example

Using a local administrator hash with Impacket's psexec.py to access other workstations.

Exam tip

LAPS (unique local admin passwords) prevents one hash from working everywhere.

Related terms