Match route, destination service and effective authorization

Needs: Real source-to-service route, correct identity context and protocol-specific execution/logon rights

Directly routed source

Material Compatible starting paths Important boundary
Password SMB/SCM, WMI/DCOM, WinRM/WinRS, RDP Correct password does not grant the required logon or execution right
NT hash NTLM-capable SMB/WMI/WinRM; RDP only through Restricted Admin where supported Net-NTLM and DCC2 are not reusable NT hashes
TGT/ccache Kerberos-capable tool using target FQDN/SPN Ticket identity, realm, lifetime, DNS and KDC route must match
TGS Only the named SERVICE/HOST and compatible client A CIFS ticket does not authorize WinRM, WMI or RDP
AES/NT long-term key Request a TGT, then use Kerberos RC4/NT-key requests can fail where RC4 is disabled
Local-account password/hash NTLM or RDP in the target's local account context Remote UAC/account restrictions commonly filter non-RID-500 local administrators

Reachable service Common execution/access mechanisms Usual authorization
SMB 445 + SCM/RPC PsExec, SMBExec, service creation Administrative share plus SCM/service rights
RPC endpoint mapper 135 + dynamic RPC; often SMB for output WMIExec, native CIM/WMI, DCOM Remote WMI/DCOM rights, commonly an effective administrator token
Task Scheduler RPC plus SMB output ATExec Remote task creation and administrative output access
WinRM 5985/5986 WinRS, PowerShell remoting, Evil-WinRM Enabled endpoint and endpoint/session authorization
RDP 3389 FreeRDP, MSTSC Remote-interactive logon right; Restricted Admin requires administrator access

# Directly routed source
nmap -Pn -sT -sV -p 135,139,445,3389,5985,5986 TARGET -oN movement-preflight.txt
getent hosts TARGET_HOST
date -u

Windows source

# Windows source
Resolve-DnsName TARGET_HOST
Test-NetConnection TARGET_HOST -Port 445
Test-NetConnection TARGET_HOST -Port 5985
Test-NetConnection TARGET_HOST -Port 3389
w32tm /query /status

Record

Port 135 alone does not prove WMI/DCOM viability because RPC commonly negotiates a dynamic high port. When the destination is reachable only through a pivot, perform these checks through the established Block 13 route and respect the client/proxy's transport limits.

# Record
SOURCE POSITION -> TARGET FQDN/IP -> ROUTE -> SERVICE/PORT
-> CREDENTIAL TYPE -> LOCAL/DOMAIN IDENTITY -> EXPECTED RIGHT
-> CHOSEN METHOD -> EXPECTED EFFECT

NetExec can classify a selected SMB credential

# NetExec can classify a selected SMB credential
# Domain password
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'

# Domain NT hash
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH

# Target-local account
nxc smb TARGET -u Administrator -H NT_HASH --local-auth

# Prove only share access
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

# For one justified execution proof
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' -x "hostname & whoami" --exec-method wmiexec

Client commands / example output

Current NetExec can select wmiexec, atexec or smbexec; without an explicit method it may fail over between them. Use a forced method when diagnosing prerequisites so the result remains attributable.

# Baseline
DOMAIN\USER  -> domain identity; evaluate target-local group/right
TARGET\USER  -> SAM identity on that target
./USER        -> tool-specific local-account selection

Remote process creation, stdout retrieval and an interactive shell are separate states

Do not “fix” this by changing LocalAccountTokenFilterPolicy during an attack workflow. Use a method already permitted by the target's configuration, the built-in Administrator where legitimately obtained and applicable, RDP if authorized, or another mapped identity.

# Remote process creation, stdout retrieval and an interactive shell are separate states
AUTHENTICATED
-> REMOTE OPERATION AUTHORIZED
-> PROCESS/TASK/SERVICE CREATED
-> COMMAND EFFECT OCCURRED
-> OUTPUT RETURNED OR CALLBACK CONNECTED
-> USABLE SESSION

Windows commands

PsExec returns named-pipe I/O through its service.

WMIExec normally redirects output to an SMB share.

SMBExec redirects command output while repeatedly creating services.

ATExec writes output under ADMIN$\Temp.

Native WMI/DCOM may return only a PID/return value; verify a harmless file or another bounded effect.

WMI/DCOM/service processes commonly run in session 0, so a GUI is not visible to the logged-on user.

WinRM creates a remote shell/runspace and returns structured or text output.

REM Baseline
hostname
whoami /all
ipconfig /all
route print
netstat -ano
klist

local privilege and accessible credential sources;

domain groups, ACLs, shares and host rights under the new identity;

logged-on sessions and service accounts;

interfaces, routes, DNS, listeners and internal reachability;

the next evidence-backed host/identity transition.

Do not overwrite the earlier state. Record the source host, credential form, authentication protocol, execution method, returned identity and side effects.

Verify → Record exact source, credential type, destination name/service and successfully permitted operation.

If it fails → Do not infer every service works from an administrative SMB indicator. Separate authentication, route, execution and output-channel failures. More detail ↓

If → then

A destination grants administrative-share write and service-control rights → Execute through uploaded service creation using PsExec
Needs: SMB/SCM reachability, writable required share, effective service-creation/start rights and an accepted password/hash or supported Kerberos context
A destination exposes WMI/DCOM and the identity has useful namespace/process rights → Execute through WMI or native CIM over DCOM
Needs: RPC endpoint mapper plus negotiated dynamic ports; effective WMI/DCOM rights; the selected output path may additionally need SMB
A WinRM listener and a candidate endpoint-authorized account → Use WinRM, WinRS or PowerShell remoting
Needs: Reachable HTTP(S) listener, accepted authentication and endpoint/session configuration permissions; hash/ticket support depends on client/context
RDP is reachable and the identity may have remote-interactive logon rights → Obtain an authorized RDP interactive session
Needs: Allowed account/session policy and compatible client/NLA/TLS; hash-based Restricted Admin has additional supported-policy/admin requirements
The identity has remote task rights and a compatible output path → Execute through remote Task Scheduler
Needs: Task Scheduler RPC reachability, effective task-creation rights and the required administrative output access
A usable remote COM application and effective activation/method rights → Execute through an authorized DCOM application object
Needs: RPC/dynamic-port route, allowed DCOM activation and application method, supported authentication and target component

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Match route, destination service and effective authorization

USE WHEN: A credential appears valid but the destination's usable access is unknown
STARTING ACCESS: Identified authentication material, destination service reachability and a candidate authorized identity
RESULT: A selected movement method and a decision-changing preflight result

Recognize the clue

Use the discovered destination name/address and known credential record, then inspect the selected service ports from the actual direct or established pivot source.

nmap -Pn -sT -p 135,445,3389,5985,5986 TARGET
getent hosts TARGET_HOST

SYNTHETIC EXAMPLE OUTPUT

445/tcp open microsoft-ds
135/tcp open msrpc
5985/tcp filtered wsman

Means: SMB/RPC are transport candidates while WinRM is not yet reachable; dynamic RPC and authorization are still untested.

Confirm: Probe the destination from the real source. Check DNS/service names and each required SMB/RPC/WinRM endpoint, then test effective service authorization. An open port and an accepted password do not establish a working remote execution method.

After validation: One compatible service accepts the identity and authorized operation: choose that movement mechanism.
Ruled out in this context: The intended protocol is conclusively unavailable from this source: reject that route/service combination.
Still inconclusive: Open 135 does not settle dynamic RPC; an SMB admin indicator does not settle WMI/WinRM/RDP.

Troubleshooting: Do not infer every service works from an administrative SMB indicator. Separate authentication, route, execution and output-channel failures.

Material	Compatible starting paths	Important boundary
Password	SMB/SCM, WMI/DCOM, WinRM/WinRS, RDP	Correct password does not grant the required logon or execution right
NT hash	NTLM-capable SMB/WMI/WinRM; RDP only through Restricted Admin where supported	Net-NTLM and DCC2 are not reusable NT hashes
TGT/ccache	Kerberos-capable tool using target FQDN/SPN	Ticket identity, realm, lifetime, DNS and KDC route must match
TGS	Only the named `SERVICE/HOST` and compatible client	A CIFS ticket does not authorize WinRM, WMI or RDP
AES/NT long-term key	Request a TGT, then use Kerberos	RC4/NT-key requests can fail where RC4 is disabled
Local-account password/hash	NTLM or RDP in the target's local account context	Remote UAC/account restrictions commonly filter non-RID-500 local administrators

Reachable service	Common execution/access mechanisms	Usual authorization
SMB 445 + SCM/RPC	PsExec, SMBExec, service creation	Administrative share plus SCM/service rights
RPC endpoint mapper 135 + dynamic RPC; often SMB for output	WMIExec, native CIM/WMI, DCOM	Remote WMI/DCOM rights, commonly an effective administrator token
Task Scheduler RPC plus SMB output	ATExec	Remote task creation and administrative output access
WinRM 5985/5986	WinRS, PowerShell remoting, Evil-WinRM	Enabled endpoint and endpoint/session authorization
RDP 3389	FreeRDP, MSTSC	Remote-interactive logon right; Restricted Admin requires administrator access

Directly routed source:

Windows source:

Port 135 alone does not prove WMI/DCOM viability because RPC commonly negotiates a dynamic high port. When the destination is reachable only through a pivot, perform these checks through the established Block 13 route and respect the client/proxy's transport limits.

Record:

NetExec can classify a selected SMB credential:

A successful login proves SMB authentication. (Pwn3d!) is NetExec's SMB administrative-context indicator, not proof that WinRM, RDP, WMI or every SMB execution method will succeed.

For one justified execution proof:

Current NetExec can select wmiexec, atexec or smbexec; without an explicit method it may fail over between them. Use a forced method when diagnosing prerequisites so the result remains attributable.

Common failure pattern:

a local account authenticates over SMB;
Windows issues a filtered remote token;
ADMIN$, SCM or WMI administrative operations fail.

Do not “fix” this by changing LocalAccountTokenFilterPolicy during an attack workflow. Use a method already permitted by the target's configuration, the built-in Administrator where legitimately obtained and applicable, RDP if authorized, or another mapped identity.

Remote process creation, stdout retrieval and an interactive shell are separate states:

PsExec returns named-pipe I/O through its service.
WMIExec normally redirects output to an SMB share.
SMBExec redirects command output while repeatedly creating services.
ATExec writes output under ADMIN$\Temp.
Native WMI/DCOM may return only a PID/return value; verify a harmless file or another bounded effect.
WMI/DCOM/service processes commonly run in session 0, so a GUI is not visible to the logged-on user.
WinRM creates a remote shell/runspace and returns structured or text output.

A WinRM/PowerShell session on HOST_A may not possess delegable credentials for HOST_B. That “double hop” is a credential-context problem, not proof that HOST_B or the password is wrong. Prefer executing from the source that actually holds the credential/ticket rather than enabling broad delegation.

Re-enumerate:

local privilege and accessible credential sources;
domain groups, ACLs, shares and host rights under the new identity;
logged-on sessions and service accounts;
interfaces, routes, DNS, listeners and internal reachability;
the next evidence-backed host/identity transition.

Do not overwrite the earlier state. Record the source host, credential form, authentication protocol, execution method, returned identity and side effects.

Why it works

SMB authentication, SCM/WMI rights, WinRM endpoint rights and RDP logon rights are different. Local-account remote filtering and second-hop delegation can change an otherwise valid credential's effect.

Worked example · hypothetical

Observation: a credential authenticates to SMB but WMI fails. Test: check RPC endpoint/dynamic-port reachability and authorization. Illustrative output: TCP/445 works but negotiated RPC is blocked. Interpretation: choose a reachable authorized SMB method or repair the route.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗