Get the Whitepaper called Blind CreateRemoteThread Privilege Escalation.
You can download it from the following link: https://packetstormsecurity.com/files/download/157545/Blind_CreateRemoteThread_Escalate.pdf
Source: https://packetstormsecurity.com/files/157545/Blind-CreateRemoteThread-Privilege-Escalation.html