How can an adversary use a hash that was stolen from a Windows account to compromise a Linux server?

SSH authentication relies on passwords or public-key cryptography and does not use NTLM hashes, making a stolen Windows hash unusable for SSH authentication.

Direct Linux console or PAM-based login does not use NTLM hashes for credential verification, so a Windows account hash cannot be leveraged for this access method.

Becoming a man-in-the-middle requires network positioning to intercept live traffic and does not directly leverage a pre-stolen hash to gain unauthorized access to server resources.

SAMBA implements the SMB/CIFS protocol on Linux and supports NTLM authentication, which uses the same hash format as Windows account credentials. In a pass-the-hash attack, the adversary supplies the stolen NTLM hash directly in response to the authentication challenge without ever needing the plaintext password. Because SAMBA accepts this NTLM hash as valid proof of identity, the attacker gains access to shared resources on the Linux server using only the stolen credential material.