--- title: "Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords" description: "DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems." date: 2026-11-04 author: Sevban Dönmez (@jankesec) canonical: https://jankesec.com/posts/pass-the-hash-overpass-the-hash/ --- ## The hashes that open doors without a password By now `secretsdump` has handed us a folder full of `uid:rid:lmhash:nthash` lines and not a single plaintext password for most of them. That is the whole point of an NTLM hash in an Active Directory engagement: you often do not need the password at all. Two techniques turn a raw hash into movement, and they are different enough to keep straight: - **Pass-the-hash (PTH)** feeds the hash into **NTLM** authentication directly. - **Overpass-the-hash (OPTH)** exchanges the hash for a **Kerberos TGT** and moves over Kerberos. Both log in as `Administrator` without cracking anything. The difference is *which protocol* ends up carrying you. ## Pass-the-hash: NTLM does not care where the hash came from NTLM authentication proves you know a password by proving you know its hash — the protocol literally only ever sees the hash, never the plaintext. So if you hold the NTLM hash, you can answer the NTLM challenge directly. `nxc` does it with `-H`: ```bash $ nxc smb 192.168.56.10 -u Administrator -H c66d72021a2d4744409969a581a1705e -d sevenkingdoms.local SMB 192.168.56.10 445 KINGSLANDING [+] sevenkingdoms.local\Administrator:c66d72... (Pwn3d!) ``` No `-p`, no password. The `Pwn3d!` is `nxc` confirming the hash authenticated over SMB as a Domain Admin. The same `-H` works against `impacket-psexec`, `impacket-wmiexec`, and `evil-winrm` for code execution — the hash is a drop-in replacement for the password across every NTLM-based tool. The catch is the protocol. PTH only works where NTLM is allowed. If the environment has disabled NTLM or a control flags NTLM logons, this road is closed — which is exactly when you reach for the Kerberos version. ## Overpass-the-hash: trading the hash for a ticket Overpass-the-hash "over"-uses the hash. Instead of feeding it into NTLM, you use it to answer the Kerberos `AS-REQ` pre-authentication — which proves you know the account's long-term key — and receive a real TGT. From there you move over Kerberos, exactly like a normal logon: ```bash $ impacket-getTGT sevenkingdoms.local/Administrator -hashes :c66d72021a2d4744409969a581a1705e [*] Saving ticket in Administrator.ccache $ export KRB5CCNAME=Administrator.ccache $ nxc smb kingslanding.sevenkingdoms.local -k --use-kcache SMB kingslanding.sevenkingdoms.local 445 KINGSLANDING [+] SEVENKINGDOMS.LOCAL\Administrator from ccache (Pwn3d!) ``` Note the `-k` this time: the authentication is Kerberos, driven by the ticket we minted from the hash. The output is the same `Pwn3d!`, but it lands through the KDC instead of around it. The practical difference matters. If NTLM is blocked or heavily audited, OPTH still works because Kerberos is the default and legitimate path. And once you hold a TGT, you can request service tickets for any service the account can reach — the hash is gone from the picture entirely.

The same NTLM hash, two doors: pass-the-hash answers an NTLM challenge directly, overpass-the-hash trades the hash for a Kerberos TGT and moves over the KDC.

## Detection and the fix **Detection:** PTH is visible as NTLM logons (Event `4624` with logon type `3` and NTLM as the package) sourced from unexpected hosts — a user authenticating from a machine they never logged into before. OPTH looks like a normal Kerberos logon, but the `4768` `AS-REQ` for a Tier-0 account from a non-standard workstation, or a TGT issued to an account whose password you know has not been used recently, is the tell. **Control:** The root cause is always the same as DCSync: an attacker with a DA hash. Block the *acquisition* — `Protected Users` (which blocks NTLM for its members), `LAPS`, and `Credential Guard` all make the hash harder to get. On the movement side, restrict NTLM outright, enforce Kerberos with AES-only, and monitor for Tier-0 accounts authenticating from unusual sources. ## Summary | Property | Pass-the-hash | Overpass-the-hash | | --- | --- | --- | | Protocol | NTLM | Kerberos | | Input | NTLM hash | NTLM hash | | Output | direct NTLM logon | TGT → service tickets | | Use when | NTLM is allowed | NTLM is blocked/audited | | Tell | `4624` NTLM from odd host | `4768` for Tier-0 from odd host | ## Evidence and limits Both Pass-the-Hash (`nxc smb/winrm -H`) and Overpass-the-Hash (`impacket-getTGT -hashes` followed by `-k --use-kcache`) were verified against `KINGSLANDING`, `WINTERFELL`, and `MEEREEN` in the isolated GOAD lab using the Domain Admin NT hashes recovered during DCSync. ## References - **Orange Cyberdefense, GOAD:** [orange-cyberdefense.github.io/GOAD](https://orange-cyberdefense.github.io/GOAD/) - **The Hacker Recipes, Pass-the-hash:** [thehacker.recipes/ad/movement/ntlm/pth](https://www.thehacker.recipes/ad/movement/ntlm/pth) - **HackTricks, Over Pass the Hash/Pass the Key:** [hacktricks.wiki](https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html) - **MITRE ATT&CK, Pass the Hash (T1550.002):** [attack.mitre.org/techniques/T1550/002](https://attack.mitre.org/techniques/T1550/002/) - **MITRE ATT&CK, Pass the Ticket (T1550.003):** [attack.mitre.org/techniques/T1550/003](https://attack.mitre.org/techniques/T1550/003/)