Escalate through weak service permissions and unquoted paths

A service you can reconfigure, or one whose unquoted path runs through a writable directory, executes your binary as its account on restart.