How Pass-the-Hash and Kerberoasting Let Attackers Hijack Networks Without Passwords

Two well-established attack techniques, Pass-the-Hash and Kerberoasting, remain among the first methods real-world attackers use to compromise corporate networks. Pass-the-Hash exploits NTLM authentication by reusing a captured credential hash, eliminating the need for brute-force password cracking. Kerberoasting targets Active Directory service accounts by extracting Kerberos service tickets and cracking them offline, taking advantage of weak passwords often left on forgotten service accounts. A red-team exercise at a financial firm in 2023 demonstrated how these techniques can be chained together, starting with a phishing email and escalating to full lateral movement across the network. Security teams are urged to treat these techniques as high-priority threats, as both can bypass common defenses when misconfigured accounts and weak passwords are present.