20.3 Lateral Movement Tools and LOLbins

Objective 5.2 ends as a tool matching drill. CompTIA names LOLbins (Netstat, Net commands, cmd.exe, explorer.exe, ftp.exe, mmc.exe, rundll32, msbuild, route, strings/findstr.exe), Covenant, CrackMapExec, Impacket, Netcat, sshuttle, Proxychains, PowerShell ISE, batch files, Metasploit, PsExec, and Mimikatz. You already met several of these logos on 4.2, 4.3, and 4.4. Here the question is: which one moves you, which one builds the path, and which one looks like the administrator. This guide matches jobs to names. It will not give Proxychains stanzas, sshuttle invocations, PsExec command lines, or Mimikatz recipes.

Tunnel and path tools: sshuttle, Proxychains, Netcat, Metasploit

sshuttle conceptually turns an SSH-capable foothold into a poor-man's VPN: TCP (and often DNS) from the tester appears to come from the far side of the SSH hop. Proxychains (and similar proxy wrappers) forces existing tools — scanners, clients, exploit modules — to send their TCP through a SOCKS relay you already created in 20.1. Netcat is the swiss-army TCP/UDP pipe: a listener, a client, a crude port forward, a file shove. Metasploit on 5.2 is not msfvenom from 4.2. It is the framework treating a session as a route — autoroute-style — so later modules exit through the compromised host.

When you pick this family: the stem is reachability. You have a hop and you need tools on the laptop to use it. When you do not: the stem is already on Windows admin shares and wants a remote command as SYSTEM (that is PsExec / CME / Impacket), or the stem is LSASS (that is Mimikatz). Exam trap: calling CrackMapExec a SOCKS proxy because CME can go through one. CME is the Windows fleet-movement tool; Proxychains is how you point a tool at a SOCKS path. Trap two: calling Mimikatz a tunnel. Mimikatz does not build SOCKS.

Netcat versus sshuttle: Netcat is a single pipe. sshuttle is a broader user-space relay over SSH. Proxychains is the wrapper for other binaries. Metasploit is the framework that already has a session. Match the width of the path, not the brand you used in a lab last year.

Windows movement: CrackMapExec, Impacket, PsExec, WinRM

CrackMapExec (CME) is the exam's Windows-fleet Swiss Army: check SMB signing, spray a credential (within RoE), run a command, confirm local admin, move to the next host. Impacket is the Python tradecraft family that speaks SMB, WMI, DCOM, and related Windows protocols from a tester box or a Python foothold (4.10 named Impacket for attack automation; 5.2 names it for movement). PsExec is remote execution via admin shares — copy a service binary, run as SYSTEM-style, come back. 4.4 already listed PsExec as a host tool; 5.2 lists it because that host tool is how you land on the next Windows box. WinRM-family shells (Evil-WinRM on 4.4) pair with the WinRM protocol from 20.2.

When you pick CME: fleet-wide Windows credential reuse and command execution, plus posture checks, from the new position. When you pick Impacket: a specific Windows protocol client (SMB exec, WMI, secrets dump as a library family) rather than a CME-style spray-and-run. When you pick PsExec: admin shares plus a one-shot remote command, often as a service. Exam trap: answering sshuttle for ADMIN$. Trap two: answering Covenant for a one-line SMB exec with no C2 story. Trap three: answering Impacket ntlmrelay thinking because Impacket also did 4.2 relay. On 5.2, Impacket is the Windows protocol toolkit for moving, unless the stem clearly revives live NTLM forwarding.

Covenant and Metasploit as C2-adjacent movers

Covenant is a command-and-control (C2) framework. 5.1 listed C2 for persistence. 5.2 lists Covenant because operators task a grunt to enumerate, token-impersonate, and move — SMB, WMI, PowerShell remoting — without dropping a new unsigned binary for every hop. When you pick Covenant: the stem is an established C2 implant and the next action is tasked lateral movement. When you do not: you only have a one-off SSH session and need a SOCKS wrapper (Proxychains / sshuttle / Netcat).

Metasploit overlaps: sessions, routing, and modules that execute on the far side. Pick Metasploit when the stem already lives in that framework (autoroute, a Meterpreter-style session used as a hop). Pick Covenant when the stem names a .NET C2 / grunts / tasking story. Exam trap: treating every C2 as 5.1 persistence only. If the grunt is used to move, it is 5.2.

Mimikatz: credentials that buy the next hop

Mimikatz is still the named credential dumping tool. On 4.4 it extracted LSASS/SAM/tickets on a host you already occupied. On 5.2 it runs again because the new host (or the new integrity level) holds the password, hash, or ticket that authenticates to FILE-OT or the DC. Mimikatz does not speak SMB for you. CME, Impacket, PsExec, WinRM, or RDP use what Mimikatz found. Exam trap: picking Mimikatz as the movement protocol. Trap two: picking Mimikatz for 4.2 NTLM relay. Trap three: picking hashcat. hashcat cracks. Mimikatz extracts.

LOLbins: look like admin activity

LOLbins (living-off-the-land binaries) are inbox or signed OS tools. Defenders cannot block them without breaking Windows. CompTIA's 5.2 list is specific:

• Netstat — who is listening, who is connected (network traffic discovery).
• Net commands (net view, net use, net user, net group) — shares, sessions, and accounts the way an admin already does.
• cmd.exe — the default command interpreter; parent of a lot of admin work.
• explorer.exe — GUI file copy and the process name you may want to blend into (PID / 4.4 injection cross-ref).
• ftp.exe — inbox FTP client; file movement without dropping a new binary.
• mmc.exe — Microsoft Management Console; remote computer snap-ins over RPC/DCOM.
• rundll32 — signed loader for a DLL; execution that looks like Windows.
• msbuild — signed build host that can execute inline tasks; 4.4 already used it as a LOLbin.
• route — routing table; the dual-home and the next hop in one command conceptually.
• strings / findstr.exe — string searches for passwords and keys (20.1 enumeration).

When you pick a LOLbin: the stem wants discovery or execution that looks like the administrator, or allow-listing blocked an unsigned drop. When you do not: the stem needs a dedicated dumper (Mimikatz is not a LOLbin), a C2 framework (Covenant is not a Microsoft-signed inbox binary), or a SOCKS wrapper (Proxychains is a tester tool, not an OS LOLbin). Exam trap: calling Mimikatz a LOLbin. Trap two: calling Covenant a LOLbin because the grunt used PowerShell. The LOLbin is powershell.exe / ISE / cmd.exe, not the C2 server.

PowerShell ISE and batch files

PowerShell ISE is a signed Microsoft host console. Testers use it when script blockers ignore inbox tools and when the movement job is a short remoting or WMI snippet. Batch files (.bat / .cmd) are the older living-off-the-land cousin: net use, copy, sc, wmic conceptually, scheduled with a job the admin already runs. 2.3 used PowerShell for recon snippets. 4.10 automated attacks. 5.2 uses ISE and batch files to move without looking like malware. Exam trap: answering 2.3 whenever PowerShell appears. If the ISE window is creating a WinRM session to FILE01, that is lateral movement.

Worked matching

WS-042 is the hop. A SOCKS-style path exists conceptually. Proxychains (or sshuttle if the hop is SSH) wraps the tester's scanner so packets exit on WS-042. Netcat forwards one HMI RDP port. Metasploit autoroute-style routing is the answer if the stem already has a Meterpreter-family session. On the Windows far side, CrackMapExec confirms local admin with the service account from findstr; Impacket speaks WMI when 5985 is filtered; PsExec is the admin-share one-shot. Covenant is how an existing grunt is tasked to do the same without a new drop. Mimikatz on ENG-WS yields the next password; it does not replace CME. Netstat and route show the OT conversations. findstr hits the backup script. mmc.exe opens Computer Management against ENG-WS. rundll32 / msbuild execute a helper that allow-listing would have blocked as an unsigned EXE. ftp.exe pulls a file from the historian. cmd.exe and explorer.exe are what the helpdesk already uses, which is the point. PowerShell ISE hosts the WinRM snippet. A batch file on a share the admin runs at logon is the quiet repeat. Name the job, then the logo.

free PenTest+ practice questionsPractice questions with detailed explanations