In a nutshell Windows doesn't store your password — it stores a hash of it, and often authenticates using that hash rather than the plaintext. That design detail creates one of Windows' most famous weaknesses: steal the hash and you can sometimes log in as that user without ever cracking it — "pass-the-hash."
Where Windows keeps secrets
Local account hashes live in the SAM database; the running secrets of logged-in users live in the memory of LSASS; in a domain, all hashes live on the DC (NTDS.dit). Attackers dump these — from SAM, from LSASS memory (mimikatz is the famous tool), or from the DC.
Analogy — a coat-check that takes a token, not your name. You hand in a token (the hash) and get your coat; the attendant never asks your name (the password). Anyone holding a valid token gets the coat — they didn't need to be you, just hold your token.
Pass-the-Hash — the headline attack
Because NTLM authentication can accept the hash itself as proof, a stolen NTLM hash authenticates you as that user to other machines without knowing or cracking the password:
The family of attacks
| Attack | What it does |
|---|---|
| Pass-the-Hash | authenticate with the NTLM hash directly, no password |
| NTLM relay | capture an auth attempt and relay it to another server in real time |
| cracking | dump hashes, run hashcat offline to recover the real passwords |
| Pass-the-Ticket | the Kerberos equivalent — steal and reuse a ticket (see Active Directory) |
This is the engine of lateral movement: you rarely crack every password; you harvest hashes/tickets from each machine and pass them to the next, spreading sideways and up to Domain Admin.