I understood that Windows users' password hashes can be exported very easily. Right? So my question is:
If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't it good enough for me for impersonating other users?
For example, when a user tries to log into some web site using NTLM, only the HASH of the password is used for the challenge process. So if I already have this hash (as it is saved locally and can be exported easily), doesn't it mean that I can fake the challenge process? Why do I need to crack the password if the hash can be good enough for me?