Hashed passwords for NTLM authentication

Question

I understood that Windows users' password hashes can be exported very easily. Right? So my question is:

If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't it good enough for me for impersonating other users?

For example, when a user tries to log into some web site using NTLM, only the HASH of the password is used for the challenge process. So if I already have this hash (as it is saved locally and can be exported easily), doesn't it mean that I can fake the challenge process? Why do I need to crack the password if the hash can be good enough for me?

Answer 1

You are absolutely correct. This is a very well known problem with NTLM authentication and the resulting attack is known as Pass the Hash. There is in fact a very handy tool called Pass-The-Hash toolkit that makes exploiting this really easy.