Hey there, back again with another post! 😄

Pass the Hash (PtH) attacks are one of the most effective lateral movement techniques in penetration testing and red team operations. Instead of cracking password hashes to obtain plaintext passwords, this technique allows attackers to authenticate directly using the NTLM hash itself.

In this blog post will see some fundamentals of Windows authentication, when to use PtH attacks, and various methods to perform them from both Windows and Linux.

Free Link For Non Members 😄

WINDOWS AUTHENTICATION FUNDAMENTALS

Understanding Kerberos vs NTLM

Before diving into PtH attacks, lets understand the authentication protocols in Windows environments:

Kerberos
is the default authentication method sicne Windows 2000. It uses tickets instead of password hashes. Kerberos requires a Key Distribution Center, typically a domain controller. More secure with mutual authentication.

NTLM (PtH Target)
is an older authentication method that is still widely used. NTLM uses a challenge-response protocol using password hashes. No mutual authentication is present which means the client doesn’t verify the server. It is still used for backward compatibility and in certain scenarios. This is where Pass-the-Hash attacks occur.