Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords

The hashes that open doors without a password

By now secretsdump has handed us a folder full of uid:rid:lmhash:nthash lines and not a single plaintext password for most of them. That is the whole point of an NTLM hash in an Active Directory engagement: you often do not need the password at all. Two techniques turn a raw hash into movement, and they are different enough to keep straight:

• Pass-the-hash (PTH) feeds the hash into NTLM authentication directly.
• Overpass-the-hash (OPTH) exchanges the hash for a Kerberos TGT and moves over Kerberos.

Both log in as Administrator without cracking anything. The difference is which protocol ends up carrying you.

Pass-the-hash: NTLM does not care where the hash came from

NTLM authentication proves you know a password by proving you know its hash — the protocol literally only ever sees the hash, never the plaintext. So if you hold the NTLM hash, you can answer the NTLM challenge directly. nxc does it with -H:

$ nxc smb 192.168.56.10 -u Administrator -H c66d72021a2d4744409969a581a1705e -d sevenkingdoms.local
SMB  192.168.56.10  445  KINGSLANDING  [+] sevenkingdoms.local\Administrator:c66d72... (Pwn3d!)

No -p, no password. The Pwn3d! is nxc confirming the hash authenticated over SMB as a Domain Admin. The same -H works against impacket-psexec, impacket-wmiexec, and evil-winrm for code execution — the hash is a drop-in replacement for the password across every NTLM-based tool.

The catch is the protocol. PTH only works where NTLM is allowed. If the environment has disabled NTLM or a control flags NTLM logons, this road is closed — which is exactly when you reach for the Kerberos version.

Overpass-the-hash: trading the hash for a ticket

Overpass-the-hash “over”-uses the hash. Instead of feeding it into NTLM, you use it to answer the Kerberos AS-REQ pre-authentication — which proves you know the account’s long-term key — and receive a real TGT. From there you move over Kerberos, exactly like a normal logon:

$ impacket-getTGT sevenkingdoms.local/Administrator -hashes :c66d72021a2d4744409969a581a1705e
[*] Saving ticket in Administrator.ccache

$ export KRB5CCNAME=Administrator.ccache
$ nxc smb kingslanding.sevenkingdoms.local -k --use-kcache
SMB  kingslanding.sevenkingdoms.local  445  KINGSLANDING  [+] SEVENKINGDOMS.LOCAL\Administrator from ccache (Pwn3d!)

Note the -k this time: the authentication is Kerberos, driven by the ticket we minted from the hash. The output is the same Pwn3d!, but it lands through the KDC instead of around it.

The practical difference matters. If NTLM is blocked or heavily audited, OPTH still works because Kerberos is the default and legitimate path. And once you hold a TGT, you can request service tickets for any service the account can reach — the hash is gone from the picture entirely.

Detection and the fix

Detection: PTH is visible as NTLM logons (Event 4624 with logon type 3 and NTLM as the package) sourced from unexpected hosts — a user authenticating from a machine they never logged into before. OPTH looks like a normal Kerberos logon, but the 4768 AS-REQ for a Tier-0 account from a non-standard workstation, or a TGT issued to an account whose password you know has not been used recently, is the tell.

Control: The root cause is always the same as DCSync: an attacker with a DA hash. Block the acquisition — Protected Users (which blocks NTLM for its members), LAPS, and Credential Guard all make the hash harder to get. On the movement side, restrict NTLM outright, enforce Kerberos with AES-only, and monitor for Tier-0 accounts authenticating from unusual sources.

Summary

Evidence and limits

Both Pass-the-Hash (nxc smb/winrm -H) and Overpass-the-Hash (impacket-getTGT -hashes followed by -k --use-kcache) were verified against KINGSLANDING, WINTERFELL, and MEEREEN in the isolated GOAD lab using the Domain Admin NT hashes recovered during DCSync.

References

• Orange Cyberdefense, GOAD: orange-cyberdefense.github.io/GOAD
• The Hacker Recipes, Pass-the-hash: thehacker.recipes/ad/movement/ntlm/pth
• HackTricks, Over Pass the Hash/Pass the Key: hacktricks.wiki
• MITRE ATT&CK, Pass the Hash (T1550.002): attack.mitre.org/techniques/T1550/002
• MITRE ATT&CK, Pass the Ticket (T1550.003): attack.mitre.org/techniques/T1550/003