Pass-the-hash: authenticating without the password

In NTLM the proof of identity derives from the NT hash of the password, not the cleartext. So the hash is the credential.

The attack

Given an NT hash (from LSASS, SAM, or a dump), you use it to authenticate to SMB/WMI services without ever knowing the password:

pth-winexe -U 'dom/admin%aad3b...:31d6cfe0...' //host cmd
impacket-wmiexec -hashes :NTHASH dom/admin@host

A local-admin hash identical across many machines (a cloned image) enables sweeping lateral movement.

Defence

LAPS for unique, rotating local admin passwords. Credential Guard to protect LSASS. Limit local admins, account tiering, and disable NTLM where possible in favour of Kerberos. Detect anomalous NTLM authentications.