A legacy PowerShell implementation of the Hot Potato local privilege-escalation technique. Trigger 1 spoofs WPAD resolution with NBNS and uses a Windows Defender signature-update request; trigger 2 uses WebClient and a scheduled task. Both trigger an HTTP-to-SMB NTLM relay to the local SMB service and run the supplied command as SYSTEM when the target retains the vulnerable Windows behavior. Relevant SMB and WPAD security updates hardened these paths, so success depends on the target's OS, patch state, and configuration.
PowerShell
RESTRICTED_ACCESS_BLUR_MARKER