Programmatically start WebClient from an unprivileged session to enable that juicy privesc. - View it on GitHub