lateral-movement

Plan credential-based lateral movement across hosts using SSH, WinRM, WMI, PSExec, or RDP.

1.6k|234|Updated Dec 7, 2019

Search Tags:#pivot #lateral-movement #winrm #psexec #wmi #pth #ptt

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill lateral-movement-wgpsec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: lateral-movement
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/lateral/lateral-movement
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill lateral-movement-wgpsec

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Coordinates credential-based lateral movement across a network to pivot from a compromised host to additional targets, taking OS and credential types into account to maximize effectiveness and stealth.

Core Features & Use Cases

Phase-based decision tree that selects the best method (SSH, WinRM/WMI/PSExec, RDP, DCOM) based on target OS and available credentials.
Supports Windows and Linux scenarios with guidance on credential usage and command selection.
Use Case: Red team exercises or post-compromise operations requiring safe, structured pivot planning and verification.

Quick Start

Plan credential-based lateral movement across hosts using the available credentials.

Frequently Asked Questions about lateral-movement

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I plan lateral movement across hosts using stolen credentials?▼

Planning lateral movement requires selecting the optimal pivot method based on target OS and credential type, ensuring commands align with WinRM, WMI, PSExec, SSH, or RDP to maximize effectiveness and stealth during post-compromise operations.

What is the best way to pivot to a Windows host using WinRM or PSExec?▼

The best way to pivot to a Windows host is using a decision tree that selects between WinRM, WMI, and PSExec based on the available credential types, aligning commands with the target OS to ensure safe, structured pivot planning.

Does lateral movement planning support both Windows and Linux environments?▼

Lateral movement planning supports both Windows and Linux scenarios, guiding credential usage and command selection by matching WinRM, WMI, PSExec, and RDP for Windows or SSH for Linux targets.

How do credential types like pth or ptt affect the pivot method selection?▼

Credential types like pass-the-hash (pth) and pass-the-ticket (ptt) directly affect pivot method selection by dictating which remote execution protocols, such as WMI or PSExec, can be used to authenticate and execute commands across target hosts.

When should I use RDP instead of WMI for credential-based lateral movement?▼

You should use RDP instead of WMI when your lateral movement requires graphical remote desktop access rather than command-line execution, selecting the method based on the target OS and the specific credential type available.

Can I use this for red team exercises to verify network pivot paths?▼

Yes, you can use this for red team exercises or post-compromise operations requiring structured pivot planning and verification, coordinating credential-based lateral movement across a network to safely pivot from compromised hosts.