Pass-the-hash in plain English
Windows doesn’t store passwords in plain text but as hashes. A hash is a kind of digital fingerprint: a fixed mathematical procedure turns the password into a string of characters. There’s no easy way to work backward from this string to the password.
The problem: with NTLM, an older Windows authentication protocol, this fingerprint is enough to sign in. Anyone who has the hash doesn’t need the password. Hence the name: the attacker simply “passes the hash” along instead of the password.
Think of a bouncer who doesn’t check tickets, only the stamp on the back of your hand. Anyone who can copy the stamp gets in – no ticket required. The hash is that stamp. Because the login looks technically correct, the abuse is hard to spot.
How a pass-the-hash attack works
- Initial access: The attacker gains access to a computer on the network, for example through a phishing email carrying malware.
- Escalate privileges: To extract hashes, they need local administrator rights. If necessary, they obtain these through privilege escalation.
- Extract hashes: Using freely available tools, they read hashes from the local user database and from memory. Memory holds the credentials of the people currently signed in to that computer – in the worst case, those of a domain administrator, an account with full access to the entire Windows network.
- Pass them on: With the hash, they sign in to other computers and servers. If the same local administrator password is set on many devices, a single hash opens many doors.
- Spread: Step by step, they move through the network this way (lateral movement) until they capture an account with domain administrator rights. With it, they control Active Directory – the central directory service that manages all accounts and permissions in the Windows network.
A practical example
An engineering firm set up all its workstations from a common system image – with the same local administrator password on every device. In an internal penetration test, the testing team initially receives only an ordinary user account.
Through outdated printer software, the team gains administrator rights on the test workstation it was given and extracts the hash of the local administrator account. Using this hash, it signs in to other computers. On one of them, a domain administrator is still signed in – he had fixed a problem there via remote access and never ended the session. His hash opens the way to the domain controller, the central server of Active Directory.
None of these steps triggers an alert. The report shows the entire attack path and the points at which it can be interrupted.
Why does this matter for businesses?
Pass-the-hash explains why a single infected computer can quickly turn into a company-wide incident. Attacker groups use such techniques to spread through the network before, for example, encrypting data with ransomware – extortion malware.
The causes usually lie in the configuration: identical local passwords, highly privileged accounts that the IT team uses to sign in to ordinary workstations, and NTLM, which is still active in many networks. Because the logins look legitimate, traditional security software often fails to detect the attack.
The good news: the most effective countermeasures can largely be implemented with tools built into Windows.
How to protect your organization
- Unique local passwords: With Windows LAPS (Local Administrator Password Solution), a free Windows feature, every computer gets its own regularly changing password for the local administrator account.
- Tiered model for administrator accounts: Strictly separate the accounts for workstations, servers, and domain controllers. Domain administrator accounts are never used on ordinary workstations.
- Protect credentials in memory: Credential Guard shields the area in which Windows holds credentials. The “Protected Users” group prevents, among other things, NTLM sign-ins for particularly sensitive accounts.
- Phase out NTLM: Use the more modern Kerberos authentication protocol wherever possible and restrict NTLM step by step.
- Reduce privileges: Ordinary user accounts don’t need administrator rights on their own computers.
- Monitor for anomalies: Network logins with local administrator accounts between workstations are a clear warning sign.
How Rootsektor can help
In our Active Directory security assessment, we check whether pass-the-hash and related techniques would succeed in your network: we look for identical local passwords, risky sign-ins by privileged accounts, and attack paths leading all the way to domain administrator. We perform internal tests either on-site or remotely. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.