Day 26: Pass the Hash & Pass the Ticket 2026 — Lateral Movement With NTLM & Kerberos

This article teaches Pass the Hash (PtH) and Pass the Ticket (PtT) attacks, two lateral movement techniques that reuse stolen authentication credentials—NTLM hashes and Kerberos tickets—to move across Windows networks without cracking passwords. Rather than extracting and cracking credentials, attackers weaponize credentials already stored in memory by the operating system, enabling rapid domain compromise from a single compromised workstation. The techniques matter because they represent the inflection point where a localized breach becomes full enterprise takeover, and understanding them is essential for both penetration testers and defenders.

• NTLM Hash as Direct Authentication MaterialNTLM authentication transmits the hash itself as the credential rather than the plaintext password, and receiving servers validate the hash directly. This means an attacker who extracts an NTLM hash from LSASS memory can immediately authenticate to any NTLM-protected service as that user without cracking it. The hash is functionally equivalent to the password in NTLM's authentication model, making hash extraction equivalent to full credential compromise.
• Kerberos Ticket Exploitation and ValidityWindows stores Kerberos Ticket Granting Tickets (TGTs) and service tickets in memory. Stealing and injecting these tickets allows authentication to Kerberos-protected services within the ticket's validity window, typically 10 hours. Unlike NTLM hashes, Kerberos tickets remain valid even after a user's password is reset unless the KRBTGT account key is rotated, making them particularly persistent post-compromise.
• Extraction via Mimikatz and LSASS AccessMimikatz, written by Benjamin Delpy, accesses the Local Security Authority Subsystem Service (LSASS) process to dump both NTLM hashes and Kerberos tickets from memory. Extraction requires SYSTEM privileges or local Administrator rights with SeDebugPrivilege. The tool uses commands like `sekurlsa::logonpasswords` to dump credentials and `sekurlsa::tickets /export` to export tickets as .kirbi files.
• Hash Spray Pattern and Local Admin ReuseOnce an attacker obtains one NTLM hash, CrackMapExec tests it across entire subnets in seconds to identify all hosts accepting that credential. In real enterprises, local administrator passwords are often identical across machines due to poor configuration management. A single workstation compromise frequently yields hashes that unlock 5, 10, or 50+ additional machines—a pattern called local administrator password reuse that is among the most prevalent misconfigurations in enterprise Windows networks.
• Cascading Lateral Movement Through Hash EscalationThe workflow creates a compounding effect: compromise one machine → extract hashes with Mimikatz → spray with CrackMapExec → access new machines → use impacket-secretsdump to dump SAM databases on newly-accessed hosts → extract new hashes → repeat. Each new machine yields more hashes, each hash unlocks more machines. The article describes this as the 'hash spray cascade' that enables full domain compromise within hours from a single unpatched endpoint.
• Detection via Windows Event IDs and EDRWindows Event ID 4624 with Logon Type 3 and NTLM authentication flags lateral movement; Event 4648 flags explicit credential use. EDR solutions directly detect LSASS access by non-system processes. Mimikatz itself is detected by virtually all antivirus and EDR solutions through signature recognition, though penetration testers use obfuscated or in-memory versions in real engagements.
• Microsoft Defenses: LAPS and Credential GuardLocal Administrator Password Solution (LAPS) sets unique randomized local admin passwords on every machine, eliminating hash reuse attacks across the network. Credential Guard stores credentials in a virtualization-based isolated environment that Mimikatz cannot access. Protected Users group prevents NTLM authentication and Kerberos delegation for high-privilege accounts. These mitigations directly counter the techniques taught in the article.
• Why Password Reset Alone Is InsufficientResetting a compromised user's password does not invalidate NTLM hashes already extracted from memory—the hash changes, but the attacker has already moved laterally. Kerberos TGTs remain valid for 10 hours unless the KRBTGT account key is rotated. Effective incident response requires isolating compromised machines, rotating KRBTGT keys twice to invalidate all tickets, and forcing password resets on all accounts authenticated to compromised hosts, not just the initially-breached account.

Bottom line: Pass the Hash and Pass the Ticket are not theoretical attacks—they are the primary mechanism by which single workstation compromises transform into full domain takeover in real enterprise environments, typically within hours and without requiring password cracking. Penetration testers must master both the attack execution (hash extraction, CrackMapExec spraying, ticket injection) and the defender's detection patterns and mitigations (LAPS, Credential Guard, Event ID monitoring) to operate effect