Recover or reuse an NT password hash

Needs: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights

Offline recovery

# Offline recovery
hashcat -a 0 -m 1000 nt.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
john --format=NT --wordlist=wordlist.txt nt.hash

# Compatible SMB validation
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH --shares
smbclient //TARGET/SHARE -U 'DOMAIN\USER' --pw-nt-hash NT_HASH

# Variant — remote access/execution when the identity has matching rights
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /pth:NT_HASH /cert:ignore

Verify → Verify source/type, identity context and the exact permitted service action.

If it fails → Local/domain confusion, remote UAC and denied NTLM are different from an invalid hash. Use tickets only when their own prerequisites exist. More detail ↓

If → then

A password, actual NT hash, AES/NT long-term key or ticket is available → Select password, NT hash, key-to-ticket or ticket authentication
Needs: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
A destination grants administrative-share write and service-control rights → Execute through uploaded service creation using PsExec
Needs: SMB/SCM reachability, writable required share, effective service-creation/start rights and an accepted password/hash or supported Kerberos context

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Recover or reuse an NT password hash

USE WHEN: An NT verifier from an appropriate credential source
STARTING ACCESS: A credential artifact with a recorded source and possible account context
RESULT: A recovered password or a verified hash-backed authentication capability

Recognize the clue

Inspect the output schema of a justified local/domain credential source, keeping RID, machine and domain labels.

head -n 3 hashes.txt

SYNTHETIC EXAMPLE OUTPUT

USER:RID:LM_HASH:NT_HASH:::
Source: matched local registry extraction

Means: The source and record fields identify an NT verifier for that local account, not a captured challenge response.

Confirm: Verify the actual NT field, account scope and an accepting service/client with the required destination right.

After validation: A compatible service accepts the correctly qualified hash identity: use only its verified authorization.
Ruled out in this context: The source produced Net-NTLMv2 or DCC2 instead: reject direct NT-hash reuse.
Still inconclusive: An unlabeled hexadecimal value remains unknown until the source/account is resolved.

Troubleshooting: Local/domain confusion, remote UAC and denied NTLM are different from an invalid hash. Use tickets only when their own prerequisites exist.

Additional prerequisite checks

hashcat -m 1000 hashes.txt WORDLIST
nxc smb TARGET -d DOMAIN -u USER -H HASH

Offline recovery:

Compatible SMB validation:

NT hashes come from a producing context such as SAM, LSASS or NTDS. A visually similar 32-hex application digest is not PtH material.

Variant — remote access/execution when the identity has matching rights

WMI needs administrative rights plus DCOM/RPC/SMB reachability and normally runs as the authenticated user. PsExec-style execution needs service-control and writable-share rights and commonly yields SYSTEM. RDP hash authentication depends on target/client support and policy. Detailed method selection belongs to the lateral-movement procedure.

Why it works

Pass-the-Hash uses a long-term NT key in an NTLM exchange; it does not convert every captured hash-like value into a reusable password equivalent.

Worked example · hypothetical

Observation: a matched SAM/SYSTEM extraction yields a local NT hash. Test: qualify the target-local identity for one reachable service. Illustrative output: authentication succeeds but execution is denied. Interpretation: record valid authentication and investigate effective rights.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗