Credential Re-use for Lateral Movement

Hello! Welcome back to our final module on post-exploitation.

In our last lesson, you learned how to establish a foothold inside a target network through pivoting. Using tools like ssh and chisel, you can now tunnel your traffic through a compromised host to reach internal-only systems. That gets you in the door.

This lesson is about what you do next: moving from that first compromised machine to other, more valuable targets within the network. This process is called lateral movement. We will focus on one of the most fundamental and effective lateral movement techniques in Windows environments: Pass-the-Hash (PtH). By the end of this lesson, you will be able to reuse credentials harvested from one machine to authenticate to another, without ever needing the original password.

1. The Theory: From Password to Hash

In many authentication systems, when you enter your password, the system hashes it and compares that hash to a stored value. The Windows NTLM authentication protocol has a characteristic that attackers can abuse: under certain conditions, you can skip the password step entirely and authenticate directly using a user's NTLM hash.

This means that if you can obtain a user's NTLM hash, you can often impersonate that user across the network.

Where Do Hashes Live?

If you gain administrative privileges on a Windows machine, you can access these hashes from two primary locations:

1. The SAM Database: The Security Account Manager (SAM) is a registry file (C:\Windows\System32\config\SAM) that stores the NTLM hashes for all local user accounts on that machine. Accessing it requires SYSTEM privileges.
2. LSASS Process Memory: The Local Security Authority Subsystem Service (lsass.exe) is a critical Windows process that handles user authentication, password changes, and access token creation. It caches the credentials (including NTLM hashes) of users who are currently or have recently been logged on. This is a goldmine for an attacker, as it can contain hashes for domain users, including privileged accounts like Domain Admins, who may have logged into the machine for maintenance.

Since you have a computer science background, you can think of the SAM file as persistent, on-disk storage for local credentials, while LSASS is volatile, in-memory storage for credentials related to active sessions. Dumping credentials from LSASS is the most common technique used during a penetration test.

2. The Practice: Dumping Hashes with Mimikatz

The quintessential tool for extracting credentials from LSASS is Mimikatz. It's a powerful post-exploitation tool that can parse the memory of the lsass.exe process and pull out plaintext passwords, NTLM hashes, and Kerberos tickets.

Let's see how it's done. The following video provides a concise, practical demonstration.

The key commands you saw were:

1. privilege::debug: This command attempts to grant Mimikatz the SeDebugPrivilege, which is necessary to interact with a protected process like lsass.exe. This will only succeed if you are running as a high-integrity user (like an administrator).
2. sekurlsa::logonpasswords: This is the magic command that instructs Mimikatz to parse the LSASS process memory and dump all available credentials.

The output will show various credential types, but for our purposes, the NTLM hash is the key piece of information we're looking for.

3. The Attack: Passing the Hash for Lateral Movement

Now that you have a user's NTLM hash, you can use it to authenticate to other machines on the network where that user has access. This is the "Pass-the-Hash" attack.

The image below illustrates a typical workflow. An attacker uses Mimikatz to generate a new command prompt that has the authentication context of a privileged user, then uses that new shell to access another machine.

While using Mimikatz's pth module is one way to do this, a more common and flexible method is to use specialized tools that can authenticate with a hash directly. Tools from the Impacket suite (like psexec.py, wmiexec.py) and other tools like Evil-WinRM are perfect for this. They allow you to specify the hash on the command line to gain a shell on a remote system.

Let's return to the video to see this in action.

This demonstrates the core loop of lateral movement: compromise > dump credentials > reuse credentials > repeat.

To round out your understanding, the following resource provides a text-based "cheat sheet" of various commands used for Pass-the-Hash.

Conclusion

Today you've learned a critical post-exploitation skill: lateral movement using Pass-the-Hash. This technique is a staple of penetration testing in Windows environments and is essential for moving from an initial foothold to controlling key assets within a network.

Key Takeaways:

• Lateral Movement is the process of moving from a compromised host to other hosts within the same network.
• Pass-the-Hash (PtH) is an attack that leverages a user's NTLM hash to authenticate to a remote service, bypassing the need for a plaintext password.
• LSASS (lsass.exe) is the primary target for credential dumping on a live system, as it caches credentials for logged-on users.
• Mimikatz is the go-to tool for dumping credentials from LSASS memory using the sekurlsa::logonpasswords command.
• Tools like Impacket (psexec.py, wmiexec.py) and Evil-WinRM allow you to use a captured hash to authenticate and gain a shell on a remote machine.

Next Lesson Preview:

Pass-the-Hash is incredibly powerful, but it's just one method of lateral movement. In our next lesson, we will explore another common scenario: reusing compromised credentials found in plaintext (e.g., in configuration files or scripts) and using a technique known as Pass-the-Hash to move laterally in a different way, this time by passing password hashes for Kerberos authentication. This will set the stage for you to understand how to move towards a domain controller, the ultimate prize in an Active Directory environment.