The Internet Storm Center features a well-written awareness document for PtH attacks. Microsoft also has a centralized high-level resource that shares awareness & mitigating controls for this popular hacking attack to gain unauthorized access into vulnerable systems.

https://isc.sans.edu/forums/diary/Pass+the+hash/19479/

http://www.microsoft.com/pth

Passing the hash is a form of login credential theft that is quite prevalent. In it, an attacker captures the encoded session password (the “hash”) from one computer, and then re-uses it to illicitly access another computer. On (most configurations of) the Microsoft Windows operating system, this “hash” can be used as an equivalent stand-in for the original password, hence if an attacker obtains the “hash” of a privileged account, this has the exact same immediate consequences as when the attacker had gotten his hands on the password of same account.

One pre-requisite for PtH to work is that the attacker must obtain local administrator privileges on at least one computer in your organization. So, if you are still generously letting your users work and surf the web as “admin”, here’s one more reason to stop that. Another particularity of PtH is that whenever a higher privileged administrator logs on to a lower privileged device, he/she creates a privilege escalation opportunity for whoever controls that lower device. If you have some type of admin privileges in your windows AD domain, think about when you “RDP” into other devices to “check something out” or “fix something”. Doing so places your “hash” onto that device, and the hash can be harvested by someone with admin rights on that device, and re-used to impersonate you for as long as you do not change your associated password.

Sounds bad? Yup. Potentially, it is. Because what seems to be happening quite frequently is that attackers breach one single user workstation (through malware in drive-by web or email based attacks). Then, the attackers try to get admin privileges on that workstation. If the user already has local admin privs, they won, if not, they need to find some local exploit (missing patch, weak password, etc).  Once they ARE local admin, they extract all “hashes” that they can find locally on that workstation. With a bit of luck, some IT Helpdesk person who has admin privileges across ALL workstations in the firm had recently connected to that particular PC, and “left the hash” behind. Thus, the attacker ends up with admin privs across all workstations. Next step, find the workstation of a server or domain administrator, and hope to locate an even more privileged hash on there. If found: game over.  All of this can be and has been automated, and can happen in a matter of minutes.