This is a short write-up on binary planting along with a few old-school 0-days which may still be helpful for pentesters willing to escalate privileges on Windows.
You can download it from the following link: https://packetstormsecurity.com/files/download/152120/windows-binaryplanting.pdf
Source: https://packetstormsecurity.com/files/152120/Microsoft-Windows-Binary-Planting.html