# Active Directory Lateral Movement

> Pass-the-hash, pass-the-ticket, PSExec, WMI, DCOM, WinRM, golden/silver tickets, and trust abuse for domain-wide lateral movement.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 4
- **Published:** 2026-09-25
- **Updated:** 2026-09-27

With valid credentials or a forged ticket, lateral movement lets you jump between hosts in the domain until you reach a Domain Controller or high-value target. PEN-200 covers pass-the-hash, pass-the-ticket, overpass-the-hash, PSExec, WMI, DCOM, WinRM, RDP hijacking, and golden/silver ticket forgery. The OSCP AD set requires chaining these techniques across multiple hosts to reach the domain controller.

## Lateral Movement Techniques

Pass-the-hash uses NTLM hashes directly without cracking. Pass-the-ticket injects stolen or forged Kerberos tickets. Overpass-the-hash converts an NTLM hash into a Kerberos TGT for environments that block NTLM. PSExec, SMBExec, and WMIExec provide remote command execution over SMB and WMI. DCOM and WinRM offer alternative execution paths when SMB is restricted. RDP hijacking reuses existing sessions without knowing the password. Each method leaves different forensic traces and works under different conditions.

## Domain Dominance and Persistence

Golden tickets (forged TGTs from the krbtgt hash) grant unrestricted domain access. Silver tickets target specific services without touching the DC. Pass-the-certificate uses ADCS-obtained certificates for authentication. After domain compromise, credential harvesting (NTDS.dit, LSASS, gMSA, LAPS) across the domain provides access to every account. Trust abuse extends access to child/parent domains and cross-forest trusts through SID history injection.

## Study material

- [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket.md) (read, core)
- [Pass-the-Ticket and Overpass-the-Hash](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.md) (read, core)
- [Remote Execution in Active Directory](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution.md) (read, core)
- [DCOM Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement/dcom-lateral-movement.md) (read, core)
- [Pass-the-Certificate](https://hackindex.io/platforms/active-directory/lateral-movement/ad-pass-the-certificate.md) (read, core)
- [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket.md) (read, core)
- [Overpass-the-Hash and Token Impersonation](https://hackindex.io/platforms/windows/lateral-movement/overpass-the-hash-and-token-impersonation.md) (read, core)
- [PsExec and SMB Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement.md) (read, core)
- [WMI Remote Execution for Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/wmi-remote-execution.md) (read, core)
- [WinRM and PowerShell Remoting Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/winrm-and-powershell-remoting.md) (read, core)
- [RDP Hijacking and Credential Reuse](https://hackindex.io/platforms/windows/lateral-movement/rdp-hijacking-and-credential-reuse.md) (read, core)
- [Golden Ticket and Silver Ticket Attacks](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket.md) (read, core)
- [Golden and Silver Ticket Persistence](https://hackindex.io/platforms/active-directory/persistence/golden-and-silver-ticket-persistence.md) (read, core)
- [Credential Harvesting](https://hackindex.io/platforms/active-directory/post-exploitation/ad-credential-harvesting.md) (read, core)
- [Situational Awareness](https://hackindex.io/platforms/active-directory/post-exploitation/ad-post-exploitation-situational-awareness.md) (read, core)
- [Domain Trust Abuse](https://hackindex.io/platforms/active-directory/post-exploitation/ad-domain-trust-abuse.md) (read, core)
- [Cross-Forest Trust Abuse](https://hackindex.io/platforms/active-directory/post-exploitation/ad-cross-forest-trust-abuse.md) (read, core)
- [Account and ACL Persistence](https://hackindex.io/platforms/active-directory/persistence/ad-account-and-acl-persistence.md) (read, core)
- [ADCS Certificate Persistence](https://hackindex.io/platforms/active-directory/persistence/ad-adcs-certificate-persistence.md) (read, core)
- [DSRM and Skeleton Key](https://hackindex.io/platforms/active-directory/persistence/ad-dsrm-and-skeleton-key.md) (read, core)
- [Mimikatz Active Directory Reference](https://hackindex.io/platforms/active-directory/exploitation/mimikatz-active-directory-reference.md) (read, core)
- [Rubeus Active Directory Reference](https://hackindex.io/platforms/active-directory/exploitation/rubeus-active-directory-reference.md) (read, core)
- [Certipy ADCS Exploitation Reference](https://hackindex.io/platforms/active-directory/exploitation/certipy-adcs-exploitation-reference.md) (read, core)
- [bloodyAD Active Directory Attack Reference](https://hackindex.io/platforms/active-directory/exploitation/bloodyad-active-directory-reference.md) (read, core)