SeRestorePrivilege privilege escalation via Seclogon service hijacking.
Modifies the Seclogon service's ImagePath using SeRestorePrivilege and REG_OPTION_BACKUP_RESTORE to execute arbitrary commands as SYSTEM.
MIT License - Use only on authorized systems.
Bryan Alexander Original research
xct SeRestoreAbuse