> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/serestoreprivilege.md).

# SeRestorePrivilege

This privilege is often given to [Backup Operators](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/backup-operators.md) and is distinct from the [SeBackupPrivilege](/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/sebackupprivilege.md), which pertains to arbitrary file reads. This privilege allows a process or user to...

* **write or restore any file**, regardless of NTFS permissions.
* bypass ACL checks during write operations.
* set file ownership, permissions / DACLs, and system-protected file contents

## ImagePath Manipulation

Attackers with `SeRestorePrivilege` can modify the `ImagePath` of an existing Windows service to execute a custom payload. When the service starts (usually as `NT AUTHORITY\SYSTEM`), it will execute the attacker's command instead of the original binary.

<https://www.elastic.co/guide/en/security/8.19/potential-privilege-escalation-via-service-imagepath-modification.html>

## File Replacement

Because `SeRestorePrivilege` permits overwriting files locked by the operating system, an attacker can replace a legitimate administrative utility or service executable (like `utilman.exe` or `sethc.exe` in the logon screen) with a payload such as `cmd.exe`. If the service runs the binary as `SYSTEM`, then our desired program should be executed as such!

<https://ovelny.sh/chaos/windows-exploitation/privilege-escalation/>