Windows Privesc: Unquoted Paths & DLL Hijacking

Exploit an unquoted service path with a writable intermediate directory, and abuse Windows DLL search order to drop a malicious DLL a privileged process loads, both leading to SYSTEM.