I was thinking this was where the article was going, but the solution ended up being a lot simpler. It leaves traces and notifies the user, though... I suppose

I was thinking this was where the article was going, but the solution ended up being a lot simpler. It leaves traces and notifies the user, though... I suppose yet another way would be to make a copy of the executable before the overwrite, then restore it after gaining a stable SYSTEM shell.