Privilege escalation

With a writable Windows service

If the executable of a Windows service is writable by non-admin users, you can replace it with another executable that will launch a command prompt in the system account.

Program.cs

1. Replace the executable of the Windows service by the compiled application.
2. A command prompt will be launched when the Windows service starts.

whoami REM nt authority\system