this is complicated rce. not so easy.it queries basically internal RPC calls and you need make the server listen to your machine. so I mentioned i couldn’t able to do it. but through some services you can get critical information from the server. Some times its not straight forward rce . Hope you understand and please correct me if I am wrong.