mcpField
L
lateral-movement

lateral-movement

github.com/wgpsecSecurity1.8k50 installsUpdated 4d ago
Repository

About lateral-movement

lateral-movement is a security methodology guide for discovering targets and choosing remote movement techniques based on credentials and operating systems. It also covers post-movement checks and links to detailed references for credential handling and execution methods.

Key features

  1. 01Target discovery guidance
  2. 02Technique selection by credentials and OS
  3. 03Post-movement permission checks
  4. 04References for credentials and execution

Use cases

  1. 01Planning movement across discovered network hosts
  2. 02Selecting a remote execution method for available credentials
  3. 03Checking access after connecting to a host
  4. 04Consulting detailed technique references

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill lateral-movement

After installing, type/lateral-movementin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

evals/
evals.json
recall.json
references/
credential-extraction.md
movement-techniques.md
pass-techniques.md
remote-execution-comparison.md

Details

From the project README

横向移动方法论

⛔ 深入参考（必读）

Phase 1: 目标发现

arp -a                              # 已通信的主机
naabu -host 10.0.0.0/24 -p 22,80,135,445,3389,5985 -silent
目标价值
域控极高（控制整个域）
数据库/文件/备份服务器高（敏感数据）
跳板机中（连接更多网段）

Phase 2: 技术选择决策树

凭据类型 + 目标 OS？
├─ Linux
│   └─ SSH 密码/密钥（chmod 600!）
├─ Windows + 明文密码
│   └─ WinRM > WMI > PSExec（按隐蔽性）
├─ Windows + NTLM 哈希
│   └─ PTH via WinRM/WMI/PSExec
├─ Kerberos 票据
│   └─ PTT（mimikatz kerberos::ptt）
├─ 跨网段
│   └─ SSH 隧道/SOCKS 代理
└─ 需要图形界面
    └─ RDP
详细命令 → [references/movement-techniques.md](references/movement-techniques.md)

Phase 3: 移动后操作

  1. 确认权限 — whoami /all 或 id
  2. 重复后渗透流程
  3. 收集新凭据 — 可能发现更高权限凭据
  4. 评估下一步目标

注意事项

  • PSExec 创建服务 → 有明显日志，优先用 WMI/WinRM
  • PTH 只对 NTLM 认证有效（Kerberos-only 环境不行）
  • 多次失败可能触发告警，控制尝试频率

SSH 密钥认证横向

  • SSH 密钥/私钥（id_rsa）发现后直接登录
  • 注意文件权限：权限太宽松（如 0644 / too open）SSH 会拒绝
  • SSH 安全要求：私钥文件权限必须为 600

Comments

Markdown supported