TechKnowSurge
TechKnowSurge Catalog Videos Pass-the-Hash/Ticket/Token
VideoSecurityFree

Pass-the-Hash/Ticket/Token

Pass the hash, pass the ticket, and pass the token are credential replay attacks in which an adversary intercepts and reuses an authentication hash, Kerberos ticket, or session token to gain unauthorized access to systems and resources.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Credential replay attacks occur when an adversary captures an authentication credential in transit and reuses it to impersonate a legitimate user, bypassing the need to ever know the actual password. Hashing a password before transmitting it over a network reduces the risk of plaintext exposure, but if the hash itself can be intercepted and replayed, the underlying security goal is defeated. Pass the hash, pass the ticket, and pass the token are three closely related attack techniques built on this same principle, each targeting a different authentication mechanism. Pass the hash is most closely associated with NTLM, the NT LAN Manager protocol used for authentication between Windows clients and servers. An attacker who captures an NTLM hash can replay it directly against a server to gain access without cracking it. Pass the ticket targets Kerberos, the authentication system used in modern Windows domain environments, where a captured ticket-granting ticket or service ticket can be replayed to access network resources. Pass the token extends the concept to session tokens issued by applications and web services, which are used to authorize ongoing access without repeated logins. Unlike pass the hash and pass the ticket, pass the token is not linked to a single protocol vulnerability and can arise from a wide range of insecure application development practices, making it a broader and more variable threat surface.

What you'll learn

What's covered

Pass the Hash/Ticket/Token

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Hash Function
A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Credential Replay Attack
An attack where an adversary intercepts authentication data such as a password hash and retransmits it to a server to gain unauthorized access without knowing the original credentials.
Pass-the-Hash Attack
An attack that captures a hashed password and replays it to authenticate to a server without knowing the plaintext password, commonly associated with NTLM.
NT LAN Manager
NTLM
A legacy Windows authentication protocol that is vulnerable to pass-the-hash attacks because it authenticates users using password hashes rather than plaintext credentials.
Pass-the-Ticket Attack
An attack that steals a Kerberos authentication ticket and replays it to gain unauthorized access to network resources.
Kerberos
A network authentication protocol that uses tickets to allow nodes to prove their identity securely, commonly used in Windows domain environments.
Pass-the-Token Attack
An attack that captures an authentication token issued by an application or service and replays it to gain unauthorized access to protected resources.

Topics

Credential Attacks Pass The Hash Kerberos Authentication Protocols Identity And Access Management Cybersecurity Windows Security

Transcript

Credential replay attacks

We're going to talk about a few different types of attacks: a pass the hash attack, a pass the ticket attack, and a pass the token attack. It's all the same type of concept, so we're going to address it all at once.

There's a problem when we send clear text over a network: any adversary would be able to see that if they can see the packet. One way we can combat this is hashing the password before we send it. Then if the adversary sees it, they're just seeing a hash, they're not seeing the actual password. However, if done wrong, the adversary can still see the hash and still replay the hash, and therefore it's susceptible to a credential replay attack.

There are several variations of this. There's pass the hash, pass the ticket, and pass the token. These are all very similar variations of that credential replay attack.

Pass the hash

Pass the hash is just what I explained right there, where we have a hash and it is used to authenticate to a server. If the adversary picks that up, they can now authenticate to the server by just replaying that hash.

Now, pass the hash can be associated with many different types of replay attacks, but largely it's really associated with NT LAN Manager, NTLM. NTLM is an authentication protocol that's used between Windows machines and the Windows servers for authentication, and it's susceptible to this pass the hash. So generally speaking, when we're talking about pass the hash, what we're really talking about is a vulnerability with NT LAN Manager, an old vulnerability that used to exist.

Pass the ticket

Similarly, there's pass the ticket. The idea behind pass the ticket is that when somebody logs into a system, they get a ticket to access certain resources. When they go to access the other resources on the LAN, what they have is this ticket that grants them access to it. The idea behind pass the ticket is the same concept, where an adversary can take that ticket and then have access to resources within that network.

Similar to pass the hash, where it was associated with a specific vulnerability, so is pass the ticket. Generally it's associated with Kerberos and a vulnerability that existed in Kerberos.

Pass the token

A similar concept is pass the token. A token is something that a computer can get in order to be able to access and utilize certain resources on the network, or a lot of times it's associated with web applications. So rather than doing some sort of authentication every time you access a resource, which could be very time intensive and process intensive, instead they get a token, and that token then gives them permission to get into certain resources. If that gets replayed, then we have a pass the token attack right there — pass the token, because the token is used now to log into these services.

Whereas pass the hash is generally associated with NTLM and pass the ticket is associated with Kerberos, pass the token cannot necessarily be associated with a single vulnerability. It can creep into many circumstances if you do some sort of application programming wrong.

Here's the attack card on pass the hash, pass the ticket and pass the token. In summary, it's really when there's some sort of credentials that are being replayed in the form of a hash, ticket or token.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →