What is pass-the-hash?
Pass-the-hash is a replay attack that defeats a protection people assume is safe. Windows networks have historically authenticated with NTLM, where the client proves it knows the password by using the password's hash rather than sending the password itself. The catch is that the hash is a password equivalent: anyone who holds it can authenticate as that user without ever cracking it.
How it works
An attacker who gains administrative control of one machine pulls cached credential hashes from memory, often with a tool such as Mimikatz, and then presents a stolen hash to other systems to log in as that user. There is no guessing and no plaintext; the hash is simply replayed. Related variants pass or forge Kerberos tickets instead of NTLM hashes, under names such as pass-the-ticket.
Why it matters
Pass-the-hash is a primary technique for lateral movement. An attacker compromises one host, harvests the hashes of every account that logged on there, and reuses them to reach the next machine where those accounts have access. If a domain administrator ever signed in to a compromised workstation, their hash may be sitting in memory, and a single theft can escalate toward control of the whole domain.
How to defend against it
You do not need to administer the defenses for the exam, but recognize them. Limit where privileged accounts log in, so their hashes are not left on ordinary workstations; this is often arranged as tiered administration. Isolate credentials in memory with features such as Credential Guard. Disable legacy NTLM in favor of Kerberos where possible. Enforce least privilege and unique local administrator passwords, for example with LAPS, so one stolen hash reaches little. Monitoring for one account authenticating across many hosts in a short time helps catch the lateral movement.
Pass-the-hash vs. cracking a password
Cracking takes a stolen hash offline and computes the plaintext password, limited by how the hash was stored. Pass-the-hash skips that step entirely: it uses the hash directly as the credential. If a scenario says the attacker authenticated with a captured hash and never recovered the password, it is pass-the-hash, not cracking.
Pass-the-hash on the CompTIA Security+ exam
Pass-the-hash appears under objective 2.5 as an indicator of malicious activity. Scenario wording about reusing an NTLM hash, Mimikatz dumping credentials from memory, or an attacker moving between hosts without ever knowing the password points at it. The distractors are offline password cracking and a brute-force attack. The exam wants you to connect it to lateral movement and to defenses such as limiting privileged logons, Credential Guard and least privilege.