Other answers are good, but no one mentioned *nix equivalent of PTH. Admittedly it's not exactly the same, but from an attacker's perspective it can be used wit

Other answers are good, but no one mentioned *nix equivalent of PTH. Admittedly it's not exactly the same, but from an attacker's perspective it can be used with similar effect. This equivalent (which works on Windows as well, btw!) is pass-the-password. There are two requirements for this to work, both much more common in the wild then hip HN DevOps crowd would like you to believe: 1. root or other privileged accounts share the same password across the internal infrastructure and SSH is configured to allow password authentication for root (that's not the default, but it's usually enabled when admins believe that the network access is sufficiently restricted anyway) 2. requirement for admins to normally login as an unprivileged user and gain superuser rights when necessary through su or sudo (for auditing purposes) The attacker gains superuser access on one system, then tricks admin to log in and gain root privileges, disclosing their password during that process (by swapping binaries, process injection, reading memory, rootkits, etc).