unicornAll work

Windows authentication: NTLM & hashes

Why Windows stores hashes, and how pass-the-hash logs in without cracking them.

In a nutshell Windows doesn't store your password — it stores a hash of it, and often authenticates using that hash rather than the plaintext. That design detail creates one of Windows' most famous weaknesses: steal the hash and you can sometimes log in as that user without ever cracking it — "pass-the-hash."

Where Windows keeps secrets

Local account hashes live in the SAM database; the running secrets of logged-in users live in the memory of LSASS; in a domain, all hashes live on the DC (NTDS.dit). Attackers dump these — from SAM, from LSASS memory (mimikatz is the famous tool), or from the DC.

Analogy — a coat-check that takes a token, not your name. You hand in a token (the hash) and get your coat; the attendant never asks your name (the password). Anyone holding a valid token gets the coat — they didn't need to be you, just hold your token.

Pass-the-Hash — the headline attack

Because NTLM authentication can accept the hash itself as proof, a stolen NTLM hash authenticates you as that user to other machines without knowing or cracking the password:

Machine Ayou own it hashof an admin Machine Badmin can reach dump from LSASS reuse the hash no password ever known or cracked
Steal one admin's hash from one box and you may unlock every box that admin can reach.

The family of attacks

Attack What it does
Pass-the-Hash authenticate with the NTLM hash directly, no password
NTLM relay capture an auth attempt and relay it to another server in real time
cracking dump hashes, run hashcat offline to recover the real passwords
Pass-the-Ticket the Kerberos equivalent — steal and reuse a ticket (see Active Directory)

This is the engine of lateral movement: you rarely crack every password; you harvest hashes/tickets from each machine and pass them to the next, spreading sideways and up to Domain Admin.

The defender's view Don't reuse local-admin passwords across machines (Microsoft's LAPS randomizes each), so one dumped hash can't unlock the fleet. Protect LSASS (Credential Guard). Tier privileged accounts so their hashes never land on a low, attacker-reachable machine. The through-line: a credential doesn't have to be known to be used — treat hashes and tickets as the passwords they effectively are.
All theory