lateral-movement

Lateral Movement Methodology

⛔ In-Depth Reference (Required Reading)

• Need credential extraction and dumping methods → references/credential-extraction.md
• Need remote execution technique comparison and selection → references/remote-execution-comparison.md
• Need PTH/PTT/PTK pass-the-attack techniques → references/pass-techniques.md
• Need specific commands for WinRM/PSExec/WMI/DCOM/RDP/PTT techniques → references/movement-techniques.md

---

Phase 1: Target Discovery

arp -a                              # 已通信的主机
naabu -host 10.0.0.0/24 -p 22,80,135,445,3389,5985 -silent

Target	Value
Domain Controller	Extremely High (controls the entire domain)
Database/File/Backup Servers	High (sensitive data)
Jump Host	Medium (connects to more network segments)

Phase 2: Technique Selection Decision Tree

凭据类型 + 目标 OS？
├─ Linux
│   └─ SSH 密码/密钥（chmod 600!）
├─ Windows + 明文密码
│   └─ WinRM > WMI > PSExec（按隐蔽性）
├─ Windows + NTLM 哈希
│   └─ PTH via WinRM/WMI/PSExec
├─ Kerberos 票据
│   └─ PTT（mimikatz kerberos::ptt）
├─ 跨网段
│   └─ SSH 隧道/SOCKS 代理
└─ 需要图形界面
    └─ RDP
详细命令 → [references/movement-techniques.md](references/movement-techniques.md)

Phase 3: Post-Movement Operations

1. Confirm privileges — whoami /all or id
2. Repeat the post-exploitation process
3. Collect new credentials — may discover higher-privilege credentials
4. Assess the next target

Precautions

• PSExec creates a service → has obvious logs, prefer WMI/WinRM
• PTH is only effective for NTLM authentication (does not work in Kerberos-only environments)
• Multiple failures may trigger alerts; control the attempt frequency

SSH key authentication lateral movement

• Log in directly after discovering SSH keys/private keys (id_rsa)
• Note file permissions: if permissions are too loose (such as 0644 / too open), SSH will refuse
• SSH security requirement: private key file permissions must be 600