Five distinct paths from low-privilege user to SYSTEM. Credentials in plaintext. Scheduled tasks pointing to writable scripts. Services configured by someone who didn't read the documentation.
The Vectors
Stored Credentials
PowerShell history, IIS web.config, saved Windows credentials via cmdkey, and PuTTY registry entries. Four separate sources of plaintext or reusable credentials without touching memory.
Scheduled Task Abuse
Scheduled task pointing to a batch file any user could overwrite. Replaced it with a Netcat reverse shell, triggered the task manually, shell landed as the task account.
Service Executable Permissions
Writable service binary. Replaced it with an msfvenom payload, restarted the service, shell landed as the service account.
Unquoted Service Path
Service binary path with spaces and no quotes. Windows resolved an intermediate path first. Planted a payload there, restarted the service, shell landed as a different service account.
Insecure Service DACL
BUILTIN\Users had SERVICE_ALL_ACCESS on a service. Reconfigured it to run an msfvenom payload as LocalSystem, restarted it, shell landed as NT AUTHORITY\SYSTEM.
Each page has the full methodology, commands, and evidence.