> For the complete documentation index, see [llms.txt](https://www.udayxd.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.udayxd.tech/notes/windows-active-directory-ad/pass-the-hash.md). # Pass The Hash During internal security tests, auditors often need to move from one computer to another (called **lateral movement**) to find useful data and gain higher access. A common trick used in these tests is **Pass-the-Hash** it lets someone reuse a stored password hash to log into other machines and try to become an administrator. > To understand pass-the-hash you mast under stand how NTLM protocol work's > > ### What is Pass the Hash? **Pass the Hash (PTH)** is an authentication attack where an attacker uses a stolen password hash (specifically the NT hash in Windows) to authenticate to systems *without needing to crack the password*. Windows allows authentication using just the hash itself. ### Why This Works In Windows authentication, the system stores password hashes (NT hashes) rather than plain passwords. When you authenticate, Windows can verify you by checking your hash. The vulnerability: **if you have someone's NT hash, you can authenticate as them without knowing their actual password**. ### Two Attack Scenarios Explained #### Scenario 1: Identical Local Administrator Accounts **The Setup:** * IT departments often create a "master image" of Windows for efficiency * This master has a configured local Administrator account * Every workstation deployed from this master has the **same Administrator account with the same password** * Same password = same NT hash across all machines **The Attack:** 1. Attacker compromises one workstation 2. Extracts the local Administrator's NT hash (e.g., `20cc650a5ac276a1cfc22fbc23beada1`) 3. Uses this hash to authenticate to ANY other workstation built from the same master 4. Result: Administrative access to potentially dozens or hundreds of machines **Example given:** ## Using Impacket's psexec.py with the stolen hash psexec.py -hashes :20cc650a5ac276a1cfc22fbc23beada1 Administrator\@target-machine #### Scenario 2: Domain Group with Local Admin Rights **The Setup:** * IT creates a domain group (e.g., "HelpDesk") * This group is added to the local Administrators group on all workstations via Group Policy (GPO) * Anyone in HelpDesk can administer any workstation **The Attack:** 1. Attacker compromises one user account in the HelpDesk group (e.g., user "jsnow") 2. Extracts jsnow's NT hash (e.g., `89db9cd74150fc8d8559c3c19768ca3f`) 3. Uses this domain user's hash to authenticate to ANY machine where HelpDesk has admin rights 4. The domain controller validates the authentication 5. The target machine sees the user is in HelpDesk group → grants admin access **Why this is more powerful:** * Works across ALL workstations regardless of which master image was used * Domain groups are typically added via GPO, so coverage is broader * One compromised domain account = potential access to entire fleet ### The Authentication Flow (Scenario 2) Attacker → \[Uses jsnow's hash] → Target Workstation ↓ Asks Domain Controller: "Is this hash valid?" ↓ DC responds: "Yes, that's jsnow, member of HelpDesk" ↓ Workstation: "HelpDesk is in local Admins, grant access" ### Why This is Dangerous 1. **No password cracking needed** - hashes work directly 2. **Lateral movement** - one compromise leads to many 3. **Persistence** - unless passwords change, hashes remain valid 4. **Difficult to detect** - looks like legitimate authentication. ### Pass the Hash Limitations While Pass the Hash works when NTLM authentication is enabled (which is the default), Windows has built-in protections that can restrict what an attacker can actually do after authenticating. ### Access Tokens and UAC (User Account Control) **How Windows manages privileges:** Windows uses **Access Tokens** to control permissions - they define "who can do what." **For members of the Administrators group:** * They receive **two tokens**: 1. A **standard user token** (limited privileges) - used by default 2. An **administrator token** (full privileges) - used only when needed **Locally on a machine:** When an administrator tries to perform administrative tasks, Windows shows the UAC prompt: ``` [UAC Window appears] "Do you want to allow this app to make changes to your device?" ``` This elevates from the standard token to the admin token. > will cover UAC in up-coming notes --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://www.udayxd.tech/notes/windows-active-directory-ad/pass-the-hash.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.