In a pass-the-hash scenario, what credential is used to authenticate without providing plaintext passwords?

• A. Reuse credentials from another user
• B. Use the NT hash to authenticate
• C. Log in with plaintext password
• D. Crack passwords offline using the plaintext password

Answer: (B)

In a pass-the-hash scenario, authentication is performed using the NT hash rather than a plaintext password. The NT hash is Windows’ password-derived credential used in NTLM authentication. If an attacker obtains this hash, they can present it to a remote service to prove knowledge of the password without ever sending or revealing the plaintext. This enables access and potential lateral movement with the same rights as the original user, provided the hash corresponds to an account with those privileges. The other options don’t fit because they either involve using plaintext credentials, reusing someone else’s credentials in a non-hash form, or offline cracking, none of which describe the credentials used in pass-the-hash.