Question

During post-exploitation on a Windows 2019 server, you have a Meterpreter session running as a local service account (NT SERVICE\MSSQLSERVER) that holds the SeImpersonatePrivilege but not SeDebugPrivilege. You want to escalate to SYSTEM without dropping additional binaries to disk and without triggering a new process creation event that the SOC is monitoring. Which technique best fits these constraints?

Accepted Answer

Use a named-pipe impersonation potato-style attack (e.g., RoguePotato/PrintSpoofer) that coerces a SYSTEM service to authenticate to a pipe the session controls, then impersonates the resulting token

Answer

Dump LSASS memory with Mimikatz to recover the local Administrator NTLM hash, then pass-the-hash back to the same host

Answer

Enumerate unquoted service paths and plant a malicious executable in a writable directory, then restart the affected service

Answer

Modify the HKLM Run key to add a SYSTEM-level payload that executes at the next reboot