# Lateral movements

### Expired password renewal

Expired password of local or domain accounts can be renewed over `SMB` (`MSRPC-SAMR`) using `impacket`'s `smbpasswd.py` Python script. `smbpasswd.py` supports authentication using an account `NTLM` hash.

```
smbpasswd.py [-newpass '<NEW_PASSWORD>'] <USERNAME>[:<CURRENT_PASSWORD>]@<HOSTNAME | IP>
smbpasswd.py [-newpass '<NEW_PASSWORD>'] -hashes <CURRENT_NT_HASH> <USERNAME>@<HOSTNAME | IP>
```

The account's previous password can be restored using `mimikatz`'s `lsadump::changentlm` function with only the knowledge of the previous `NTLM` hash. Note that the minimum password age policy setting may prevent an immediate password restoration.

```
mimikatz # privilege::debug
mimikatz # lsadump::changentlm /server:<DC_FQDN | HOSTNAME> /user:<USERNAME> [/oldpassword:<CURRENT_PASSWORD> | /old:<CURRENT_NT_HASH>] [/newpassword:<NEW_PASSWORD> | /new:<NEW_NT_HASH>]
```

### Lateral movements overview

Multiples techniques can be used to access computers remotely:

| Technique / Service                          | Port                                                                                                                                                                                                             | Required privileges                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Pass-the-Hash?                                         |
| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
| `PsExec`                                     | <p><code>SMB</code>: TCP Port 445<br>or<br><code>SMB</code> over <code>NetBIOS</code>: TCP port 139</p>                                                                                                          | <p>If <code>User Account Control (UAC)</code> is disabled (<code>EnableLUA</code> set to <code>0x0</code>):<br>Any local and domain accounts members of the local <code>Administrators</code> group<br><br>If <code>UAC</code> is enabled (<code>EnableLUA</code> set to <code>0x1</code>) in default configuration (standard since <code>Windows Vista</code> / <code>Windows Server 2008</code>):<br>Local built-in <code>Administrator</code> (RID: <code>500</code>)<br>Domain accounts members of the local <code>Administrators</code> group (SID: <code>S-1-5-32-544</code>)<br><br>If <code>UAC</code> remote restrictions are disabled (<code>LocalAccountTokenFilterPolicy</code> set to <code>0x1</code>):<br>Any local (and domain) accounts members of the local <code>Administrators</code> group<br><br>If <code>UAC</code> is enforced for the local built-in <code>Administrator</code> account <code>RID</code> 500 (<code>FilterAdministratorToken</code> set to <code>0x1</code>):<br>Only domain accounts members of the local <code>Administrators</code> group</p> | <p>Network logon<br>-> Yes</p>                         |
| `Remote Desktop Protocol (RDP)`              | `Terminal Services` TCP port 3389                                                                                                                                                                                | Any local and domain accounts members of the local `Administrators` (SID: `S-1-5-32-544`) or `Remote Desktop Users` (SID: `S-1-5-32-555`) groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Yes, if `Restricted Admin` mode is enabled server-side |
| `Windows Management Instrumentation (WMI)`   | <p><code>RPC</code> TCP port 135<br><code>RPC</code> randomly allocated high TCP ports:<br>- TCP ports 1024 - 5000 (<= Windows 2003R2)<br>- TCP ports 49152 - 65535</p>                                          | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| `Windows Remote Management (WinRM)`          | <p><code>WinRM 1.1 and earlier</code>:<br><code>HTTP</code> port 80<br>or<br><code>HTTPS</code> port 443<br><br><code>WinRM 2.0</code>:<br><code>HTTP</code> port 5985<br>or<br><code>HTTPS</code> port 5986</p> | Similar privileges to `PsExec` with the addition of membership to the `Remote Management Users` (SID: `S-1-5-32-580`) group                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | <p>Network logon<br>-> Yes</p>                         |
| `Distributed Component Object Model (DCOM)`  | Same TCP ports as `WMI`                                                                                                                                                                                          | Similar privileges to `PsExec` with the addition of membership to the `Distributed COM Users` (SID: `S-1-5-32-562`) group depanding on the target host configuration                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | <p>Network logon<br>-> Yes</p>                         |
| Remote Windows services                      | TCP port 445                                                                                                                                                                                                     | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| Remote scheduled tasks                       | TCP port 445                                                                                                                                                                                                     | Similar privileges to `PsExec`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | <p>Network logon<br>-> Yes</p>                         |
| Third parties remote administration IT tools | <p><code>AnyDesk</code>: TCP port 7070<br><code>TeamViewer</code>: TCP / UDP ports 5938<br>...</p>                                                                                                               | Technology dependent                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Likely not                                             |

To quickly identity which servers or workstations in the domain are exposing one of the service above from your network standpoint, AD queries and `nmap` can be used in combination (refer to the `[Active Directory] Methodology - Domain Recon` note).

Note that the `Impacket` Python scripts presented below are available as static stand-alone binaries for both Windows and Linux x64 operating systems on the following GitHub repository:

```
https://github.com/Qazeer/OffensivePythonPipeline

https://github.com/ropnop/impacket_static_binaries
```

**For the forensics artefacts induced by the different lateral movement technics refer to the `[DFIR] Windows - Analysis - Lateral movement` note.**

***

### References

<https://ss64.com/nt/sc.html>

<https://support.microsoft.com/en-us/help/251192/how-to-create-a-windows-service-by-using-sc-exe>

<https://posts.specterops.io/offensive-lateral-movement-1744ae62b14f>

<https://www.contextis.com/en/blog/lateral-movement-a-deep-look-into-psexec>

<https://docs.microsoft.com/fr-fr/windows/win32/winrm/portal>

<https://docs.microsoft.com/fr-fr/windows/win32/wmisdk/wmi-start-page>

<https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf>

<https://blog.cobaltstrike.com/2017/05/23/cobalt-strike-3-8-whos-your-daddy/>

<https://blog.cobaltstrike.com/2015/12/16/windows-access-tokens-and-alternate-credentials/>

<https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/>

<https://docs.microsoft.com/en-us/windows/win32/secauthz/access-tokens>

<http://woshub.com/powershell-remoting-via-winrm-for-non-admin-users/>

<https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/>

<https://www.cybereason.com/blog/dcom-lateral-movement-techniques>

<https://docs.microsoft.com/en-us/openspecs/windows\\_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0>

<https://docs.microsoft.com/en-us/openspecs/windows\\_protocols/ms-dcom/ba4c4d80-ef81-49b4-848f-9714d72b5c01>

<https://blog.varonis.fr/dcom-technologie-distributed-component-object-model/>

<https://gallery.technet.microsoft.com/scriptcenter/89a5e3c2-0a1c-4471-b78c-136606cafdfb>

<https://blog.f-secure.com/endpoint-detection-of-remote-service-creation-and-psexec/>

Applied Incident Response, Steve Anson

<https://docs.microsoft.com/en-us/windows/win32/api/lmshare/nf-lmshare-netshareadd>

<https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/>

Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.qazeer.io/windows/lateral_movements.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.