A penetration tester discovers an anonymous FTP server that is sharing the C:\drive. Which of the following is the BEST exploit?

Placing a batch script in the startup folder depends on a user logging in to trigger execution, making it unreliable and slower compared to a service-based approach.

Windows services commonly run under high-privilege accounts such as SYSTEM. By using FTP write access to redirect a service's binary path to a custom payload, the attacker gains code execution at that service's privilege level when the service starts or restarts. This technique - known as service binary path hijacking - directly leverages the write access without requiring user interaction or complex tooling.

The at.exe command schedules tasks but does not directly exploit FTP write access to C:\ for immediate privilege escalation as effectively as service binary replacement.

Downloading, modifying, and reuploading a registry hive via FTP requires offline registry import tooling and is far more complex and unreliable than direct binary replacement.