AD Lateral Movement
AD PivotingLateral MovementDomain Propagation
Lateral movement in Active Directory refers to techniques used to move from one compromised host to another within the domain, escalating privileges and extending control.
Ports
| Port | Protocol | Description |
|---|---|---|
| 445 | tcp | SMB |
| 5985 | tcp | WinRM HTTP |
| 5986 | tcp | WinRM HTTPS |
| 135 | tcp | MSRPC |
| 3389 | tcp | RDP |
| 88 | tcp | Kerberos |
Fingerprints
| Banner / Probe | Expected Response |
|---|---|
nmap -sV -p <port> <target> | Service banner and version info |
nc -nv <target> <port> | Raw banner grab |
Key Files
| Path | Description |
|---|---|
C:\Windows\NTDS\ntds.dit | AD database with all password hashes |
C:\Windows\System32\config\SAM | Local SAM password hashes |
C:\Windows\System32\config\SYSTEM | System hive (boot key for hash decryption) |
C:\Windows\System32\config\SECURITY | Security policy and cached domain credentials |
%USERPROFILE%\AppData\Roaming\Microsoft\Credentials\ | Saved Windows credentials |
Default Credentials
| Username | Password | Context |
|---|---|---|
admin | admin | Generic admin account |
root | root | Generic root account |
Known CVEs
| Identifier | Type | Description |
|---|---|---|
— | Info | Check NVD database for latest CVEs |
Exploitation Primitives
| Technique | Tool / Command | Result |
|---|---|---|
| Recon | nmap -sV -sC -p- <target> | Full port/service scan |
| Enumeration | nmap --script <service>-* -p <port> <target> | Service-specific NSE scripts |
Notes
Always start with full port scan: `nmap -sV -sC -p- <target>`.
Check for default credentials before brute-forcing.
Use service-specific NSE scripts: `nmap --script <service>-* -p <port> <target>`.
Remember to check both IPv4 and IPv6 if applicable.
Seen on
ShodanCensysFOFAZoomEye
References