# Lateral Movement

> Move across accounts or systems to expand reach. Use trust paths to access new assets.

- **URL:** https://hackindex.io/services/winrm/lateral-movement
- **Service:** [WinRM](https://hackindex.io/services/winrm.md)
- **Tags:** pivoting, movement, network
- **Published:** 2026-05-06
- **Updated:** 2026-07-13

WinRM lateral movement leverages PowerShell remoting to hop between hosts using harvested credentials or Kerberos tickets. Enter-PSSession gives you an interactive shell on the remote host, while Invoke-Command executes scripts across multiple targets simultaneously, making it one of the fastest lateral movement methods in a Windows domain.

Credential reuse is the primary vector. NTLM hashes work with Evil-WinRM's pass-the-hash support, and Kerberos tickets obtained through Rubeus or Mimikatz enable authentication without the plaintext password. When WinRM is allowed through the firewall between segments, it provides a clean lateral path that blends in with legitimate admin traffic.

The subpages cover remote session management, credential-based and ticket-based authentication for pivoting, JEA (Just Enough Administration) bypass techniques, and strategies for chaining WinRM sessions across multiple network segments.

## Guides

- [WinRM Lateral Movement](https://hackindex.io/services/winrm/lateral-movement/winrm-lateral-movement.md): Exploiting Windows Remote Management (WinRM) for lateral movement using tools like Evil-WinRM, CrackMapExec, and PowerShell remoting.