Lateral movement

Objective 5.1 in this course covers post-exploitation activities — establishing persistence, performing lateral movement, and cleaning up artifacts. This is the second. Runs between machines you own, in the lab from lesson 2.

Why this matters

Lateral movement is how one compromised host becomes many, and it is what turns a single finding into the compromise that matters to a client. Named directly by CompTIA, it is also the heart of lesson 40's attack narrative: the story a client needs is usually the story of movement, not of the initial foothold.

The lesson

Trust relationships as the map

Lateral movement follows trust. Before moving, you map who trusts whom, because that map is the set of paths available.

• Shared credentials are the most common trust: the same account, the same local administrator password (lesson 26), the same key across many machines. Each shared credential is an edge in the graph.
• Directory trust. In a domain, accounts and their permissions define who can reach what, and administrative relationships are the high-value edges.
• Service and application trust — systems configured to authenticate to each other, integrations with stored credentials, machines that trust a management server.
• Network reachability, which bounds all of the above: a trust you cannot reach across the network is not immediately usable, which is what segmentation (lesson 22) is for.

The output is a graph of hosts and the trust edges between them, and lateral movement is traversing it. Tooling that maps these relationships exists, and reading its output to find the path to the objective is the skill.

Remote execution paths between hosts you own

The mechanisms that move you from one host to the next, described for recognition:

• Remote management protocols — the legitimate administrative channels, used with credentials you have recovered. This is the quietest movement because it is indistinguishable from administration.
• Remote service creation and scheduled tasks on the target host, the lesson-36 mechanisms used against a new machine.
• Authenticated file and command execution through the protocols that permit it.
• Credential replay (lesson 26), which is often the movement itself — you do not need to exploit the next host if the credential you hold already authenticates to it.

The important recognition: most lateral movement is authenticated and looks legitimate. It is not exploitation of the next host; it is using valid credentials over valid channels, which is exactly why it is hard to detect and why the credential hygiene from lessons 25, 26 and 34 matters so much.

Reusing credentials you have already captured

This is the engine of lateral movement, tying Domain 4's credential work to Domain 5's movement.

• Credentials from one host authenticate to others wherever accounts are shared — which lesson 26 showed is common and lesson 22's segmentation is meant to bound.
• Each host reached yields more credentials to dump (lesson 29), which reach further, which is the compounding that makes lateral movement accelerate.
• The path to the objective is usually a sequence: this credential reaches that host, which yields that credential, which reaches the domain controller.

This compounding is why a single shared local administrator password is such a serious finding — it is not one machine, it is every machine that shares it, and from each the next set of credentials. The finding is the reachability, and it is lesson 40's chain in its most literal form.

Moving between two lab machines and logging the route

The applied lab for objective 5.1's movement half, on two or more lab hosts from lesson 2.

1. Build hosts with a shared credential — the condition you are demonstrating — and a target on a host you cannot reach directly.
2. Compromise the first host and recover its credentials (Domain 4).
3. Map the trust — which credential reaches which host.
4. Move to the second host using a recovered credential over a legitimate channel, without exploiting it.
5. Log the route precisely — each hop, the credential used, the channel, the timestamp — because this log is lesson 40's attack narrative.
6. Read both hosts' logs, to see what movement looked like to the defender.

The step people skip is 5. The route, recorded as you go, is the single most valuable artefact of a post-exploitation engagement, and reconstructing it afterward loses exactly the detail the narrative needs.

Segmentation and tiering that break the chain

Remediation at the cause, and it is the same controls as several earlier lessons seen from the movement side:

• Segmentation (lesson 22) bounds reachability, so a compromised host cannot reach the next even with a valid credential. The verified segmentation claim from lesson 16 is what this relies on.
• Unique per-machine credentials (lesson 26) break credential-reuse movement — the single most effective control against the compounding above.
• Tiering ensures administrative credentials for high-value systems never land on low-value ones, so movement cannot climb.
• Least privilege limits what each reached credential can do, capping how far each hop advances.
• Detection of the movement pattern — the same account authenticating to many hosts in a short window, administrative logons where they do not belong — so that movement, even by legitimate channels, is at least noticed.

The client message: lateral movement is mostly legitimate credentials over legitimate channels, so the defence is not blocking the channels but breaking the trust — unique credentials, segmentation, tiering — and detecting the pattern that valid-but-abnormal movement makes.

What to take into the exam

• Lateral movement follows trust: shared credentials, directory trust, service trust, bounded by network reachability. Map the trust graph and traverse it.
• Most movement is authenticated and looks legitimate — credential replay over valid channels, not exploitation of the next host.
• Reached hosts yield more credentials, which compounds; a shared local administrator password is every machine that shares it.
• Log the route as you go — it is the attack narrative. Break the chain with unique credentials, segmentation, tiering and least privilege, and detect the abnormal-movement pattern.