it's possible to obtain local system privileges through help subsystem.
vulners.com/securityvulns/securityvulns:doc:5835