OSCP+ Lateral Movement Guide: Pivoting & Active Directory Escalation (2026)

Published under OffSec PEN-200 Technical Series • Read Time: 10 min

Escalating privileges within an Active Directory forest requires chaining access vectors across multiple hosts. When pivoting from a dual-homed member server toward the Domain Controller, selecting the right credential harvesting and delegation abuse technique is vital.

1. Modern Lateral Movement Vectors

Once credentials or NTLM hashes for internal service accounts are captured, move laterally using native tools or remote administration protocols:

• WinRM / Evil-WinRM: Ideal for remote PowerShell execution over port 5985/5986 without uploading heavy binaries.
• WMI & PsExec Execution: Effective when administrative shares (ADMIN$, C$) are accessible on member servers.
• Overpass-the-Hash: Convert captured NTLM hashes directly into Kerberos Ticket Granting Tickets (TGTs) using Rubeus.

2. Exploiting Resource-Based Constrained Delegation (RBCD)

RBCD remains one of the most reliable attack paths when a compromised account possesses write permissions over a computer object. If you have rights to add a machine account (MachineAccountQuota > 0), configure delegation directly: