# Lateral Movement

> PTH, PTT, DCOM, and remote exec methods for AD lateral movement

- **URL:** https://hackindex.io/platforms/active-directory/lateral-movement
- **Platform:** [Active Directory](https://hackindex.io/platforms/active-directory.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

Lateral movement in AD uses captured credentials and tickets to reach additional hosts and domains. Pass-the-hash, pass-the-ticket, and overpass-the-hash convert local loot into remote access without cracking passwords.

Remote execution through WMI, PSExec, DCOM, and WinRM gives you shells on machines where your current credentials are valid. Trust abuse lets you move between domains and forests when bidirectional or misconfigured trusts exist.

Credential reuse across domains is common in environments with shared service accounts or identical local admin passwords. Each new host expands your credential pool and attack surface.

## Guides

- [Pass-the-Certificate](https://hackindex.io/platforms/active-directory/lateral-movement/ad-pass-the-certificate.md): Abuse stolen X.509 certificates to authenticate via PKINIT or SChannel, obtaining TGTs or session tokens without requiring plaintext credentials.
- [Remote Execution in Active Directory](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution.md): Techniques for executing commands on remote AD hosts via WMI, PsExec, WinRM, and scheduled tasks to facilitate lateral movement across the domain.
- [DCOM Lateral Movement](https://hackindex.io/platforms/active-directory/lateral-movement/dcom-lateral-movement.md): Explores abusing Windows DCOM interfaces for lateral movement in AD environments, executing remote code via MMC20, ShellWindows, and ShellBrowserWindow objects.
- [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket.md): Explores credential-based lateral movement techniques in AD, covering PtH NTLM relay attacks and PtT Kerberos ticket hijacking to traverse network boundaries.
- [Pass-the-Ticket and Overpass-the-Hash](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.md): Covers Kerberos-based lateral movement via stolen TGTs (Pass-the-Ticket) and NTLM-to-TGT abuse (Overpass-the-Hash) in Active Directory environments.