Lateral Movement and Pivoting
What this domain tests
Lateral Movement and Pivoting tests moving from one compromised host to another and reaching segmented networks. You must choose a transport that matches the credential type and the target defenses.
Core rules and concepts
- Pass-the-hash works over SMB and WMI but not RDP. Overpass-the-hash converts an NT hash into a Kerberos ticket. Pass-the-ticket needs a valid TGT or TGS.
- WinRM requires membership in Remote Management Users or local admin.
- Pivoting tools include ligolo-ng, Chisel, and SSH SOCKS proxies; plan routes to the domain controller and target subnets.
- SMB signing, NTLM restrictions, and firewall rules determine which technique is viable.
Worked example
After secretsdump on WS01, you have a local admin NT hash. impacket-psexec -hashes :NTHASH domain/[email protected] fails because SMB signing is required. Switch to WinRM with evil-winrm -i 10.10.10.20 -u admin -H NTHASH. Reasoning: protocol choice follows the control, not preference. If WinRM is closed, try WMI or create a service with impacket-smbexec only after confirming the service control manager is reachable.
Traps that cost marks
- Assuming local admin on every host because one host allowed access.
- Ignoring SMB signing and NTLM restrictions before choosing a technique.
- Pivoting without a route to the DC or the next subnet.
- Leaving services, binaries, or scheduled tasks behind on a host.
- Using RDP for pass-the-hash; it requires a password or ticket.