# 横向移动
English: Lateral Movement
- Entry Count: 16
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## PsExec横向移动
- ID: lateral-psexec
- Difficulty: intermediate
- Subcategory: SMB
- Tags: psexec, lateral, smb, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-psexec.md
Description:
使用PsExec进行横向移动
Prerequisites:
- 目标机器开放445端口
- 拥有目标机器管理员凭证
- ADMIN$共享可访问
Execution Outline:
1. 基本使用
2. 使用哈希连接
3. 执行命令
4. Windows PsExec
Analysis:
PsExec通过SMB协议在目标机器创建服务并执行命令，成功后可获得目标机器的Shell。
OPSEC:
- PsExec会在目标机器创建服务，容易被检测
- 服务名称和二进制文件可能触发告警
- 考虑使用更隐蔽的横向移动方式
## WMI横向移动
- ID: lateral-wmi
- Difficulty: intermediate
- Subcategory: WMI
- Tags: wmi, lateral, windows, remote
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-wmi.md
Description:
使用WMI进行横向移动
Prerequisites:
- 目标机器开放135端口
- 拥有目标机器管理员凭证
- WMI服务可访问
Execution Outline:
1. WMI执行命令
2. Impacket wmiexec
3. 使用哈希
4. PowerShell WMI
Analysis:
WMI横向移动不会在目标机器创建服务，相对PsExec更隐蔽。
OPSEC:
- WMI执行不会留下明显的文件痕迹
- 但WMI活动可能被监控
- 命令输出通过临时文件获取
## Pass-the-Hash攻击
- ID: pass-the-hash
- Difficulty: intermediate
- Subcategory: 认证攻击
- Tags: pth, ntlm, hash, authentication
- Original Extracted Source: original extracted intranet-security-wiki source/pass-the-hash.md
Description:
使用NTLM哈希进行身份验证
Prerequisites:
- 获取用户NTLM哈希
- 目标机器允许NTLM认证
- 目标机器开放SMB/WMI端口
Execution Outline:
1. Impacket PtH
2. CrackMapExec PtH
3. Windows PtH
4. PowerShell PtH
Analysis:
PtH成功后可以该用户身份访问目标机器，无需明文密码。
OPSEC:
- PtH不会产生登录日志中的密码验证
- 但会留下网络登录日志
- 注意时间戳和来源IP
## NTLM Relay攻击
- ID: ntlm-relay
- Difficulty: advanced
- Subcategory: 认证攻击
- Tags: ntlm, relay, smb, authentication
- Original Extracted Source: original extracted intranet-security-wiki source/ntlm-relay.md
Description:
NTLM中继攻击技术
Prerequisites:
- 目标机器开放SMB端口
- 目标机器未启用SMB签名
- 可诱导目标机器认证
Execution Outline:
1. Responder监听
2. ntlmrelayx攻击
3. 中继到LDAP
4. IPv6中继
Analysis:
NTLM Relay成功后可以获取目标机器的访问权限或提升域权限。
OPSEC:
- 需要目标机器未启用SMB签名
- 域控制器默认启用签名
- IPv6中继更隐蔽
## WinRM横向移动
- ID: lateral-winrm
- Difficulty: intermediate
- Subcategory: WinRM
- Tags: winrm, lateral, powershell
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-winrm.md
Description:
通过WinRM进行横向移动
Prerequisites:
- WinRM启用
- 有效凭证
Execution Outline:
1. PowerShell远程
2. 执行命令
3. evil-winrm
## DCOM横向移动
- ID: lateral-dcom
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, lateral, com
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom.md
Description:
通过DCOM进行横向移动
Prerequisites:
- DCOM启用
- 有效凭证
Execution Outline:
1. MMC20.Application
2. ShellBrowserWindow
3. Excel DCOM
## SSH横向移动
- ID: lateral-ssh
- Difficulty: beginner
- Subcategory: SSH
- Tags: ssh, lateral, linux
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-ssh.md
Description:
通过SSH进行横向移动
Prerequisites:
- SSH服务
- 有效凭证
Execution Outline:
1. SSH连接
2. SSH密钥认证
3. SSH跳板
## RDP会话劫持
- ID: rdp-hijack
- Difficulty: intermediate
- Subcategory: RDP
- Tags: rdp, hijack, session
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-hijack.md
Description:
劫持已存在的RDP会话
Prerequisites:
- SYSTEM权限
- 存在RDP会话
Execution Outline:
1. 列出会话
2. 劫持会话
3. 使用Mimikatz
## Overpass-the-Hash
- ID: overpass-the-hash
- Difficulty: advanced
- Subcategory: PtH
- Tags: pth, kerberos, hash
- Original Extracted Source: original extracted intranet-security-wiki source/overpass-the-hash.md
Description:
使用哈希获取Kerberos票据
Prerequisites:
- 用户NTLM哈希
- 域环境
Execution Outline:
1. Mimikatz
2. Rubeus
3. Impacket
## Pass-the-Ticket
- ID: pass-the-ticket
- Difficulty: advanced
- Subcategory: PtT
- Tags: ptt, kerberos, ticket
- Original Extracted Source: original extracted intranet-security-wiki source/pass-the-ticket.md
Description:
使用Kerberos票据进行横向移动
Prerequisites:
- 有效Kerberos票据
Execution Outline:
1. 导出票据
2. 注入票据
3. Rubeus导入
## SMBExec横向移动
- ID: lateral-smbexec
- Difficulty: intermediate
- Subcategory: SMB
- Tags: smb, lateral, exec
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-smbexec.md
Description:
通过SMB执行命令
Prerequisites:
- SMB访问权限
- 管理员权限
Execution Outline:
1. Impacket smbexec
2. 通过服务执行
## ATExec横向移动
- ID: lateral-atexec
- Difficulty: intermediate
- Subcategory: 计划任务
- Tags: at, scheduled, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-atexec.md
Description:
通过计划任务执行命令
Prerequisites:
- 计划任务权限
- 管理员权限
Execution Outline:
1. Impacket atexec
2. schtasks
## WinRS横向移动
- ID: lateral-winrs
- Difficulty: beginner
- Subcategory: WinRS
- Tags: winrs, lateral, windows
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-winrs.md
Description:
通过WinRS执行远程命令
Prerequisites:
- WinRM启用
- 有效凭证
Execution Outline:
1. 执行命令
2. 获取Shell
## Excel DCOM横向移动
- ID: lateral-dcom-excel
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, excel, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom-excel.md
Description:
利用Excel DCOM进行横向移动
Prerequisites:
- 目标安装Excel
- DCOM权限
Execution Outline:
1. Excel DCOM激活
2. 执行命令
3. Impacket DCOM
## MMC DCOM横向移动
- ID: lateral-dcom-mmc
- Difficulty: advanced
- Subcategory: DCOM
- Tags: dcom, mmc, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/lateral-dcom-mmc.md
Description:
利用MMC DCOM进行横向移动
Prerequisites:
- 目标安装MMC
- DCOM权限
Execution Outline:
1. MMC20.Application
2. Impacket执行
## RDP Relay攻击
- ID: rdp-relay
- Difficulty: advanced
- Subcategory: RDP
- Tags: rdp, relay, lateral
- Original Extracted Source: original extracted intranet-security-wiki source/rdp-relay.md
Description:
RDP中继攻击技术
Prerequisites:
- RDP服务可访问
- 存在NTLM认证
Execution Outline:
1. 设置中继
2. 诱导连接
3. PetitPotam组合

