Lateral Movement

Windows supports several mechanisms that can be used to execute commands on remote systems. The following pages explain common lateral-movement techniques and their prerequisites:

• PsExec
• SmbExec
• WmiExec
• AtExec / SchtasksExec
• WinRM
• DCOM Exec
• RDPexec
• SCMexec
• Pass the cookie (cloud)^[1]
• Pass the PRT (cloud)^[2]
• Pass the Microsoft Entra ID certificate (cloud)^[3]

References

• [1] HackTricks Cloud - Pass the cookie
• [2] HackTricks Cloud - Pass the PRT
• [3] HackTricks Cloud - Pass the certificate