Pivoting and Lateral Movement

A common practice in lateral movement is to look for stored passwords and hashes after establishing remote access to the victim' s host. The remote access can be a limited shell, a remote desktop session, or, even better, a root/administrator shell. Professionals in the field use the terms pivoting and lateral movement interchangeably. This chapter uses the two terms to talk about the same principle. Also, this task is considered a post‐exploitation phase in penetration testing engagements because it happens after exploiting the target host. The Security Account Manager file is where the Windows system will store the account hashes. In a typical organization, people use their Active Directory account to log in to their host. They use the same account to log in to other systems and this is called a single sign‐on. Port forwarding is simply to redirect network communication because of a firewall restriction.