Windows Lateral Movement
Gaining access to a client workstation
or a server is only the first step in a typical penetration test.
Once we gain initial access,
our goal is to compromise more of the organization’s assets,
either to obtain more privileged access,
or gain access to confidential information.
The course of action is dictated by the goals of the test.
We’ll often use lateral movement techniques
to compromise additional machines inside the target network.
For example, we may continue a phishing campaign from a compromised client
in an attempt to send email from an internal account
that is not subject to the external security checks
and may be more trusted.
Another approach may be to locate
and exploit vulnerable software on internal servers
since they may be patched less-often
than servers directly exposed to the Internet.
We may even be able to reuse stolen credentials
to obtain access to additional systems.
Although there are many lateral movement techniques
we could leverage against a Windows infrastructure,
most rely on NTLM hash or Kerberos ticket reuse.
The most valuable techniques work equally well
against both workstations and servers.
In this module, we will focus on several Windows-based lateral movement techniques
that do not rely on specific software vulnerabilities.
Each technique offers a certain element of stealth
and can improve our level of access.
We’ll begin by abusing the Windows Remote Desktop Protocol.
Next we’ll describe the PsExec technique which will allow us to create
a custom implementation that is slightly more stealthy.