Lion Cipher Lab

Pass-the-Hash: move laterally with a stolen NTLM hash in your own AD lab — then break the reuse with LAPS

• Penetration Testing / Red Team
• Intermediate
• ~90 min
• Free · no account required

Why it matters

Pass-the-Hash is one of the most reliable ways real intrusions spread, and it is almost never a clever exploit -- it is credential reuse. Windows can authenticate an NTLM logon using the account's password HASH instead of the plaintext, so if you steal the hash you can log in as that user without ever knowing or cracking the password. The reason this becomes a network-wide disaster is boring and extremely common: organisations build machines from one image and leave the SAME local Administrator password on all of them. One password means one NT hash, so a single hash dumped from any machine…

What you'll learn

• explaining in plain words what an NTLM hash is and why, for authentication, it is a password-equivalent: Windows will accept the NT hash directly in an NTLM logon, so an attacker who holds the hash never needs to know or crack the plaintext
• recognising the single misconfiguration that turns one dumped hash into a whole-network compromise: the SAME local Administrator password (and therefore the same NT hash) set on many machines from a golden image
• dumping the local account hashes from a machine you control with impacket's secretsdump, and reading the SAM output to pick out the local Administrator's NT hash
• performing Pass-the-Hash with impacket's wmiexec/psexec using -hashes LMHASH:NTHASH to get command execution on a SECOND host as local Administrator, with no password and no cracking
• measuring the BEFORE state honestly: the reused hash authenticates on every machine that shares the password, so the blast radius is 'all of them'
• deploying the fix that actually removes the reuse: Windows LAPS, which sets a unique random local Administrator password per machine and rotates it, so one machine's hash no longer opens any other
• adding the second control: denying local accounts (well-known SIDs S-1-5-113 / S-1-5-114) the 'Access this computer from the network' right by Group Policy, so a local-account hash cannot be used for a network logon at all
• RE-MEASURING after the fix: the same secretsdump-then-PtH sequence now works on exactly one host (or none, if network logon for local accounts is denied) instead of the whole fleet
• the judgment: Pass-the-Hash is a CREDENTIAL-REUSE and NTLM problem, not a weak-password problem, so 'use a longer password' does not fix it -- unique credentials and blocking lateral NTLM do; and knowing the honest limits (it targets local-account reuse here; domain accounts need Protected Users / tiering, and Kerberos has its own pass-the-ticket analogue)
• placing the technique on MITRE ATT&CK -- T1550.002 (Use Alternate Authentication Material: Pass the Hash) -- so you know exactly what a defender hunts for and how the sibling detection lab catches it

Steps in this lab

1. First, the shape of the problem — a hash is a password, and reuse is the disaster
2. Set up: two Windows hosts that share a local admin password
3. Get the hash: dump local accounts from the host you control
4. BEFORE — pass the hash to a SECOND host and get a shell
5. Why this worked — and why 'use a longer password' does nothing
6. HARDEN (fix 1) — kill the reuse with Windows LAPS, then re-measure
7. HARDEN (fix 2) — deny local accounts a network logon, then re-measure
8. Honest limits, and how a pro thinks about it

Open the full interactive lab →