Pass-the-hash attack: How the attack works and how to stop it