Active Directory:
Lateral Movement
PTH, PTT, DCOM, and remote exec methods for AD lateral movement
Pass-the-Certificate
Abuse stolen X.509 certificates to authenticate via PKINIT or SChannel, obtaining TGTs or session tokens without requiring plaintext credentials.
Remote Execution in Active Directory
Techniques for executing commands on remote AD hosts via WMI, PsExec, WinRM, and scheduled tasks to facilitate lateral movement across the domain.
DCOM Lateral Movement
Explores abusing Windows DCOM interfaces for lateral movement in AD environments, executing remote code via MMC20, ShellWindows, and ShellBrowserWindow objects.
Pass-the-Hash and Pass-the-Ticket
Explores credential-based lateral movement techniques in AD, covering PtH NTLM relay attacks and PtT Kerberos ticket hijacking to traverse network boundaries.
Pass-the-Ticket and Overpass-the-Hash
Covers Kerberos-based lateral movement via stolen TGTs (Pass-the-Ticket) and NTLM-to-TGT abuse (Overpass-the-Hash) in Active Directory environments.
Lateral movement in AD uses captured credentials and tickets to reach additional hosts and domains. Pass-the-hash, pass-the-ticket, and overpass-the-hash convert local loot into remote access without cracking passwords.
Remote execution through WMI, PSExec, DCOM, and WinRM gives you shells on machines where your current credentials are valid. Trust abuse lets you move between domains and forests when bidirectional or misconfigured trusts exist.
Credential reuse across domains is common in environments with shared service accounts or identical local admin passwords. Each new host expands your credential pool and attack surface.