7 thoughts on “I Have the Password Hashes! Can I Pass Them?

    • Yeah, ha, it’s how the OS itself interacts with other Windows systems. Now, you can’t just open a RDP connection to another machine, and type the hash, but you can use hashes you have to psexec into other machines without a problem.Wikipedia actually has a decent writeup on how it works. But if you use psexec, or any of the other tools I showed to interact with a Windows machine, you can log right in with the hash because Windows is basically interpreting the hash as the password.

    • Nope. You can change how Windows is configured to prevent this, but you’ll basically break windows. Best defense – don’t let people get hashes and make sure all local accounts have different passwords in relation to other computers on the network.

Leave a Reply