Move between two lab hosts and log the route

short · 55 min · Objective 5.1

Task

Move laterally from one lab host you built to another using credentials you already captured, log the route as you go, and then break the chain with segmentation and tiering — because lateral movement follows trust relationships, and the map of those relationships is the thing to understand and to disrupt.

Steps

On the lab you own, build two hosts with a trust relationship you set — a shared credential, or one host permitted to execute on the other. Snapshot both.
From a foothold on the first, reuse a credential you captured earlier to reach the second, using a legitimate remote-execution path.
Log the route in /tmp/route.md: from:, to:, method:, and the trust that permitted it.
Read the second host's logs and note that the movement used valid credentials and a legitimate mechanism — which is why it is hard to distinguish from normal administration.
Break the chain: remove the shared credential or the trust, and confirm the movement no longer works.
Revert snapshots.

Verify

grep -cE "^from:" /tmp/route.md
grep -cE "^(method|trust):" /tmp/route.md
grep -ciE "removed|broke|no longer|segmentation|tiering" /tmp/fix.md

The first count must be non-zero: you recorded moving between hosts. The second must be non-zero: each hop records the method and the trust that permitted it, because trust relationships are the map. The third must be non-zero: you broke the chain with segmentation or tiering and confirmed it, which is the remediation.

Notes

Lateral movement follows trust relationships and reuses credentials you already have, using legitimate remote-execution paths — which is exactly why it blends with normal administration in the logs. Segmentation and tiering break the chain, which is why they appear in the remediation for so many findings. Everything ran on disposable hosts you built with credentials you set.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.