SeImpersonate to SYSTEM with a potato technique

A service account holding SeImpersonatePrivilege can coerce a SYSTEM authentication and duplicate its token for a full-privilege shell.