I still cannot understand one concept of Windows system exploitation.
There are many ways to get a shell on Windows machine - BO exploit, Web reverse shell, .exe launch. After that you gain a non-interactive cmd.exe version without any credentials.
Many local privilege escalation exploits require interactive/RDP environment e.x. to create second cmd window with system rights.
I can't understand how to overstep that gap between these two points. In most cases it's not a problem to route traffic to even firewalled 3389, but still - you do not know user's creds.
What are the possible ways to create interactive shell in such scenario?