SeBackupPrivilege Abuse for Privilege Escalation

SeBackupPrivilege allows reading any file on the system regardless of ACLs: it is designed for backup software. With this privilege you can copy the SAM and SYSTEM registry hives even though they are locked and protected. Extract local account NTLM hashes from those files and either crack them or use them directly for pass-the-hash authentication.

This privilege is commonly assigned to members of the Backup Operators group and some service accounts. It does not require local admin rights. On a Domain Controller, it also grants access to NTDS.dit, which holds every domain account hash. Accounts with this privilege are high-value targets during post-exploitation.

• Copy SAM, SYSTEM, and SECURITY hives using reg save or backup semantics

• Extract NTLM hashes with impacket-secretsdump

• Use hashes for pass-the-hash or crack them offline

• On Domain Controllers, copy NTDS.dit via VSS shadow copy

SeBackupPrivilege Windows Escalation Check

SeBackupPrivilege must show Enabled. If it shows Disabled, enable it: the privilege is assigned to the current token but not yet active. Most group-inherited privileges arrive in the Disabled state. Activating it requires a token manipulation API call, not additional access. Enabling it does not change group membership or generate an event log entry for the privilege change itself.

Or use the SeBackupPrivilegeCmdlets: both DLLs come from the same GitHub repo. Set-SeBackupPrivilege wraps the WinAPI AdjustTokenPrivileges call and activates the privilege in the current process token. Either approach works; prefer the cmdlets if they are already staged on the target.

Step 1: Copy SAM and SYSTEM Hives

The SAM and SYSTEM files are locked by the OS. Use reg save to create unlocked copies: SeBackupPrivilege allows this even as a non-admin. Stage files in C:\Windows\Temp: it is writable by standard users and unlikely to trigger path-based alerts. Include the SECURITY hive to capture LSA secrets, which may contain cached service account passwords in plaintext or reversibly encrypted form. All three commands succeed silently on success. Any error output indicates a failed save.

If reg save is blocked, use the backup API directly via PowerShell: some environments restrict registry export for non-admin accounts via GPO. Copy-FileSeBackupPrivilege opens the file handle with FILE_FLAG_BACKUP_SEMANTICS, which instructs the kernel to skip the normal ACL check. The operation completes silently. No output on success. An access denied error means the privilege is not active in the current token.

Or use robocopy with backup mode: the /B flag activates backup semantics at the robocopy level. The output shows a summary table with copied file counts. Check the Copied row to confirm both files transferred. Robocopy is noisier than the PowerShell cmdlets and may generate additional process creation events on monitored targets.

Step 2: Transfer to Attack Box

Start impacket-smbserver on your attack box before running the copy commands on the target. The transfer fails silently if the server is not listening. Run the server as root. If outbound SMB (port 445) is filtered, use a Python HTTP server instead and pull files on the target with certutil -urlcache -split -f. Transfer SAM, SYSTEM, and SECURITY if all three were saved.

Step 3: Extract Hashes

The output format is username:RID:LM:NT:::. The LM value aad3b435b51404eeaad3b435b51404ee means LM hashing is disabled: ignore it. The NT hash is the value to use for pass-the-hash or cracking. The Administrator account appears at RID 500. Other local accounts follow. If the SECURITY hive was included, LSA secrets appear below the local account hashes.

Step 4: Use the Hashes

Pass-the-hash to get a shell:

Choose the tool based on what the target exposes. psexec drops a service binary and returns a SYSTEM shell. wmiexec uses WMI, leaves less on disk, and returns an admin shell. evil-winrm requires WinRM on port 5985 or 5986. The -hashes argument format is LMhash:NThash: use the empty LM hash as the LM portion when LM is disabled. A successful connection confirms the hash is valid and the account has local admin rights on the target.

Crack the hash offline:

For the full password attack workflow see https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks.

Reading NTDS.dit (Domain Controller)

If the target is a Domain Controller, SeBackupPrivilege allows copying NTDS.dit: the AD database containing all domain account hashes. NTDS.dit is locked by the AD DS database engine while the DC is running. Direct file copy fails. A VSS shadow copy creates a point-in-time snapshot of the volume and lets you read locked files through it. The diskshadow script creates the snapshot and exposes it as drive z:. Copy NTDS.dit from z:\Windows\NTDS\ntds.dit using backup semantics and save the SYSTEM hive separately. secretsdump needs the SYSTEM hive to extract the boot key, which decrypts the hashes stored in NTDS.dit.

Create the shadow script file first: each line is a diskshadow directive. set context persistent nowriters excludes VSS writers that would otherwise interfere with the snapshot. add volume c: alias privesc targets the system drive and assigns an alias for later reference. create triggers the actual shadow copy. expose %privesc% z: mounts the snapshot as drive z:.

Extract hashes: secretsdump decrypts NTDS.dit offline using the boot key from the SYSTEM hive. Output format matches the local SAM dump: username:RID:LM:NT:::. Large domains return thousands of lines. The krbtgt account hash appears near the top. Use grep krbtgt to isolate it. The krbtgt NT hash enables golden ticket creation. Machine account hashes (names ending in $) are included but rarely useful for pass-the-hash unless targeting a specific service.