mr-un1k0d3r/elevate-system-trusted-bofCobalt Strike Beacon Object File that elevates an active beacon to SYSTEM and grants TrustedInstaller privileges through SetThreadToken token impersonation.
This BOF can be used to elevate the current beacon to SYSTEM and obtain the TrustedInstaller group privilege. The impersonation is done through the SetThreadToken API.
gcc elevate_x64.c -c -o elevate_x64.o
inline-execute C:\elevate_x64.o
Mr.Un1k0d3r RingZer0 Team