Privilege escalation

With a writable Windows service

If the executable of a Windows service is writable by non-admin users, you can replace it with another executable that will launch a command prompt in the system account.

Program.cs

Replace the executable of the Windows service by the compiled application.
A command prompt will be launched when the Windows service will start.

whoami REM nt authority\system