> For the complete documentation index, see [llms.txt](https://notes.qazeer.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.qazeer.io/windows/lateral_movements.md).

# Lateral movements

### Expired password renewal

Expired password of local or domain accounts can be renewed over `SMB` (`MSRPC-SAMR`) using `impacket`'s `smbpasswd.py` Python script. `smbpasswd.py` supports authentication using an account `NTLM` hash.

```
smbpasswd.py [-newpass '<NEW_PASSWORD>'] <USERNAME>[:<CURRENT_PASSWORD>]@<HOSTNAME | IP>
smbpasswd.py [-newpass '<NEW_PASSWORD>'] -hashes <CURRENT_NT_HASH> <USERNAME>@<HOSTNAME | IP>
```

The account's previous password can be restored using `mimikatz`'s `lsadump::changentlm` function with only the knowledge of the previous `NTLM` hash. Note that the minimum password age policy setting may prevent an immediate password restoration.

```
mimikatz # privilege::debug
mimikatz # lsadump::changentlm /server:<DC_FQDN | HOSTNAME> /user:<USERNAME> [/oldpassword:<CURRENT_PASSWORD> | /old:<CURRENT_NT_HASH>] [/newpassword:<NEW_PASSWORD> | /new:<NEW_NT_HASH>]
```

### Lateral movements overview

Multiples techniques can be used to access computers remotely:

| Technique / Service                          | Port                                                                                                                                                                                                             | Required privileges                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Pass-the-Hash?                                         |
| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
| `PsExec`                                     | <p><code>SMB</code>: TCP Port 445<br>or<br><code>SMB</code> over <code>NetBIOS</code>: TCP port 139</p>                                                                                                          | <p>If <code>User Account Control (UAC)</code> is disabled (<code>EnableLUA</code> set to <code>0x0</code>):<br>Any local and domain accounts members of the local <code>Administrators</code> group<br><br>If <code>UAC</code> is enabled (<code>EnableLUA</code> set to <code>0x1</code>) in default configuration (standard since <code>Windows Vista</code> / <code>Windows Server 2008</code>):<br>Local built-in <code>Administrator</code> (RID: <code>500</code>)<br>Domain accounts members of the local <code>Administrators</code> group (SID: <code>S-1-5-32-544</code>)<br><br>If <code>UAC</code> remote restrictions are disabled (<code>LocalAccountTokenFilterPolicy</code> set to <code>0x1</code>):<br>Any local (and domain) accounts members of the local <code>Administrators</code> group<br><br>If <code>UAC</code> is enforced for the local built-in <code>Administrator</code> account <code>RID</code> 500 (<code>FilterAdministratorToken</code> set to <code>0x1</code>):<br>Only domain accounts members of the local <code>Administrators</code> group</p> | <p>Network logon<br>-> Yes</p>                         |
| `Remote Desktop Protocol (RDP)`              | `Terminal Services` TCP port 3389                                                                                                                                                                                | Any local and domain accounts members of the local `Administrators` (SID: `S-1-5-32-544`) or `Remote Desktop Users` (SID: `S-1-5-32-555`) groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Yes, if `Restricted Admin` mode is enabled server-side |
| `Windows Management Instrumentation (WMI)`   | <p><code>RPC</code> TCP port 135<br><code>RPC</code> randomly allocated high TCP ports:<br>- TCP ports 1024 - 5000 (<= Windows 2003R2)<br>- TCP ports 49152 - 65535</p>                                          | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| `Windows Remote Management (WinRM)`          | <p><code>WinRM 1.1 and earlier</code>:<br><code>HTTP</code> port 80<br>or<br><code>HTTPS</code> port 443<br><br><code>WinRM 2.0</code>:<br><code>HTTP</code> port 5985<br>or<br><code>HTTPS</code> port 5986</p> | Similar privileges to `PsExec` with the addition of membership to the `Remote Management Users` (SID: `S-1-5-32-580`) group                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | <p>Network logon<br>-> Yes</p>                         |
| `Distributed Component Object Model (DCOM)`  | Same TCP ports as `WMI`                                                                                                                                                                                          | Similar privileges to `PsExec` with the addition of membership to the `Distributed COM Users` (SID: `S-1-5-32-562`) group depanding on the target host configuration                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | <p>Network logon<br>-> Yes</p>                         |
| Remote Windows services                      | TCP port 445                                                                                                                                                                                                     | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| Remote scheduled tasks                       | TCP port 445                                                                                                                                                                                                     | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| Third parties remote administration IT tools | <p><code>AnyDesk</code>: TCP port 7070<br><code>TeamViewer</code>: TCP / UDP ports 5938<br>...</p>                                                                                                               | Technology dependent                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Likely not                                             |

To quickly identity which servers or workstations in the domain are exposing one of the service above from your network standpoint, AD queries and `nmap` can be used in combination (refer to the `[Active Directory] Methodology - Domain Recon` note).

Note that the `Impacket` Python scripts presented below are available as static stand-alone binaries for both Windows and Linux x64 operating systems on the following GitHub repository:

```
https://github.com/Qazeer/OffensivePythonPipeline

https://github.com/ropnop/impacket_static_binaries
```

**For the forensics artefacts induced by the different lateral movement technics refer to the `[DFIR] Windows - Analysis - Lateral movement` note.**

***

### References

<https://ss64.com/nt/sc.html>

<https://support.microsoft.com/en-us/help/251192/how-to-create-a-windows-service-by-using-sc-exe>

<https://posts.specterops.io/offensive-lateral-movement-1744ae62b14f>

<https://www.contextis.com/en/blog/lateral-movement-a-deep-look-into-psexec>

<https://docs.microsoft.com/fr-fr/windows/win32/winrm/portal>

<https://docs.microsoft.com/fr-fr/windows/win32/wmisdk/wmi-start-page>

<https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf>

<https://blog.cobaltstrike.com/2017/05/23/cobalt-strike-3-8-whos-your-daddy/>

<https://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-credentials/>

<https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/>

<https://docs.microsoft.com/en-us/windows/win32/secauthz/access-tokens>

<http://woshub.com/powershell-remoting-via-winrm-for-non-admin-users/>

<https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/>

<https://www.cybereason.com/blog/dcom-lateral-movement-techniques>

<https://docs.microsoft.com/en-us/openspecs/windows\\_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0>

<https://docs.microsoft.com/en-us/openspecs/windows\\_protocols/ms-dcom/ba4c4d80-ef81-49b4-848f-9714d72b5c01>

<https://blog.varonis.fr/dcom-technologie-distributed-component-object-model/>

<https://gallery.technet.microsoft.com/scriptcenter/89a5e3c2-0a1c-4471-b78c-136606cafdfb>

<https://blog.f-secure.com/endpoint-detection-of-remote-service-creation-and-psexec/>

Applied Incident Response, Steve Anson

<https://docs.microsoft.com/en-us/windows/win32/api/lmshare/nf-lmshare-netshareadd>

<https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/>

Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf