Haiyahhh Hack Vault

Active Directory - SeBackupPrivilege Abuse

4 min read

🧠 Active Directory - SeBackupPrivilege Abuse

What is it?

  • Concept: SeBackupPrivilege lets its holder read any file on disk regardless of ACLs (so backup software can copy locked/protected system files without needing full Administrator rights) — including the registry hives (SAM, SYSTEM) and, with the right access, NTDS.dit.
  • Impact: Local privilege escalation to Administrator/SYSTEM (member server), or a domain-wide credential dump (domain controller) — the exact target depends on which route below is actually usable.

How it works

Windows normally protects the live SAM/SYSTEM registry hives and NTDS.dit from being read directly — they’re locked by the OS while it’s running. SeBackupPrivilege bypasses the usual ACL/lock checks specifically so backup agents can still capture a consistent copy of protected files. SAM’s data is encrypted with a key derived from SYSTEM, so both always need to be pulled together; once local, secretsdump decrypts them completely offline.

There are two distinct routes that get lumped under “SeBackupPrivilege abuse,” and they have different real prerequisites — confirmed the hard way while writing up HTB Machine - Return, where the first route worked and the second didn’t:

Exploitation

Prerequisites

whoami /priv

Confirm SeBackupPrivilege is listed with State: Enabled — a right that’s present but Disabled won’t take effect until something enables it.

whoami /groups | findstr /i "S-1-5-32-544"

This checks specifically for BUILTIN\Administrators (SID S-1-5-32-544) in the token. This one only matters for Route 2 below — Route 1 doesn’t need it.

Route 1: reg save (needs only the privilege above)

reg save HKLM\SAM sam
reg save HKLM\SYSTEM system
# transfer both off-box, e.g. evil-winrm's `download`
impacket-secretsdump -sam sam -system system LOCAL

reg.exe only calls into RegSaveKeyEx, which just checks for SeBackupPrivilege being enabled — it doesn’t additionally check group membership. This is why svc-printer on HTB Machine - Return machine (in Server Operators, not Administrators) could run this step fine.

Route 2: diskshadow → NTDS.dit (needs local Administrators membership, not just the privilege)

This is the only way to get a domain-wide credential dump from a DC (Route 1 only ever touches the local SAM — see the DC caveat below). But diskshadow doesn’t go through reg.exe’s code path at all: it drives the VSS COM subsystem (IVssBackupComponents::InitializeForBackup) to create a shadow copy, and Microsoft’s own documentation states the requirement for that plainly:

“Membership in the local Administrators group, or equivalent, is the minimum required to run Diskshadow.” — Microsoft Learn: Diskshadow

That’s a group membership check, separate from whatever privileges the token carries. SeBackupPrivilege granted through Server Operators (or Backup Operators, or any group other than Administrators) does not satisfy it. Confirm with the whoami /groups check above before attempting this — if S-1-5-32-544 isn’t in the output, diskshadow will fail with COM call "(*vssObject)->InitializeForBackup" failed every time, and no amount of retrying or script-fixing will change that.

# script.txt
set context persistent nowriters
add volume c: alias cdrive
create
expose %cdrive% z:
# script.txt needs CRLF line endings — diskshadow misparses LF-only files
sed -i 's/$/\r/' script.txt
diskshadow /s script.txt
robocopy /b z:\Windows\NTDS . ntds.dit
reg save hklm\system system.hive
impacket-secretsdump -ntds ntds.dit -system system.hive LOCAL

On a Domain Controller: what Route 1 actually gives you

Promoting a box to a DC strips out normal local accounts — the only thing left in its local SAM is the DSRM (Directory Services Restore Mode) account. It’s still labeled “Administrator” with the same well-known RID 500, but by default it’s a separate credential from the domain’s Administrator account. Pass-the-hash with it against the domain will simply fail — wrong secret, not a broken technique. Route 2 (NTDS.dit) is what actually contains every domain account’s hash.

Notes:

  • Exception to the DC caveat: if the DSRM password was ever deliberately synced with a domain account’s password (ntdsutil → set dsrm password → sync from domain account), the DSRM hash is that domain account’s hash, and Route 1 alone is enough. This is a known persistence/misconfiguration technique, not the default state — cheap to just try, but don’t expect it on an unmodified DC.
  • SeRestorePrivilege (often granted alongside SeBackupPrivilege) is a related but separate abuse path — it allows writing files regardless of ACLs, opening up options like overwriting a service binary or DLL instead of just reading secrets.

Mitigation

  • Fix: Only grant SeBackupPrivilege/SeRestorePrivilege to dedicated, tightly-controlled backup service accounts — never to a regular user or a broad group like Server Operators.
FileCreated
HTB Machine - CicadaTuesday, July 21st 2026, 2:55:20 am

References:

Graph View

Backlinks