Pass-the-Hash vs Pass-the-Ticket: Sec+ Guide

Pass-the-Hash (PtH) exploits NTLM by using a captured password hash to authenticate without needing the plaintext password. Pass-the-Ticket (PtT) targets Kerberos by stealing Ticket Granting Tickets (TGTs) or Service Tickets (TGS). While PtH targets the NTLM protocol, PtT exploits the ticket-based architecture of Kerberos.

What exactly is a Pass-the-Hash (PtH) attack?

In a Pass-the-Hash attack, the adversary doesn't bother trying to crack your password. Instead, they steal the NTLM (New Technology LAN Manager) hash—the mathematical representation of your password stored in memory or the SAM database. Because the NTLM protocol uses this hash for authentication, the attacker can simply 'pass' that hash to a remote server to prove their identity.

Imagine it like a valet key. The attacker doesn't need the master key to the house; they just need the specific token that the system accepts as proof of access. For the SY0-701 exam, you need to recognize that PtH is fundamentally about NTLM hash reuse. If you see a scenario involving the LSASS process or the SAM database being dumped to steal credentials, you're likely looking at a PtH setup.

How does Pass-the-Ticket (PtT) differ from PtH?

While PtH is about hashes, Pass-the-Ticket is all about Kerberos. In a Kerberos environment, users don't send hashes every time they want to access a resource; they use tickets. The most critical of these is the Ticket Granting Ticket (TGT). In a PtT attack, the adversary steals a valid TGT or a Service Ticket (TGS) directly from the system memory.

Once the attacker has that ticket, they can impersonate the user to access network resources without ever knowing the user's password or even their hash. It's a more sophisticated move than PtH because it leverages the trusted third-party nature of the Key Distribution Center (KDC). When studying with our 1,000 expert-curated practice questions, pay close attention to the terminology: 'tickets' always point you toward Kerberos, while 'hashes' point you toward NTLM.

Which authentication protocols are being targeted here?

This is where many students get tripped up on the exam. You must associate the attack with the protocol. Pass-the-Hash targets NTLM, which is a challenge-response protocol. It's older and lacks the robust security of modern standards, making it a prime target for lateral movement within a Windows domain.

Pass-the-Ticket targets Kerberos, the default authentication protocol for modern Active Directory environments. Kerberos is designed to be more secure by using a centralized KDC, but it introduces the risk of ticket theft. If you're using our custom quiz builder to filter by the 'Threats and Attacks' domain, make sure you can instantly distinguish between these two. If the question mentions a 'TGT' or 'TGS,' stop thinking about hashes and start thinking about Kerberos tickets.

Why are these attacks so dangerous for lateral movement?

Both PtH and PtT are the bread and butter of lateral movement. An attacker typically enters a network through a low-privilege workstation. By using tools like Mimikatz to scrape memory, they find a hash or ticket belonging to a Domain Administrator who previously logged into that machine. Suddenly, the attacker has 'god-mode' access to the entire forest.

In the case of PtT, this can escalate to 'Golden Ticket' attacks, where the attacker steals the KRBTGT account hash to forge their own TGTs with any permissions they want, essentially granting them permanent access. We include detailed expert reasoning for every answer in our platform to help you understand not just *that* this happens, but *why* it's the preferred method for advanced persistent threats (APTs).

How do you mitigate these credential theft techniques?

The gold standard for stopping these attacks is Windows Defender Credential Guard. It uses virtualization-based security (VBS) to isolate the LSASS process in a protected container, meaning even a user with local admin rights can't easily scrape hashes or tickets from memory. It effectively puts a wall between the attacker and the credentials.

Beyond Credential Guard, you should implement LAPS (Local Administrator Password Solution) to ensure every workstation has a unique local admin password, preventing a single PtH attack from compromising every machine on the subnet. We recommend tracking your performance analytics on these mitigation topics; if your score is low in the 'Implementation' domain, spend more time reviewing how VBS protects the kernel.

How should you approach these questions on the SY0-701 exam?

When you encounter these on the exam, look for the 'trigger words.' If the scenario mentions 'NTLM,' 'SAM,' or 'Hash,' your mind should immediately go to Pass-the-Hash. If it mentions 'KDC,' 'TGT,' 'TGS,' or 'Tickets,' it's Pass-the-Ticket. Don't let the technical jargon distract you from the core mechanism: both are about using a stolen credential 'token' to bypass the need for a plaintext password.

Practice is the only way to make this instinctual. We suggest building a custom quiz in Cert Sensei focusing specifically on 'Identity and Access Management' and 'Attacks.' By drilling these differences across hundreds of scenarios, you'll stop second-guessing yourself and start spotting the correct answer in seconds.

❓ Frequently Asked Questions