Flat Network Pivoting

This record describes one internal SMB lateral-movement hop on a flat network. It assumes an authorized operator network position or foothold with a route to a reachable Windows SMB service (TCP 445 by default), then uses a valid, authorized NTLM hash to authenticate. Remote command execution requires the administrator rights and method-specific SMB share and service-control permissions described in the steps. Flat-network reachability is connectivity only; it does not provide credentials or authorization. SMB share enumeration is an optional check and does not itself grant access or command execution.