Haiyahhh Hack Vault

Active Directory - SeBackupPrivilege Abuse

2 min read

🧠 Active Directory - SeBackupPrivilege Abuse

What is it?

  • Concept: SeBackupPrivilege lets its holder read any file on disk regardless of ACLs (so backup software can copy locked/protected system files without needing full Administrator rights) — including the registry hives (SAM, SYSTEM) that hold local account password hashes.
  • Impact: Local privilege escalation to Administrator/SYSTEM by dumping and pass-the-hashing (or cracking) the local Administrator’s NTLM hash straight out of the registry hives.

How it works

Windows normally protects the live SAM/SYSTEM registry hives from being read directly — they’re locked by the OS while it’s running. SeBackupPrivilege bypasses the usual ACL/lock checks specifically so backup agents can still capture a consistent copy of protected files, and the same override applies to reg save against the registry hives. Since the SAM hive’s data is encrypted with a key derived from the SYSTEM hive, both need to be pulled together; once local, a tool like secretsdump can decrypt them completely offline, no interaction with the live host required beyond the initial read.

Exploitation

Prerequisites

  • Code execution as an account with SeBackupPrivilege enabled — check with whoami /priv

Attack Vectors

reg save HKLM\SAM .\sam
reg save HKLM\SYSTEM .\system
# then transfer both files off the target (e.g. evil-winrm's `download`)
impacket-secretsdump -sam sam -system system LOCAL

Notes

  • The recovered hash is the local Administrator account’s, not a domain account’s — still enough for full control of the box via pass-the-hash, since it’s typically also a local admin.
  • SeRestorePrivilege (often granted alongside SeBackupPrivilege) is a related but separate abuse path — it allows writing files regardless of ACLs, which opens up options like overwriting a service binary or DLL instead of just reading secrets.

Mitigation

  • Fix: Only grant SeBackupPrivilege/SeRestorePrivilege to dedicated, tightly-controlled backup service accounts — never to a regular user or a broad group.
FileCreated
HTB - CicadaTuesday, July 21st 2026, 2:55:20 am

References:

Graph View

Backlinks