IRTriageCMD

IRTriage Command Line Interpreter (Cmd.exe)

Download ReactOS source

Download ReactOS build environment

Download IRTriageCmd

- Install build environment.
- Extract source into source directory.
- Run build environment
- configure
- cd output-MinGW-i386
- make cmd
- extract IRTriageCMD source over ReactOS source
- delete output-MinGW-i386\base\shell\cmd\cmd.exe
- make cmd

Done IRTriageCMD is located at "output-MinGW-i386\base\shell\cmd\cmd.exe"

http://blog.didierstevens.com/2015/12/13/windows-backup-privilege-cmd-exe/

https://isc.sans.edu/forums/diary/Use+The+Privilege/20483/

http://www.riosec.com/articles

http://perldoc.perl.org/perlembed.html