Now there are two terms that commonly get confused with each other and that is
lateral and pivoting. And I'm here to explain it in the easiest, most complicated, simplistic,
almost easy way possible. I'm just picking with you. We're going to break this down pretty easy.
Lateral movement is about identity. So whenever you hear lateral movement, just know that it's
about who you are at that time. You are moving sideways through the actual network using valid
credentials. You know, we're talking about the username passwords that we created and maybe even
with that golden ticket sometimes too. You're jumping between machines. You're going from one
to the other. You're not making any up or down movements, meaning you're not going from a
workstation to a domain controller. You're going from workstation to workstation. And pivoting is
about routing. So you're creating a tunnel like we did in our crafted packets when we were doing
tunneling techniques earlier in this course to reach a hidden network that your attack machine
cannot see directly. So think of this for instance, right? You're going through and you're trying to
attack the domain controller, but you're having to pivot through our Ubuntu box like we did earlier
in the course through SSH tunneling. So you're talking directly to Ubuntu. You can't network
see the domain controller. You're just using the Ubuntu box to be able to do that attack for you.
It's a relay point, right? And that's exactly what pivoting is. In the sense of understanding that
it's like a lateral pass in football. The ball does not go past the line or in a forward motion.
It goes either sideways or behind the quarterback or whoever has the ball at that time,
Dallas. But the forward motion is when you start pivoting. When the ball goes from quarterback to
receiver, it's changed to possession of players. So that's an actual pivot of the ball going down
the field. When a lateral pass is just that of the ball staying pretty much in the same point and not
making any progression forwards or backwards, Dallas. But generally lateral movement is broken
down into three areas. And the first one is the actual goal of being on the targeted system
directly instead of having to pivot through the network. And hopefully you can talk to somebody
that can see it for you, but no, it's actually being on the computer that you're targeting
directly. And this can be through a meter printer session, or it could be, you know, even so far as
to say you're physically on the box, but generally it's through a direct network connection to that
target system. You're on it and you can manipulate it directly as you see fit. Now, number two of
areas is the actual method. You could either do this by stealing the credentials, using something
like MSF Phenomenon console together, or a combination of, and then once you actually
get into the system, you could use other tools like the PS exec suite, WMI remote desktop to be
able to actually get on that system itself to execute those commands using those harvested
credentials, regardless of how you got them. But it is hand in hand with the goal of actually being
on that system itself. Now let's say that you've gone in directly to that system and you're using
a meter printer session with dummy.exe. This counts as a method of being able to do that because it is
stealing a credential because you did manage to get on that system in a session that is under
the credentials of the person logged in. If it just happens to be an administrator, it is what it
is and it's all fun and games from there on out. And then finally, we get into part three, which is
the actual technique of doing this. How so? Now, as we mentioned, you could use meter printer as
an actual technique of getting there for the method of being on that system directly
for your final goal. See, I'm trying to make a chain of events here, right? But as you look at
the individual techniques for doing this, as far as getting the credentials for that,
we've covered these in the previous couple of skills. Pass the hash, pass the ticket, a golden
ticket, and there's running the individual tools like meter printer. So it's just basically broken
down into those three areas of the goal, which is being on the system directly. The method of how
you do it. Are you using credentials? Are you using meter printer to do it? And then the technique
of having gotten those credentials, which is things like pass the hash or manipulating the golden ticket.