20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others

The rest of the 5.2 matching drill is which remote service you use once the hop exists. CompTIA lists service discovery targets: SMB/fileshares, RDP/VNC, SSH, cleartext, LDAP, RPC, FTP, Telnet, HTTP/HTTPS web interfaces, LPD, JetDirect, RPC/DCOM, and process IDs, then calls out WMI and WinRM on their own. You already know these ports from Domain 2. 5.2 is not a second port-memorization quiz. It is: this listener is how I move. This guide names the protocol and the job. It will not give exploit payloads, pass-the-hash one-liners, or WinRM shell recipes.

SMB and fileshares

SMB (typically TCP 445, historically 139) is how Windows hosts share files and how many testers copy a tool then execute it. Fileshares are both a loot path and a movement path: C$ and ADMIN$ admin shares, department shares with a scripts folder, and the share the jump box already mounts. When you pick SMB: the stem shows 445 open on the next host, an admin share the foothold account can write, or a file copy followed by remote execution. When you do not: the only listener is 3389 and the job is an interactive desktop (that is RDP), or 5985 and the job is a PowerShell remoting shell (that is WinRM).

Exam trap: treating every share as 2.2 share enumeration. 2.2 found the share. 5.2 uses it to land on the next box. Trap two: calling SMB the same thing as 4.2 NTLM relay. Relay borrowed a live authentication. Here you already have a credential (or a hash you will reuse as 4.3) and you are speaking SMB as a client from the new position.

RDP and VNC: interactive GUIs

RDP (TCP 3389) is Windows interactive desktop. VNC (often TCP 5900, plus vendor variants) is the cross-platform GUI cousin, frequently with weaker authentication and older encryption. When you pick RDP: you need a GUI, a logged-on user session, or a jump-host pattern the administrators already use. When you pick VNC: the stem is a non-Windows HMI, a lab PC, or a camera/NVR that speaks RFB. Exam trap: answering SSH for a Windows GUI stem, or answering RDP for Linux. Trap two: treating VNC as encrypted because the operator used it on a trusted VLAN. VNC is often cleartext or weakly protected, which is why CompTIA groups it with RDP but also with the cleartext idea.

RDP is loud in a different way than SMB. Interactive logons create sessions defenders can see. If the stem emphasizes stealthy file copy and a service-style command, SMB or WMI/WinRM is a better match than parking an RDP desktop.

SSH, Telnet, FTP, and the cleartext umbrella

SSH (TCP 22) is the Linux, Unix, and network-gear hop: interactive shell, file copy, and — conceptually — a later tunnel. When you pick SSH: the next host is Linux, an appliance, or a switch, and 22 is the admin path. Telnet (TCP 23) is the cleartext remote shell that still sits on printers, legacy controllers, and forgotten lab gear. FTP (TCP 21) is file movement, often with cleartext USER/PASS. CompTIA's cleartext bullet is the umbrella: Telnet, FTP, HTTP (not HTTPS), SNMPv1/v2c community strings, and similar. When you pick cleartext: the stem shows credentials or commands on the wire, or a service that never offered TLS. Exam trap: encrypting Telnet in your head because the OT VLAN felt private. Private is not encrypted. Trap two: answering SSH whenever the host is Linux. Linux with Telnet enabled is still Telnet.

LDAP, RPC, and RPC/DCOM

LDAP (389/636) from a new position is directory enumeration you could not see before: more accounts, more groups, more service principals. 5.2 LDAP is not 4.3 LDAP injection. Injection tampers with a filter. Here you are a bindable client on a segment that can reach a domain controller or an LDAP-speaking appliance.

RPC and RPC/DCOM (endpoint mapper on TCP 135, then dynamic ports) are how a lot of Windows remote management still works: MMC snap-ins against a remote computer, DCOM activation, and the transport under WMI. When you pick RPC/DCOM: the stem is remote Windows management that is not WinRM 5985/5986 and not a simple file share. Exam trap: calling every Windows remote job SMB. File copy is SMB. A WMI process create or a remote Event Viewer snap-in is RPC/DCOM.

HTTP/HTTPS admin UIs, LPD, and JetDirect

HTTP/HTTPS web interfaces are the forgotten admin planes: printer dashboards, camera and NVR logins, iLO/iDRAC/iRMC hypervisor and lights-out boards, SAN web UIs, and the internal wiki nobody put behind SSO. After a pivot they are often the easiest hop because they still have default credentials (4.2) or a password you just found with findstr. When you pick the web UI: the stem is a browser admin page on the newly visible net, not a file share and not SSH.

LPD (Line Printer Daemon, TCP 515) and JetDirect (HP printer language, often TCP 9100) are CompTIA's named printer paths. Printers sit on every VLAN, they are rarely patched, they store jobs and sometimes credentials, and they may have a second interface or a management VLAN the tester was not supposed to see. When you pick them: the stem is a printer, print server, or HP JetDirect banner on a segment you just reached. When you do not: treating LPD as Linux SUID privilege escalation, or treating JetDirect as VLAN hopping. They are lateral service discovery targets — forgotten, in-scope if the RoE includes them, and useful because nobody watches 9100 the way they watch 3389.

Exam trap: skipping printers because they are not domain controllers. 5.2 lists them because they are how testers stumble into credentials and adjacent networks. Trap two: attacking the vendor's cloud print service because the printer phones home. Stay on the in-scope device.

WMI and WinRM: two Windows remoting planes

WMI (Windows Management Instrumentation) queries and steers Windows over RPC/DCOM. Conceptually: remote process create, remote inventory, scheduled-job style actions, and a lot of living-off-the-land admin work. WinRM (Windows Remote Management) is HTTP(S) on 5985/5986 and is the transport under PowerShell remoting. Objective 4.4 named Evil-WinRM as a WinRM shell tool. 5.2 names WinRM as the protocol you move with.

When you pick WMI: 135/RPC is open, WinRM is filtered, or the stem is a WMI query or process create. When you pick WinRM: 5985 or 5986 is the path, and the job is an interactive or semi-interactive PowerShell remoting session. Exam trap: answering SSH for WinRM because both are remoting. Trap two: answering Mimikatz for WMI because both are Windows. Mimikatz dumps credentials (4.4 / additional 5.2 dump). WMI uses a credential to manage a host. Trap three: treating WinRM as only HTTPS 5986. HTTP 5985 is common inside a domain and is still WinRM.

Process IDs: who owns the listener, what you inject into

Process IDs (PIDs) are listed under 5.2 service discovery because movement is process-aware. A listening port is owned by a PID. That PID tells you whether you are looking at lsass.exe, spoolsv.exe, winlogon.exe, an HMI binary, or a vendor backup agent. Two exam jobs:

1. Targeting the service. You talk to the process that actually speaks SMB, RDP, or the admin UI — not a random high port.
2. Targeting injection (cross-ref 4.4). Process injection and hollowing hide code inside a trusted name. 5.2 is where you identify the PID worth blending into as you move; 4.4 is the injection attack type. Exam trap: treating PIDs as CVSS scores (4.1) or as a 5.3 exfiltration channel. A PID is not how you sneak a file out. Trap two: killing a PID to disable EDR and calling that 5.2. Circumventing security tools is 4.4 and RoE-gated.

Worked protocol match

From WS-042's OT NIC the tester sees: 445/SMB on FILE-OT, 3389/RDP on HMI-01, 5900/VNC on a lab PC, 22/SSH on a jump appliance, 23/Telnet on a PLC, 21/FTP on a legacy historian, 389/LDAP toward a DC that this NIC can now reach, 135/RPC on a Windows engineering workstation, 80 on a printer, 515/LPD and 9100/JetDirect on the same printer, 5985/WinRM on ENG-WS, and an HTTPS iDRAC. SMB is the file-and-admin-share hop to FILE-OT. RDP is the interactive HMI. VNC is the lab GUI. SSH is the appliance. Telnet and FTP are cleartext. LDAP is new directory visibility, not LDAP injection. RPC/DCOM and WMI are how you manage the engineering workstation if WinRM is off; WinRM is the answer when 5985 is the open admin port. The printer HTTP UI plus LPD/JetDirect are forgotten paths, not a domain-controller substitute. PID inventory on ENG-WS shows which process owns 5985 and which trusted process would be a 4.4 injection target later. Match the listener to the movement method; do not invent a kernel exploit because OT felt exotic.

Sequence on the exam: name the newly visible listener, name the movement method, and do not pick a 4.2/4.3/4.4 attack type when the stem is simply which protocol carries you to the next host.