Pass-the-Hash and Kerberoasting: How Attackers Exploit Active Directory Weaknesses

Two common Active Directory attack techniques — Pass-the-Hash and Kerberoasting — allow attackers to compromise Windows networks without ever knowing a user's plaintext password. In Pass-the-Hash attacks, an adversary steals the NT hash of a logged-in user from system memory (via the LSASS process) and uses it directly to authenticate on other networked machines. Kerberoasting requires only a low-privileged domain account: the attacker requests a Kerberos service ticket encrypted with a service account's password, then cracks it offline. While Pass-the-Hash typically demands local administrator rights, Kerberoasting is accessible to any compromised domain user, making it particularly dangerous in environments with weak service account passwords. Security experts emphasize that understanding these techniques is essential for hardening network infrastructure against real-world intrusions.