Awesome
IRTriageCMD
IRTriage Command Line Interpreter (Cmd.exe)
Download ReactOS source
Download ReactOS build environment
Download IRTriageCmd
- Install build environment.
- Extract source into source directory.
- Run build environment
- configure
- cd output-MinGW-i386
- make cmd
- extract IRTriageCMD source over ReactOS source
- delete output-MinGW-i386\base\shell\cmd\cmd.exe
- make cmd
Done IRTriageCMD is located at "output-MinGW-i386\base\shell\cmd\cmd.exe"
http://blog.didierstevens.com/2015/12/13/windows-backup-privilege-cmd-exe/
https://isc.sans.edu/forums/diary/Use+The+Privilege/20483/