Pass-the-Hash vs Pass-the-Ticket: The Critical Difference Explained
Attackers bypass password requirements by stealing cryptographic proofs, making credential resets useless against these specific authentication theft methods.
Pass-the-hash steals the cryptographic hash of a password to authenticate directly to servers. Pass-the-ticket steals the Kerberos ticket-granting ticket, allowing access without interacting with the authentication server. Both bypass password checks but operate at different protocol layers.
The Core Distinction Between Authentication Theft
The fundamental difference lies in what the attacker steals and how they use it. Pass-the-hash involves stealing the cryptographic hash of a user’s password. This hash is a fixed-length string derived from the password using a one-way function. The attacker uses this hash to authenticate to remote systems without ever knowing the actual password. Pass-the-ticket involves stealing the Kerberos ticket-granting ticket (TGT). This ticket is issued by the Key Distribution Center after initial authentication. The attacker replays this ticket to request access to other services, bypassing the need for any password or hash interaction.
How Pass-the-Hash Operates
In a pass-the-hash attack, the adversary targets the Local Security Authority Subsystem Service (LSASS) memory or the Security Account Manager (SAM) database. These locations store the NTLM hash of user passwords. NTLM is an older authentication protocol that remains active in many environments for compatibility. Once the attacker extracts the hash, they inject it into a network request. The target server compares the provided hash against its stored copy. If they match, access is granted. This method works because the server never needs to decrypt the hash; it only needs to verify the mathematical match.
How Pass-the-Ticket Functions
Pass-the-ticket attacks target the Kerberos protocol, which is the default authentication mechanism in modern Windows domains. When a user logs in, the Key Distribution Center issues a TGT. This ticket is encrypted with the domain controller’s secret key and stored in the user’s session memory. An attacker with administrative privileges can extract this TGT from memory. They then use the TGT to request service tickets for other resources. The target service validates the ticket against the Key Distribution Center. Because the ticket is valid and unexpired, the service grants access. This process leaves no trace of password authentication on the domain controller logs.
Point-by-Point Comparison of Techniques
| Aspect | Pass-the-Hash | Pass-the-Ticket |
|---|---|---|
| Target Data | NTLM password hash | Kerberos TGT or Service Ticket |
| Protocol Used | NTLM or older LAN Manager | Kerberos |
| Credential Reset | Invalidates future access | Often ineffective if ticket is cached |
| Detection Difficulty | Moderate; clear authentication events | High; may bypass standard auth logs |
| Prerequisite Access | Local admin or SYSTEM privileges | Local admin or SYSTEM privileges |
| Network Traffic | Contains hash in authentication packet | Contains encrypted ticket blob |
| Scope of Access | Limited to NTLM-enabled services | Broad; any Kerberos-enabled service |
Strategic Overlap and Convergence
Both techniques share a critical similarity: they are lateral movement tactics. They allow an attacker to move from a compromised machine to others without needing the cleartext password. Both require high-level privileges on the initial host, typically local administrator or SYSTEM rights. Both exploit the trust relationships inherent in Windows domain environments. The overlap becomes most dangerous when an attacker uses pass-the-hash to gain initial foothold, then pivots to pass-the-ticket for deeper, stealthier movement. This combination maximizes access while minimizing detection surface.
See also: Tor Browser Privacy Risks: Incident Response Steps
Choosing the Right Defense Strategy
You must choose your defensive posture based on the attack vector. Choose the first defense when you suspect attackers are targeting legacy systems or using tools that rely on NTLM. Focus on disabling NTLM where possible and monitoring for hash extraction attempts. Choose the second defense when your environment relies heavily on Kerberos and you need to detect ticket theft. Focus on protecting LSASS memory and monitoring for unusual ticket requests.
- Disable NTLM authentication on servers that do not require it.
- Implement Credential Guard to protect LSASS memory from extraction.
- Monitor for the creation of new service tickets from unexpected hosts.
- Restrict local administrator rights to reduce the initial attack surface.
Advanced Detection and Mitigation
Effective detection requires understanding the normal baseline of your environment. Look for authentication events that originate from unusual locations or times. In pass-the-hash scenarios, you will see NTLM authentication attempts from a single source to multiple targets. In pass-the-ticket scenarios, you may see a surge in TGS-REP events without corresponding TGT requests. Integrate these signals into your SOC playbooks for rapid response.
Consider IOC enrichment to correlate these events with known threat indicators. While threat actor profiling helps predict behavior, real-time monitoring catches the action. Remember that defense evasion techniques often accompany these attacks to hide their tracks. Understanding island hopping attacks can help you visualize how these credentials move across segmented networks.
Key takeaways
- Resetting passwords stops pass-the-hash but often fails against pass-the-ticket attacks.
- Pass-the-hash requires direct access to the authentication database or memory.
- Pass-the-ticket can move laterally without triggering standard authentication logs on the domain controller.
These attacks bypass password security by stealing cryptographic proofs, making traditional password resets ineffective against active sessions. Implement memory protection and disable legacy protocols to reduce the risk of credential theft.
Frequently asked questions
Does changing a password stop a pass-the-hash attack?
Changing the password generates a new hash, which invalidates the old one for future authentications. However, if the attacker has already accessed systems using the old hash, those sessions may remain active until they expire or are terminated.
Can pass-the-ticket work across different domains?
It can work across trusted domains if the attacker obtains a ticket for a user with cross-domain privileges. The trust relationship allows the ticket to be validated by the target domain’s Key Distribution Center.
What is the main difference in detection between the two?
Pass-the-hash generates clear NTLM authentication logs on the target server. Pass-the-ticket may not generate authentication logs on the domain controller, as the ticket validation happens at the service level or through existing ticket caches.
Are these attacks limited to Windows environments?
These specific techniques are native to Windows authentication protocols. However, similar concepts of credential theft and replay exist in other systems, such as Unix shadow files or Linux Kerberos implementations.
How this guide was produced: written by the BlueTeam Insider editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
