Pass-the-hash

Pass-the-hash authenticates to a remote system using a stolen password hash without ever cracking it. NTLM’s challenge-response protocol proves possession of the hash, not the password, so the hash is a full credential equivalent: an attacker who dumps it from a compromised machine’s memory or SAM database (Mimikatz is the standard tool) can open new sessions as that user directly. The one-way nature of hashing is no protection here, because nothing needs to be reversed.

The subtlety is where it works: pass-the-hash is an NTLM problem, and it survives wherever NTLM is still accepted, which in most Windows estates is almost everywhere. Its Kerberos-era sibling is pass the ticket, which replays stolen Kerberos tickets instead of hashes. Mitigations aim at the credential’s exposure: Credential Guard, disabling NTLM where possible, unique local admin passwords (LAPS), and tightly limiting where privileged accounts are allowed to log on.

Exam relevance: authenticated with the hash, no cracking required is the trigger, and the answer is pass-the-hash. Contrast password cracking, which runs offline guesses to recover the plaintext, and pass the ticket, which is the Kerberos analogue. If the stolen secret is the KRBTGT hash used to forge tickets, the scenario has escalated to the golden ticket attack.