Attackers exploited the vulnerability by creating an admins group and adding new users to it, Microsoft researchers say.