DB.
Courses

Lateral Movement in Active Directory
OSCP · Chapter 19

Lateral Movement in Active Directory

Lateral movement in Active Directory is how an attacker expands from one compromised host to the rest of the domain, reusing captured credentials or tickets to authenticate to additional systems.

Key concepts

  • Valid Accounts + Remote Services (RDP, WinRM, SMB admin shares) is the most common lateral movement pattern once any credential is captured.
  • Pass-the-Hash/Pass-the-Ticket (from the previous chapter) let you move laterally without ever cracking the underlying password.
  • Tools like CrackMapExec/NetExec and Impacket's psexec/wmiexec automate credential validation and remote command execution across many hosts at once.
  • Detection relies on correlating authentication logs across hosts — a single account authenticating to unusually many systems in a short window is a strong lateral-movement signal.

Example

# Validate a captured hash against many hosts, then execute remotely (lab only)
netexec smb 10.10.20.0/24 -u administrator -H <ntlm_hash>
impacket-wmiexec DOMAIN/administrator@10.10.20.5 -hashes :<ntlm_hash>

Try it yourself

In a multi-host AD lab, take a captured local administrator hash from one machine and use it (via pass-the-hash) to authenticate to a second machine sharing the same local administrator credentials.

ReferenceSearch video walkthroughs

@ Daniel Burlacu