A simple POC for NetworkService PrivEsc as described by Forshaw (https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html)

Most of the code is taken from: https://github.com/milkdevil/incognito2/

I have done minor edits to this exploit, to allow the user to spawn a new process on a specified desktop. This can be useful when you want to have an interactive SYSTEM command prompt without using a reverse shell or similar when exploiting e.g. a service.

NetworkServiceExploit.exe:
-c <command>
-i interactive mode
-l list unique tokens
-p <pid> specific pid to look for
-d <ID> Spawn a new process on the desktop corresponding to this session *ID* (check your ID with qwinsta)

The code for the edit was taken from here: https://github.com/itm4n/PrintSpoofer