# Lateral Movement and Pivoting

**Introduction**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FvrYYNpqPN9NFarM51rxc%2Fimage.png?alt=media&#x26;token=f7826b8b-d5bd-4af5-84e4-2224c4e9076e" alt=""><figcaption></figcaption></figure>

**Moving Through the Network**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FXyU1Eokrn9PBXghL4U76%2Fimage.png?alt=media&#x26;token=a1617261-1357-481a-b003-823d64e48607" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fo4G3tu7WNN7V0Y7G8btg%2Fimage.png?alt=media&#x26;token=4526e7cb-4dfd-4455-ae4d-6d9c5ab3b7dc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FrXsCFQ0G0w23eho0UVDC%2Fimage.png?alt=media&#x26;token=b71d9012-2711-436a-9eaa-4cbb2e8e1dbf" alt=""><figcaption></figcaption></figure>

**Spawning Processes Remotely**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FQPxp4Fx5VGJt03ETcUvh%2Fimage.png?alt=media&#x26;token=a4e3bdc8-6fcf-424f-907a-fb0938b3acad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fn3Z62DyNx9FcuBp9Kw48%2Fimage.png?alt=media&#x26;token=c2b893af-33c3-46da-93c2-acd2389c5f24" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FYO7S3Y0ZP7KkSL61kAh4%2Fimage.png?alt=media&#x26;token=8187dd9b-cb08-4430-9d1f-fd2f08aeb68a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FnQDq4NkxzaVIm49ld6pW%2Fimage.png?alt=media&#x26;token=9dfb0c41-e467-4e63-ba78-0be72d012f69" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FSLVeOyeyaLYQlEzFkPET%2Fimage.png?alt=media&#x26;token=eea47f69-35d9-410d-bf34-91bffaeedb71" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FxrQptImPgQ5CftObmwIC%2Fimage.png?alt=media&#x26;token=788e8fd1-245a-4b64-ab8b-d920db9eaf12" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FFhZoohxw9L1deZKib0L0%2Fimage.png?alt=media&#x26;token=3a594245-2438-4dff-96bb-38e25833c0d1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FupkWMsrxarFswEO82NEO%2Fimage.png?alt=media&#x26;token=65fda97f-b776-475c-a687-a82b14b47b35" alt=""><figcaption></figcaption></figure>

**Moving Laterally Using WMI**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F12FLViXIUeW00wyH87VR%2Fimage.png?alt=media&#x26;token=0282181e-f915-4bbf-bcab-a613cba3b9c7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F9iQW3Oc3NTPQwjitveva%2Fimage.png?alt=media&#x26;token=99ce4ed3-b651-4b08-9e09-10a3e4b076cf" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FWcJbaaIQdjN4L7BtBzuV%2Fimage.png?alt=media&#x26;token=06ca1172-50d2-4ef5-ae7b-bca9d5f59d9c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FlBiUKdq9LKLZGULOWIjQ%2Fimage.png?alt=media&#x26;token=b9ab969d-16ce-489d-ae38-e8b894a93470" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F23jBV9aDXu3GoAxJSWVW%2Fimage.png?alt=media&#x26;token=025ccf1e-020a-4b43-994b-5e42dba0edc1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FZqTx7vzmiK1IfGK4tasi%2Fimage.png?alt=media&#x26;token=3cb65917-0906-4d7b-ab68-40d0d30c90c2" alt=""><figcaption></figcaption></figure>

**Use of Alternate Authentication Material**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FrQPiSaRByBePQgXidvUe%2Fimage.png?alt=media&#x26;token=b414fff6-1239-4477-92ed-fd3eb2efe58b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FKTuI7Q7VvzW4553w4N8t%2Fimage.png?alt=media&#x26;token=ae68f9b1-dbce-4fb9-9f3f-7b94d20a6f04" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FOfuYt87WW4yodSf4ult1%2Fimage.png?alt=media&#x26;token=0ab41624-bfc3-46ab-97fe-6bfd10f14e55" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FNuOA13te4hEy2eRb4GHk%2Fimage.png?alt=media&#x26;token=2de77d8c-cb1b-46d7-b96d-6e6447c292f0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FVx003LBY8kxNQd6guFEL%2Fimage.png?alt=media&#x26;token=956c7fba-7ff7-464b-a51d-3b0825863df1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FGRCYdqh3R851nrTMJcMq%2Fimage.png?alt=media&#x26;token=e9eb7feb-c7f8-44f1-8539-4a7802e05280" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FStqLXNiylIVJSUX5IoP4%2Fimage.png?alt=media&#x26;token=7a07f569-104e-45a8-a78a-5d73382c90ab" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FTL93Bg1lI4grTFkh8Q9J%2Fimage.png?alt=media&#x26;token=461346f7-82a7-44d6-a4bb-68187a35b30c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F6Srim3mQXxgyyZFW3Jgt%2Fimage.png?alt=media&#x26;token=692c0833-4ff9-4d21-8dee-f906857492d5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FsmrCh1nYZ4kiBz18d4Ro%2Fimage.png?alt=media&#x26;token=c5abacdb-1981-4d0b-be0d-2914bf98f943" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FMPsz4CoLXFW5jqInmLXN%2Fimage.png?alt=media&#x26;token=cad8b70d-f078-41b9-b65d-101b74779d00" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FCmR3uJD0qLxjfSAnvqwK%2Fimage.png?alt=media&#x26;token=a19dd5a9-d4d7-4bd2-91b0-e875a4ae89c5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FmZRMMERIYnJpWR8fQUuE%2Fimage.png?alt=media&#x26;token=608ab21d-5b00-408c-be24-24c0de77a1fb" alt=""><figcaption></figcaption></figure>

\[0;97d82]<-2-0-40e10000-t2_felicia.dean@krbtgt-ZA.TRYHACKME.COM.kirbi>

|\_\_\_\_\_\_\_| ^ |\_\_\_\_\_\_\_\_| |\_\_\_\_\_\_\_\_\_\_\_\_\_| |\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_||\_\_\_\_\_|

&#x20;   \|     |     |              |                   |             |\_\_\_\_\_\_file extension

&#x20;   \|     |     |              |                   |

&#x20;   \|     |     |              |                   |\_\_\_\_\_\_resource

&#x20;   \|     |     |              |

&#x20;   \|     |     |              |\_\_\_\_\_\_user/computer account (ticket owner)

&#x20;   \|     |     |

&#x20;   \|     |     |\_\_\_\_\_\_0x40e10000 kerberos flag \[1]

&#x20;   \|     |

&#x20;   \|     |\_\_\_\_\_\_kerberos ticket type

&#x20;   \|            0 = TGS / 1 = Client ticket / 2 = TGT

&#x20;   |

&#x20;   |\_\_\_\_\_\_\_\_\_\_0x97d82 user LUID \[2]

**Abusing User Behaviour**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FAwlGEfWlSL5xIQyoXRBQ%2Fimage.png?alt=media&#x26;token=eb33af00-a76b-4cc9-8bde-03f6253c5efa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FpjDpgdzVHgAdVbrbf97C%2Fimage.png?alt=media&#x26;token=5c2bd71f-1a1e-44cb-b6ef-9af5d3356d91" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FYmgvT1Sl0420vIEpb1UL%2Fimage.png?alt=media&#x26;token=a1abbc33-3c57-4f5f-831b-15708986a5be" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F9vqmbK5SPkb721UJNLk5%2Fimage.png?alt=media&#x26;token=681cd4a1-8b4d-4b33-9d7d-5908c32fac68" alt=""><figcaption></figcaption></figure>

**Port Forwarding**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FL0tsIBi9hBYv152MGUmv%2Fimage.png?alt=media&#x26;token=ecdaa9f0-478f-4a58-8cc6-d7bec4a193ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FAVr88uMf2s34nqp3n2fv%2Fimage.png?alt=media&#x26;token=c7d34f22-196b-45a1-9060-b05afa024203" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FFD28ZMV0ENys5sqPNTal%2Fimage.png?alt=media&#x26;token=935f34fe-cdbd-4b23-b6c6-45b0c41f2af1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FSxlphbl2Dv1I0ximbw3b%2Fimage.png?alt=media&#x26;token=297e8c52-e60b-4916-b9b3-3979096a42e6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FvSBx7Ko0THvHWQGJ5JiK%2Fimage.png?alt=media&#x26;token=d937e5dd-ff3e-4e24-a1b6-b780a3d9b703" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FcPX0BRiJHf7Vcvascobg%2Fimage.png?alt=media&#x26;token=90dae1dd-ffcf-49dc-a660-e0a18b1159f6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2F4DYWbElS5QwfU8hul37p%2Fimage.png?alt=media&#x26;token=2bc253be-08b9-4636-9154-7774b4781aac" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FsJHWsLNntc5pS4jB8HFc%2Fimage.png?alt=media&#x26;token=a1ad2673-63b3-4fdb-b316-5ea24c678cfa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FG2YdR5NzynriDxClHDP7%2Fimage.png?alt=media&#x26;token=3ac6e2d5-de4a-43d6-84fe-ac2a7fe1ada2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FX1cJOUQHONPBZmPa0cWp%2Fimage.png?alt=media&#x26;token=da199952-a9c0-44af-a504-498ce3829cc9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FgY0npMbycVk9VofIvwxB%2Fimage.png?alt=media&#x26;token=15f33767-8f9f-4870-8958-660476ec2f8f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FlmGfoOFQkhnBU1TUmGDk%2Fimage.png?alt=media&#x26;token=7902a3fc-a958-4965-81fe-77823c15943a" alt=""><figcaption></figcaption></figure>

**Conclusion**

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fhg8ytaPkZdXy8blkdNUy%2Fimage.png?alt=media&#x26;token=7c8ce45f-55bb-477b-a3d8-c6ccd5198a91" alt=""><figcaption></figcaption></figure>

* [Sshuttle](https://github.com/sshuttle/sshuttle)
* [Rpivot](https://github.com/klsecservices/rpivot)
* [Chisel](https://github.com/jpillora/chisel)
* [Hijacking Sockets with Shadowmove](https://adepts.of0x.cc/shadowmove-hijack-socket/)
