Passing the Hash

The passing-the-hash package provides modified versions of common network tools that support authentication using NTLM password hashes rather than requiring plaintext passwords. This enables post-exploitation scenarios where an attacker has obtained password hashes from a compromised system but lacks the actual passwords.

Tools are installed as executables starting with the 'pth-' prefix, such as pth-curl, pth-smbclient, pth-winexe, and pth-wmic. These patched binaries integrate hash-based authentication into protocols like SMB, HTTP, WMI, and RPC, facilitating lateral movement and remote administration without password cracking.

Use cases include authenticating to Windows shares, executing remote commands, querying WMI, and interacting with Samba services using stolen NTLM hashes. The package depends on various libraries including libc6, libgnutls30t64, samba-common-bin, and smbclient.

The tools are patched versions of standard utilities (Curl, Samba tools, Winexe, WMI client) that accept NTLM password hashes via specific credential options like --pw-nt-hash. Instead of transmitting plaintext passwords over the network, they perform pass-the-hash authentication by using the hash directly in the NTLM challenge-response protocol. This leverages Windows authentication mechanisms where valid NTLM hashes can authenticate without knowledge of the original password. Binaries are prefixed with 'pth-' to distinguish them from standard tools.