Glossary
Pass-the-hash (PtH)
Authenticating to a Windows service with a user's NT hash instead of their password, exploiting the fact that NTLM uses the raw hash as the secret.
Pass-the-hash (PtH) is an authentication technique that uses a user's NT hash directly, without ever cracking it back to a plaintext password. It works because NTLM authentication uses the NT hash itself as the shared secret — the challenge-response is computed from the hash, so possessing the hash is equivalent to possessing the password.
This is exactly why offline credential dumping matters: an unsalted NT hash
recovered from a SAM hive or from NTDS.dit can be
replayed against remote services immediately. Note the contrast with cached
domain credentials (DCC2), which are salted, iterated
verifiers that cannot be passed — only cracked.