Extending my access: Abusing installed extensions for post compromise