When a compromised user has SeDebugPrivilege assigned to their token but disabled, it can be enabled programmatically and abused to inject shellcode into a SYSTEM-owned process, achieving privilege escalation without needing SeImpersonatePrivilege or local Administrator group membership.
The critical requirement is that the shell must be running under an interactive logon (Type 2), network logons (Type 3) from PSRemoting or WinRM receive a filtered token where privileges cannot be enabled even if they appear in whoami /priv.
This enables SeDebugPrivilege and injects shellcode into a running SYSTEM process.
Replace the $sc byte array with msfvenom output. The script targets winlogon.exe by default which runs as SYSTEM.
By using RunasCs with --logon-type 2, a new process is spawned under an interactive logon session where SeDebugPrivilege can be genuinely enabled and used.