> For the complete documentation index, see [llms.txt](https://contrxl.gitbook.io/contrxl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://contrxl.gitbook.io/contrxl/hacking/network-based-vulnerabilities/pass-the-hash.md).

# Pass-the-Hash

Windows stores passwords as hashes in the Security Accounts Manager (SAM) file. Microsoft use  a suite of protocols for authentication called New Technology Local Area Network Manager (NTLM), there are two versions: NTLMv1 and NTLMv2. NTLM is mostly replaced now, but may still be used when a client authenticates to a server via IP or to a server in a different AD forest.

If an attacker can compromise the SAM, they can just send the hash directly from a compromised system to login, rather than trying to figure out what the password is.