Study guide
20.3 Lateral Movement Tools and LOLbins
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
20.3 Lateral Movement Tools and LOLbins
Key Takeaways Explain This Topic AI
5.2 tool matching is conceptual: sshuttle, Proxychains, and Netcat (plus Metasploit autoroute-style routing) build paths; they are not Windows admin-share executors.
CrackMapExec, Impacket, and PsExec (and WinRM shells) move on Windows; Covenant is C2 tasking; Mimikatz supplies credentials that enable the next hop rather than speaking SMB itself.
LOLbins — Netstat, Net commands, cmd.exe, explorer.exe, ftp.exe, mmc.exe, rundll32, msbuild, route, strings/findstr.exe — look like admin activity because they are inbox or signed OS binaries.
PowerShell ISE and batch files are living-off-the-land hosts for movement scripts; they are not Domain 2 recon editors only.
Pick the logo from the job: tunnel, Windows remote execution, C2, dump, or LOLbin discovery — mixed stems belong on the free PenTest+ practice set.
Last updated: August 2026
Objective 5.2 ends as a tool matching drill. CompTIA names LOLbins (Netstat, Net commands, cmd.exe, explorer.exe, ftp.exe, mmc.exe, rundll32, msbuild, route, strings/findstr.exe), Covenant , CrackMapExec , Impacket , Netcat , sshuttle , Proxychains , PowerShell ISE , batch files , Metasploit , PsExec , and Mimikatz . You already met several of these logos on 4.2, 4.3, and 4.4. Here the question is: which one moves you , which one builds the path , and which one looks like the administrator . This guide matches jobs to names. It will not give Proxychains stanzas, sshuttle invocations, PsExec command lines, or Mimikatz recipes.
Tunnel and path tools: sshuttle, Proxychains, Netcat, Metasploit
sshuttle conceptually turns an SSH-capable foothold into a poor-man's VPN: TCP (and often DNS) from the tester appears to come from the far side of the SSH hop. Proxychains (and similar proxy wrappers) forces existing tools — scanners, clients, exploit modules — to send their TCP through a SOCKS relay you already created in 20.1. Netcat is the swiss-army TCP/UDP pipe: a listener, a client, a crude port forward, a file shove. Metasploit on 5.2 is not msfvenom from 4.2. It is the framework treating a session as a route — autoroute-style — so later modules exit through the compromised host.
When you pick this family: the stem is reachability. You have a hop and you need tools on the laptop to use it. When you do not: the stem is already on Windows admin shares and wants a remote command as SYSTEM (that is PsExec / CME / Impacket), or the stem is LSASS (that is Mimikatz). Exam trap: calling CrackMapExec a SOCKS proxy because CME can go through one. CME is the Windows fleet-movement tool; Proxychains is how you point a tool at a SOCKS path. Trap two: calling Mimikatz a tunnel. Mimikatz does not build SOCKS.
Netcat versus sshuttle: Netcat is a single pipe. sshuttle is a broader user-space relay over SSH. Proxychains is the wrapper for other binaries. Metasploit is the framework that already has a session. Match the width of the path, not the brand you used in a lab last year.
Windows movement: CrackMapExec, Impacket, PsExec, WinRM
CrackMapExec (CME) is the exam's Windows-fleet Swiss Army: check SMB signing, spray a credential (within RoE), run a command, confirm local admin, move to the next host. Impacket is the Python tradecraft family that speaks SMB, WMI, DCOM, and related Windows protocols from a tester box or a Python foothold (4.10 named Impacket for attack automation; 5.2 names it for movement ). PsExec is remote execution via admin shares — copy a service binary, run as SYSTEM-style, come back. 4.4 already listed PsExec as a host tool; 5.2 lists it because that host tool is how you land on the next Windows box . WinRM-family shells (Evil-WinRM on 4.4) pair with the WinRM protocol from 20.2.
When you pick CME: fleet-wide Windows credential reuse and command execution, plus posture checks, from the new position. When you pick Impacket: a specific Windows protocol client (SMB exec, WMI, secrets dump as a library family ) rather than a CME-style spray-and-run. When you pick PsExec: admin shares plus a one-shot remote command, often as a service. Exam trap: answering sshuttle for ADMIN$ . Trap two: answering Covenant for a one-line SMB exec with no C2 story. Trap three: answering Impacket ntlmrelay thinking because Impacket also did 4.2 relay. On 5.2, Impacket is the Windows protocol toolkit for moving , unless the stem clearly revives live NTLM forwarding.
Covenant and Metasploit as C2-adjacent movers
Covenant is a command-and-control (C2) framework. 5.1 listed C2 for persistence. 5.2 lists Covenant because operators task a grunt to enumerate, token-impersonate, and move — SMB, WMI, PowerShell remoting — without dropping a new unsigned binary for every hop. When you pick Covenant: the stem is an established C2 implant and the next action is tasked lateral movement. When you do not: you only have a one-off SSH session and need a SOCKS wrapper (Proxychains / sshuttle / Netcat).
Metasploit overlaps: sessions, routing, and modules that execute on the far side. Pick Metasploit when the stem already lives in that framework (autoroute, a Meterpreter-style session used as a hop). Pick Covenant when the stem names a .NET C2 / grunts / tasking story. Exam trap: treating every C2 as 5.1 persistence only. If the grunt is used to move , it is 5.2.
Mimikatz: credentials that buy the next hop
Mimikatz is still the named credential dumping tool. On 4.4 it extracted LSASS/SAM/tickets on a host you already occupied. On 5.2 it runs again because the new host (or the new integrity level) holds the password, hash, or ticket that authenticates to FILE-OT or the DC. Mimikatz does not speak SMB for you. CME, Impacket, PsExec, WinRM, or RDP use what Mimikatz found. Exam trap: picking Mimikatz as the movement protocol. Trap two: picking Mimikatz for 4.2 NTLM relay. Trap three: picking hashcat. hashcat cracks . Mimikatz extracts .
LOLbins: look like admin activity
LOLbins (living-off-the-land binaries) are inbox or signed OS tools. Defenders cannot block them without breaking Windows. CompTIA's 5.2 list is specific:
Netstat — who is listening, who is connected (network traffic discovery).
Net commands ( net view , net use , net user , net group ) — shares, sessions, and accounts the way an admin already does.
cmd.exe — the default command interpreter; parent of a lot of admin work.
explorer.exe — GUI file copy and the process name you may want to blend into (PID / 4.4 injection cross-ref).
ftp.exe — inbox FTP client; file movement without dropping a new binary.
mmc.exe — Microsoft Management Console; remote computer snap-ins over RPC/DCOM.
rundll32 — signed loader for a DLL; execution that looks like Windows.
msbuild — signed build host that can execute inline tasks; 4.4 already used it as a LOLbin.
route — routing table; the dual-home and the next hop in one command conceptually.
strings / findstr.exe — string searches for passwords and keys (20.1 enumeration).
When you pick a LOLbin: the stem wants discovery or execution that looks like the administrator , or allow-listing blocked an unsigned drop. When you do not: the stem needs a dedicated dumper (Mimikatz is not a LOLbin), a C2 framework (Covenant is not a Microsoft-signed inbox binary), or a SOCKS wrapper (Proxychains is a tester tool, not an OS LOLbin). Exam trap: calling Mimikatz a LOLbin. Trap two: calling Covenant a LOLbin because the grunt used PowerShell. The LOLbin is powershell.exe / ISE / cmd.exe , not the C2 server.
PowerShell ISE and batch files
PowerShell ISE is a signed Microsoft host console. Testers use it when script blockers ignore inbox tools and when the movement job is a short remoting or WMI snippet. Batch files ( .bat / .cmd ) are the older living-off-the-land cousin: net use , copy , sc , wmic conceptually, scheduled with a job the admin already runs. 2.3 used PowerShell for recon snippets. 4.10 automated attacks . 5.2 uses ISE and batch files to move without looking like malware . Exam trap: answering 2.3 whenever PowerShell appears. If the ISE window is creating a WinRM session to FILE01, that is lateral movement.
Worked matching
WS-042 is the hop. A SOCKS-style path exists conceptually. Proxychains (or sshuttle if the hop is SSH) wraps the tester's scanner so packets exit on WS-042. Netcat forwards one HMI RDP port. Metasploit autoroute-style routing is the answer if the stem already has a Meterpreter-family session. On the Windows far side, CrackMapExec confirms local admin with the service account from findstr; Impacket speaks WMI when 5985 is filtered; PsExec is the admin-share one-shot. Covenant is how an existing grunt is tasked to do the same without a new drop. Mimikatz on ENG-WS yields the next password; it does not replace CME. Netstat and route show the OT conversations. findstr hits the backup script. mmc.exe opens Computer Management against ENG-WS. rundll32 / msbuild execute a helper that allow-listing would have blocked as an unsigned EXE. ftp.exe pulls a file from the historian. cmd.exe and explorer.exe are what the helpdesk already uses, which is the point. PowerShell ISE hosts the WinRM snippet. A batch file on a share the admin runs at logon is the quiet repeat. Name the job, then the logo.
- Tool 5.2 job Typical stem cue Not the answer for
- sshuttle User-space hop over SSH Linux/appliance hop; whole-TCP path ADMIN$ / PsExec
- Proxychains Wrap tools through SOCKS Scanner must exit on the foothold Building the credential
- Netcat Single pipe / forward One port, one file shove Fleet Windows exec
Metasploit Session as a route (autoroute-style) Existing framework session 4.2 msfvenom payload as the 5.2 answer
- CrackMapExec Windows fleet movement SMB cred reuse, command, admin check SOCKS proxy by design
- Impacket Windows protocol clients SMB/WMI/DCOM from Python 4.2 NTLM relay unless the stem revives it
- PsExec Admin-share remote exec C$ / ADMIN$ one-shot Interactive WinRM shell
- Covenant C2-tasked movement Grunt already implanted One-off SSH SOCKS
- Mimikatz Dump secrets that buy the next hop LSASS/SAM/tickets on the new host The SMB/WinRM protocol itself
LOLbins Inbox binaries that look like admin netstat, net, cmd, explorer, ftp.exe, mmc, rundll32, msbuild, route, findstr/strings Unsigned malware; Mimikatz; Covenant
- PowerShell ISE Signed host for movement scripts WinRM/WMI snippet in ISE 2.3 recon-only
- Batch files Living-off-the-land repeat .bat on a share or logon C2 server
When mixed 5.2 stems ask which tool tunnels, which tool executes on Windows, which binary is a LOLbin, or whether Mimikatz moves or only unlocks the next hop, drill the identifications on the free PenTest+ practice questions . Name the job first, then the logo.