Horizontal escalation and lateral movement

In horizontal escalation, the attacker retains their existing credentials but uses them to act on a different user’s account. For example, a user on compromised system A attacks a user on system B in an attempt to compromise them.

The horizontal move that attackers would utilize is from the compromised system.

This is used to extract the hashes of common usernames such as Itsupport and LocalAdministrators, or known default user administrators to escalate the privileges horizontally on all the available systems that are connected to the same domain. For example, here, we will use CME to run the same password hashes across an IP range to dump all of the passwords on a hacker-controlled shared drive:

crackmapexec smb 10.10.10.1/24 -u <Username> -d local -H <Hashvalue> --sam

Figure 11.14 shows the output of a SAM dump being run on an entire IP range to extract SAM password hashes without planting any executables...