I understood that Windows users' password hashes can be exported very easily. Right? So my question is:

If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't it good enough for me for impersonating other users?

For example, when a user tries to log into some web site using NTLM, only the HASH of the password is used for the challenge process. So if I already have this hash (as it is saved locally and can be exported easily), doesn't it mean that I can fake the challenge process? Why do I need to crack the password if the hash can be good enough for me?


You are absolutely correct. This is a very well known problem with NTLM authentication and the resulting attack is known as Pass the Hash. There is in fact a very handy tool called Pass-The-Hash toolkit that makes exploiting this really easy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.