Psh sandbox

This just elevates powershell.exe instead of mshta.

I'm not sure about how non-interactive this exploit is? It seems like the user has to accept a dialog?