Credential-Based Lateral Movement

Pass-the-hash over SMB uses a stolen NTLM password hash to authenticate to a remote SMB service without recovering or supplying the cleartext password. With sufficient administrative and remote service-control rights, the authenticated account can execute a command on the target. The example below shows share enumeration as optional context and two alternative service-based execution methods; it does not describe WMI, WinRM, or plaintext-password authentication.