@0gtweet‘s tweet inspired me to look at lolbin stuff again (as it is often the case).

So… everyone knows we can use ftp.exe as a lolbin and using COMSPEC trick we can find one more way to use it this way:

set comspec=c:\windows\notepad.exe
ftp.exe
!