6.4.1 Select a compatible remote-access mechanism
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
Typed credential material, exact local/domain account scope, a scoped target and a known source/vantage point.
Where to look: First check the service route. Then separate authentication from the target service's authorization. Match password, NT hash, AES key, ticket or certificate to a client that supports that mechanism.
Expected behavior / secure boundary: A valid account can lack every remote-logon right on a given host. SMB service control, WinRM, WMI/DCOM and RDP have different services, ports and policy requirements. One protocol's success cannot be generalized to another.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.4.1.1 Baseline preflight from Kali
Run: Kali / Linux. Requires: Explicit scoped destination and the actual initiating route. Effect: Network probing/service identification; no authentication or execution proof.
nmap -Pn -sT -sV -p 135,139,445,3389,5985,5986 TARGET -oN movement-preflight.txt
getent hosts TARGET_HOST
date -u
6.4.1.2 Preflight using Windows PowerShell
Run: Windows PowerShell. Requires: Actual initiating host, DNS and selected TCP connectivity. Effect: Reads resolver/time state and makes selected connection checks.
Resolve-DnsName TARGET_HOST
Test-NetConnection TARGET_HOST -Port 445
Test-NetConnection TARGET_HOST -Port 5985
Test-NetConnection TARGET_HOST -Port 3389
w32tm /query /status
What this checks: Preflight checks transport from the host that will initiate the actual connection. RPC endpoint mapper reachability alone does not prove dynamic RPC will work. A tunnel must carry the selected protocol and name resolution.
6.4.1.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Source: Kali via SOCKS
TARGET: TCP/445 reachable; TCP/5985 refused
Credential: domain NT hash
SMB authentication: succeeds; administrative rights unverified
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| 445 reachable | A transport route to SMB. | Validate supported NTLM authentication and required share/service-control rights. | §6.4.3.1 — Execute using SMB or WMI mechanisms |
| 5985 refused | No usable WinRM listener was reached at that endpoint. | Do not repeat WinRM password guesses to solve a listener problem. | §6.4.2.1 — Access using WinRM or RDP |
| NT hash | A potential NTLM input. | Choose a client supporting it; ordinary password-only RDP is not equivalent. | §6.3.2.1 — Classify recovered credentials and their scope |
Stop when: Material type, route and one endpoint-specific authorization hypothesis are matched.
Revisit only when: A new identity, listener, route or endpoint permission changes the match.
6.4.1.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | SMB connectivity, compatible authentication and the selected service-control execution rights are verified: use the SMB mechanism section. | §6.4.3.1 — Execute using SMB or WMI mechanisms |
| Ruled out in this context | The method requires rights or a transport you lack: choose a supported alternative. | §6.2.2.1 — Enumerate shares, SYSVOL and NETLOGON |
| Inconclusive / failed check | Authentication succeeds but action is denied: preserve the valid account and investigate authorization. | §6.5.1.1 — Diagnose the failed boundary |
6.4.1.5 Tooling and complete procedure
nc/Test-NetConnection checks are transport baselines. NetExec can validate selected protocols; Evil-WinRM, Impacket, WinRS and FreeRDP are access-specific choices, not interchangeable fallbacks. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.