Definition
A Pass-the-Hash Attack is a technique where an attacker captures a user's password hash and uses it directly to authenticate to other systems without needing to crack or know the actual plaintext password.
People Also Ask
Common questions about Pass-the-Hash Attack answered by our security experts.
Pass-the-Hash Attack in Practice
Pass the hash is authenticating with a stored password hash instead of the password itself. Where a protocol accepts the hash as proof of identity, an attacker who obtains it does not need to crack anything.
It matters because it defeats the assumption behind password hashing. Storing hashes rather than passwords protects the password; it does not protect the account if the hash is itself sufficient to authenticate.
Where the hashes come from
Memory on a compromised machine, where credential material for currently and recently logged-on users is held. The local account database on the host. Cached domain credentials that allow login when a domain controller is unreachable.
And directory replication, where an attacker who has obtained sufficient rights can request every hash in the domain at once — which converts one privileged compromise into every credential.
Why it enables lateral movement so effectively
An administrator who logged into a compromised workstation leaves credential material on it. That material authenticates anywhere that account has rights, which for a domain administrator is everywhere.
This is the specific mechanism behind the rule that privileged accounts should never be used on ordinary workstations. See lateral movement.
The related techniques
Pass the ticket, which uses stolen authentication tickets rather than hashes and works the same way. Forged tickets, created using a compromised service or account key, which can grant access without any legitimate authentication event at all.
Overpass the hash, which converts a stolen hash into a full authentication ticket. The family is broad and the defensive conclusions are largely shared.
Defences
Tiered administration, so privileged credentials are only used on dedicated administrative systems. Unique local administrator passwords per machine, so a harvested local hash does not travel.
Platform credential protection features, which isolate credential material from the operating system so that even administrative access on the host cannot read it. Restricting cached credentials. And restricting which accounts may authenticate to which systems.
Detection
Authentication events with characteristics inconsistent with an interactive logon. The same account authenticating from many hosts in a short period. Access to the process holding credential material, which has very few legitimate causes.
Directory replication requests from anything that is not a domain controller, which is among the highest-fidelity detections available in a directory environment and is rarely configured.
Why the protocols still permit it
The behaviour is not a defect to be patched — it is how the authentication protocols were designed, and changing it would break a great deal of working software. Which is why the answer is architectural rather than a fix.
Migration away from the older authentication protocols where possible, combined with credential isolation features and tiered administration, is the realistic direction. Waiting for a patch that removes the technique is not an available strategy.
Where to start
Establish whether domain administrator accounts are ever used to log into ordinary workstations. If they are, every one of those machines is a route to full domain control.
See Active Directory. GuardsArm runs internal penetration testing.
Related Terms
Active Directory
Active Directory (AD) is Microsoft's directory service for Windows domain networks that provides authentication, authorization, group policy management, and centralized resource management across an organization.
Credential Stuffing
Credential Stuffing is an automated attack that uses stolen username and password pairs from data breaches to gain unauthorized access to user accounts on other services, exploiting password reuse.
Privilege Escalation
Privilege Escalation is the exploitation of a bug, design flaw, or configuration oversight in an operating system or application to gain elevated access to resources that are normally protected from unprivileged users.
Related Reading
Privileged Access Management: Vaults, Secrets and Machine Identities
Most PAM programmes secure human administrators and ignore the service accounts, which outnumber them heavily and never change their passwords.
Speak With an Expert
Book a free consultation to discuss pass-the-hash attack for your organization.
Related Services
Need Help With Pass-the-Hash Attack?
Our certified security professionals can help you implement the right pass-the-hash attack strategy for your organization. Get a free assessment today.
Book a Free Consultation