Question

During a host-based assessment on a Windows 10 workstation, you have a low-privileged user shell. You enumerate the registry and find that both HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated and HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated are set to 0x1. Which technique will most reliably escalate your privileges given this specific misconfiguration?

Accepted Answer

Craft a malicious MSI package with msfvenom and install it with msiexec, which runs the installer with SYSTEM privileges

Answer

Replace the binary path of an unquoted service with a payload and restart the service

Answer

Abuse SeImpersonatePrivilege with a potato-style attack to steal a SYSTEM token

Answer

Modify the PATH environment variable to hijack a DLL loaded by a scheduled task