AdRem NetCrunch: Credential-Free SYSTEM RCE via Cross-Session Hijacking

NetCrunch's Node.js web layer reuses RPC sessions without caller-ownership validation. An attacker who obtains a victim's sid@gid impersonates them, persists a malicious startup script via INcStartupScript.SetScriptOptions, and triggers RestartNCServer for SYSTEM-privilege command execution.