Typorithm · hard

Lateral Movement & DCSync

ad-lateralpentestpass-the-hashdcsynclateral

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Lateral Movement & DCSync

Active Directory

Pass-the-hash and pass-the-ticket move laterally without cracking a password; psexec and wmiexec execute commands remotely. DCSync (secretsdump) replicates the domain's NTDS hashes, which equals full domain compromise. The remediation is tiered admin, LAPS, and credential hygiene.

Lateral movement does not always require a plaintext password. With pass-the-hash, the NTLM hash is itself a usable credential — crackmapexec smb target -u admin -H <hash> authenticates with the hash directly. Pass-the-ticket does the same with a Kerberos ticket. psexec.py and wmiexec.py then run commands on the remote host, hopping from machine to machine.

The endgame is DCSync. secretsdump.py -just-dc uses domain replication rights to pull every account's NTDS hash straight from a domain controller. Obtaining the krbtgt and Domain Admin hashes is full domain compromise, because every credential in the domain is now exposed.

Remediation layers together: a tiered admin model stops a stolen workstation credential from reaching Tier 0; LAPS randomizes each machine's local admin password so one hash cannot unlock the fleet; and credential hygiene — not logging privileged accounts onto low-trust hosts — keeps high-value hashes out of reach in the first place.

Pass-the-hash uses the NTLM hash, no plaintext needed.

DCSync (secretsdump -just-dc) dumps every NTDS hash.

Defense: tiered admin, LAPS, credential hygiene.

crackmapexec smb target -u admin -H <hash>
psexec.py corp.local/admin@target
secretsdump.py -just-dc corp.local/admin@dc
# pass-the-hash needs no plaintext password

Read the implementation

Connect each part of the code to the concept before you type.

1. Pass-the-hash

-H authenticates with the NTLM hash directly, so no plaintext password is ever needed to log in.

crackmapexec smb target -u admin -H <hash>

2. Remote execution

psexec.py executes commands on a remote host, moving the engagement laterally to a new machine.

psexec.py corp.local/admin@target

3. DCSync

secretsdump.py -just-dc replicates NTDS hashes from the DC — full domain compromise in one command.

secretsdump.py -just-dc corp.local/admin@dc

4. Key insight

The NTLM hash itself is a credential, so stealing it is as good as stealing the password.

# pass-the-hash needs no plaintext password

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.