Lateral Movement Commands
20 commands across 4 subcategories. Every entry lists the authentication material it needs, the protocols it speaks and links to upstream tool documentation.
Remote Shells 11
- Evil-WinRM Shell Windows Remote Management shell connection
- Impacket AtExec Execute commands via Windows Task Scheduler service
- Impacket atexec.py (Scheduled Task) One-shot command execution by creating, running, and deleting a scheduled task over MS-TSCH. Output is…
- Impacket DCOMExec Execute commands via DCOM (Distributed Component Object Model)
- Impacket dcomexec.py Execute commands over DCOM (MMC20.Application / ShellWindows / ShellBrowserWindow) without dropping a…
- Impacket PSExec Execute commands via PSExec service
- Impacket SMBExec Execute commands via SMB service creation
- Impacket WMIExec Execute commands via WMI (Windows Management Instrumentation)
- NetExec SMB Command Exec Execute commands on a remote Windows host via SMB using NetExec
- NetExec WinRM Command Execution Execute a command on a Windows host over WinRM (PowerShell Remoting). Use -X for PowerShell scriptblocks.
- NetExec WMI Command Execution Execute a command on a Windows host over WMI. WMI exec is often allowed in environments where SMB / WinRM is…
Pass-the-Hash / Ticket 1
- Impacket Over-Pass-The-Hash Get TGT ticket using the hash
MSSQL 7
- Impacket MSSQLClient Interactive MSSQL shell for command execution and database access
- MSSQLPwner Linked Server Abuse Enumerate and abuse MSSQL linked servers for lateral movement
- NetExec MSSQL Command Exec Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account has sufficient…
- NetExec MSSQL Enable CmdShell Enable xp_cmdshell on a MSSQL server for OS command execution
- NetExec MSSQL Linked Servers Enumerate MSSQL linked servers for lateral movement opportunities
- NetExec MSSQL Privilege Check Enumerate and escalate MSSQL server privileges (sysadmin, impersonation, linked servers)
- NetExec MSSQL xp_cmdshell Execute OS commands via MSSQL xp_cmdshell using NetExec
RDP / SSH 1
- xFreeRDP Connection RDP connection using xFreeRDP