Using WMIC to find privilege-escalation vulnerabilities