Backup Operators

Backup Operators

Membership of this group grants its members the SeBackup and SeRestore

SeBackup

SeBackupPrivilege iallows a user to bypass file and directory permission checks to perform backups. When granted, a user can read all files, regardless of the ACLs set on them, for backup purposes.

We can't do this using the standard copy command. We need to programmatically copy the data, making sure to specify the FILE_FLAG_BACKUP_SEMANTICS flag.

The FILE_FLAG_BACKUP_SEMANTICS specify that the file is being opened or created for a backup or restore operation.

If a folder or file has an explicit deny entry for our current user or a group they belong to, this will prevent us from accessing it, even if the FILE_FLAG_BACKUP_SEMANTICS flag is specified.

POC

We use this POC for the attack => https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug

Both .dll must be transfered to the target.

Launching the attack

First import the librairies from the POC

Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll

Then verifiy if SeBackup is enabled

If not we enable it

From there we have different attack options

A) Copying a protected file

B) Attacking a DC - Copying NTDS.dit

This applies only in Active Directory context.

We can attempt to copy the DC database which contains all the users NTLM hashed passwords. We can't copy it with Copy-FileSeBackupPrivilege because the file is locked.

We can use the Windows diskshadow utility to create a shadow copy of the C drive and expose it as E drive. The NTDS.dit in this shadow copy won't be in use by the system.

Next, we can use the Copy-FileSeBackupPrivilege cmdlet to bypass the ACL and copy the NTDS.dit locally.

Now we can use a tool likesecretsdump.py or the PowerShell DSInternals module to extract all Active Directory account credentials. Here we focus on the Administrator user:

With DSInternals:

With secretdumps.py:

C) Attacking Local Windows - Backing up SAM and SYSTEM Registry Hives

We can back up the SAM and SYSTEM registry hives to extract local account credentials offline using a tool such as Impacket's secretsdump.py

First we backup the hives

D) Copying protected files with robocopy

It's less common, but we can also leverage robocopy to copy files in backup mode:

  • /B: Runs in "Backup mode." Allows Robocopy to bypass file and folder permission checks because of SeBackupPrivilege

  • C:\secrets\creds.txt: Source directory

  • .\hacker_folder: Destination directory

  • creds.txt: Specifies to only backup this file from the source directory

Previous3 - Attack Group PrivilegesNextEvent Log Readers

Last updated