$ grep category=Lateral Movement

2 articles in this category.

Lateral Movement advanced

From Web RCE to GCP Project Takeover via the Metadata Service

A full attack chain against a lab target: leaking a .git directory, finding an unsanitized system() call, then abusing the GCP instance metadata service to mint an OAuth token for a cloud-platform-scoped service account and exfiltrate a protected object from Cloud Storage.

2024-03-18

Lateral Movement advanced

Windows Lateral Movement: Pass-the-Hash & SMB/RPC Exec Tooling

A researcher-style study of Windows lateral movement: SMB/RPC fundamentals, LM and NTLM authentication, pass-the-hash, Impacket execution methods, Windows-native alternatives, protocol flow, forensic artifacts, detection opportunities, and defensive controls.

2022-06-13