Lateral Movement

Question 1

Remote Procedure Call and Distributed Component Object Model (Lateral Movement)

Answer 1

• Remote procedure call RPC - used in windows to allow remote execution of code on a remote computer
• distributed Component Object Model DCOM - microsoft tech for comms between software components on networked computers
• PsExec - lightweight telnet replacement that executes processes on other systems without having to manually install client software
• Windows Management Instrumentation WMI - specification from microsoft for consolidating management of devices and apps in network from windows computing systems

Question 2

PS Remoting and WinRM (Lateral Movement)

Answer 2

• Powershell Remoting - allows computer to receive windows powershell remote commands
• Windows Remote Management WinRM - allows admins to remotely run management scripts using WS Management Protocol, Remote Management is run on server, Remote Shell is run in client
• Server message Block

Question 3

Remote Desktop Protocol RDP (Lateral Movement)

Answer 3

*allows remote access to machine over network through GUI

Question 4

Apple Remote Desktop

Answer 4

*allows remote access to machine over network through GUI for Apple

Question 5

Virutal Network Computing VNC

Answer 5

• operates like RDP but is cross platform

Question 6

X11 Forwarding (Lateral Movement)

Answer 6

*X11 forwarding provides a GUI by forwarding the x-windows/x-server over an SSH connection

Question 7

Telnet (Lateral Movement)

Answer 7

• permits sending commands to remote devices, information is sent in plaintext

Question 8

SSH (Lateral Movement)

Answer 8

*works like telnet but encrypted to create a secure channel between client and server

Question 9

RSH and Rlogin (Lateral Movement)

Answer 9

• Remote Shell RSH - Command line program used to execute shell commands as another user on another computer over the network, unsecure because it doesnt use encryption, use SSH instead
• Rlogin - Rsh created as part of rlogin package in BSD Unix, allowed a user to login and issue commands on another Unix computer over a TCP/IP network