Privilege escalation

With a writable Windows service

If the executable of a Windows service is writable by non-admin users, you could replace it by another executable which will start a command prompt in the System account.

Program.cs

Replace the executable of the Windows service by the compiled application.
A command prompt will be launched when the Windows service will start.

whoami REM nt authority\system