RpcSsImpersonator

Privilege Escalation Via RpcSs svc

You can also use this via Metasploit Framework. rapid7/metasploit-framework#14030

1. Administrator to SYSTEM

2. Network Service Account to SYSTEM

Based On:

https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html
https://windows-internals.com/faxing-your-way-to-system/

Credit to: @tiraniddo (James Forshaw) and Yarden Shafir & Alex Ionescu (@aionescu)