if you installed the example vulnerable service at the beginning of this you can easily test your fancy new code injector make sure that the service is runningand simply execute your file_monitor py script eventuallyyou should see output indicating that vbs file has been created and modified and that code has been injected if all went wellyou should be able to run the bhpnet py script from to connect the listener you just spawned to make sure your privilege escalation workedconnect to the listener and check which user you are running as justin/bhpnet py - - whoami nt authority\system this will indicate that you have achieved the holy system account and that your code injection worked you may have reached the end of this thinking that some of these attacks are bit esoteric but the more time you spend inside large enterprisethe more you'll realize that these are quite viable attacks the tooling in this can all be easily expanded upon or turned into one-off specialty scripts that you can use in specific cases to compromise local account or application wmi alone can be an excellent source of local recon data that you can use to further an attack once you are inside network privilege escalation is an essential piece to any good trojan [ this code was adapted from the python wmi page ([ win _process class documentation[ msdn access tokens[ for the full list of privilegesvisit [ carlos perez does some amazing work with powershellsee