daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

overview.md (1958B)

      1 ---
      2 title: "Lateral Movement"
      3 section: "Windows"
      4 sectionSlug: "windows-hardening"
      5 sourcePath: "src/windows-hardening/lateral-movement/README.md"
      6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/lateral-movement/README.md"
      7 sha: "188de82beb54e70956b2952367a0af91d26758b8"
      8 isIndex: true
      9 modified: true
     10 license: "CC-BY-NC-4.0"
     11 ---
     12 
     13 # Lateral Movement
     14 
     15 Windows supports several mechanisms that can be used to execute commands on remote systems. The following pages explain common lateral-movement techniques and their prerequisites:
     16 
     17 - [**PsExec**](/hacktricks/windows-hardening/lateral-movement/psexec-and-winexec)
     18 - [**SmbExec**](/hacktricks/windows-hardening/lateral-movement/psexec-and-winexec#impacket-smbexecpy-smbexec)
     19 - [**WmiExec**](/hacktricks/windows-hardening/lateral-movement/wmiexec)
     20 - [**AtExec / SchtasksExec**](/hacktricks/windows-hardening/lateral-movement/atexec)
     21 - [**WinRM**](/hacktricks/windows-hardening/lateral-movement/winrm)
     22 - [**DCOM Exec**](/hacktricks/windows-hardening/lateral-movement/dcomexec)
     23 - [**RDPexec**](/hacktricks/windows-hardening/lateral-movement/rdpexec)
     24 - [**SCMexec**](/hacktricks/windows-hardening/lateral-movement/scmexec)
     25 - **Pass the cookie** (cloud)<sup>[[1]](#references)</sup>
     26 - **Pass the PRT** (cloud)<sup>[[2]](#references)</sup>
     27 - **Pass the Microsoft Entra ID certificate** (cloud)<sup>[[3]](#references)</sup>
     28 
     29 ## References
     30 
     31 - [1] [HackTricks Cloud - Pass the cookie](https://cloud.hacktricks.wiki/en/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.html)
     32 - [2] [HackTricks Cloud - Pass the PRT](https://cloud.hacktricks.wiki/en/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/pass-the-prt.html)
     33 - [3] [HackTricks Cloud - Pass the certificate](https://cloud.hacktricks.wiki/en/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.html)