Named Pipes

Windows Privesc

Named Pipe Impersonation: How Windows getsystem Really Works

A deep dive into ImpersonateNamedPipeClient and how named pipe impersonation powers Meterpreter's getsystem.