Exploiting the Always Install Elevated feature
AlwaysInstallElevated is a Windows feature that allows standard user accounts with no administrative privileges to install software packaged in the Microsoft Windows Installer (MSI) format with administrative privileges.
We can leverage this configuration to elevate our privileges by generating a custom executable with the MSI format. Then, we can utilize the msiexec utility to execute the MSI executable, which will give us an elevated session.
This feature is commonly misconfigured in companies and organizations, primarily for ease of access for employees or is mistakenly left enabled by administrators after setting up a workstation. Either way, this technique will allow us to elevate our privileges in a relatively straightforward manner.
The Always Install Elevated feature is configured in the Windows Registry and as a result, we can query the registry to determine whether the feature is enabled before we begin the privilege...
