# Lateral Movement Techniques

> Master post-exploitation lateral movement using Pass-the-Hash, Pass-the-Ticket, PsExec, WMI, and WinRM to navigate Active Directory networks.

Canonical: https://codelivly.com/rooms/lateral-movement-techniques
Last updated: 2026-07-24

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 6 |
| Estimated time | 30 min |
| XP | 200 |

A comprehensive, hands-on module covering post-exploitation lateral movement in Windows and Active Directory environments. Learn how to move stealthily between hosts using Pass-the-Hash (PtH), Pass-the-Ticket (PtT), PsExec, WMI, and WinRM. Understand the mechanics of credential reuse and remote execution to pivot from a compromised workstation to the Domain Controller. Includes guided, interactive labs.

## Lessons

1. What is Lateral Movement & Why Attackers Do It (30 min)
2. Pass-the-Hash Explained & Executed (30 min)
3. Pass-the-Ticket Explained & Executed (30 min)
4. PsExec & WMI for Remote Execution (30 min)
5. RDP & WinRM Abuse for Movement (30 min)
6. Guided Lab: Moving from One Host to Domain Controller (30 min)

## Related

- [Learning path: Active Directory Attacks](https://codelivly.com/learning-paths/active-directory-attacks)
- [All rooms](https://codelivly.com/rooms)