Lack of network segregation enabling lateral movement

From a host with an authorized route into a less restricted network, identify responsive hosts and reachable services across an inadequately segmented boundary, then use an authorized remote service to act on a reachable system. The examples in this record cover Nmap host and service discovery, Impacket PsExec over SMB, and an optional HTTP GET to a documented endpoint. The HTTP request does not demonstrate data collection, exfiltration, or file write; this record does not include an SSH or RDP execution command. The procedure assumes an in-scope route or foothold and applicable credentials or access rights.