CoreQ Academy5.2 Given a scenario, perform tasks to move laterally throughout the environment.
Lateral movement shows how far one compromise can spread. Every hop a tester makes is a segmentation or credential-hygiene finding for the client.
Techniques
- Pivoting
- Using a compromised host to reach networks that were not directly reachable.
- Relay creation
- Setting up forwarding (port forwards, SOCKS proxies) through compromised hosts.
- Enumeration
- Discovering more targets from inside.
- Service discovery
- Finding reachable services from the new foothold.
- Network traffic discovery
- Observing traffic to learn hosts and protocols.
- Additional credential capture
- Collecting more credentials from the new host.
- Credential dumping
- Extracting stored credentials or hashes.
- String searches
- Searching files for passwords, keys and connection strings.
- Window Management Instrumentation (WMI)
- Windows management interface that can execute commands remotely.
- Window Remote Management (WinRM)
- Remote PowerShell management over HTTP(S).
Services to move through
- Server Message Block (SMB)/fileshares
- File sharing and remote execution path in Windows networks.
- Remote Desktop Protocol (RDP)/Virtual Network Computing (VNC)
- Remote desktop access.
- Secure Shell (SSH)
- Remote shell, especially on Linux; stolen keys enable movement.
- Cleartext
- Unencrypted protocols that expose credentials on the wire.
- LDAP
- Directory queries revealing users, groups and computers.
- Remote Procedure Call (RPC)
- Windows remote management calls.
- File Transfer Protocol (FTP)
- Often cleartext; may hold credentials or sensitive files.
- Telnet
- Cleartext remote shell still found on network gear.
- Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)
- Internal web apps and admin consoles.
- Web interfaces
- Management pages of devices and applications, often with default credentials.
- Line Printer Daemon (LPD)
- Printing protocol; printers are often overlooked footholds.
- JetDirect
- Raw printing on TCP 9100; can expose printer functions.
- RPC/Distributed Component Object Model (DCOM)
- Windows component model that can execute code remotely.
- Process IDs
- Identifying processes to target, impersonate or migrate into.
Living-off-the-land and tools
- LOLBins
- Built-in binaries used to move quietly.
- Netstat
- Shows connections and listening ports.
- Net commands
- Windows net user/group/view/use for enumeration and share access.
- cmd.exe
- Windows command interpreter.
- explorer.exe
- Windows shell process, sometimes used to launch or hide actions.
- ftp.exe
- Built-in FTP client that can transfer files.
- mmc.exe
- Management console that can connect to remote computers.
- rundll32
- Runs DLL functions; abused to execute code.
- msbuild
- Build tool that can compile and run inline code.
- route
- Views or changes routing tables to reach new networks.
- strings/findstr.exe
- Extract text or search files for secrets.
- Covenant
- .NET command-and-control framework.
- CrackMapExec
- Moves across Windows hosts with valid credentials.
- Impacket
- Remote execution scripts (psexec, wmiexec, smbexec).
- Netcat
- Simple relays and transfers.
- sshuttle
- VPN-like pivoting over SSH.
- Proxychains
- Forces tools through SOCKS proxies for pivoting.
- PowerShell ISE
- PowerShell editor used for scripting on compromised hosts.
- Batch files
- Windows scripts automating commands.
- Metasploit
- Pivoting and post-exploitation modules.
- PsExec
- Remote execution over SMB.
- Mimikatz
- Credential extraction enabling further movement.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 5.2 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.