You're not the first to come up with that exploit-

https://en.wikipedia.org/wiki/Pass_the_hash