If a hacker able to get local admin rights and then from there local domain admin's NTLM hash.

Can he use this hash without cracking, to access shared folders in the network and the default C drive share on all network machines ?

I know he himself using local account he compromised can become domain admin by several ways. But would that be detectable ?

What would be the most passive way to move forward for him ?


Yes, this is called the Pass the Hash attack.

Microsoft has not issued any solution to mitigate (except for some vague general security advice), until Windows 10 where the hash is stored in a special vault.

An example of exploit (via Metasploit) can be found at Offensive Security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.