Hi everybody! I’m stuck on privesc from the last week. Powershell works 1 time outta 10 and the vm keep resetting. I’ve tried abusing U****c but it’s now working, at least I don’t get the resverse shell execution… So I tried also with Tr-Se . I see that it is running as NT AUTHORITY\SYSTEM and I tried to switch the executable with an msfvenom payload that should pop a reverse shell. I can’t see the error output on my shell so I suppose that the file is locked because it is running; i tried to move it, rename it, delete it with no luck. I read that is possible retrieve T*****r 7 password and someone has been able to do it… can someone please point me in the right direction???