Difficulty: Intermediate | Prerequisites: LDAP Enumeration and Initial Access study notes, basic understanding of Windows privilege model, familiarity with PowerShell and Evil-WinRM.
Once you have a shell on a domain controller, the next question is what that account can actually do. Windows assigns granular privileges to users and groups, and some of those privileges, particularly SeBackupPrivilege, grant far more access than their name suggests. This set of notes covers the post-exploitation phase: identifying dangerous privileges, understanding why the local SAM hash is not the same as the domain admin hash, and using built-in Windows utilities (Diskshadow and Robocopy) to extract the NTDS.dit database and dump every domain credential. If you have not covered LDAP enumeration and initial access, start there.
A compromised user in the Backup Operators group holds SeBackupPrivilege, which grants unrestricted read access to the entire file system. You use this to dump the SAM and SYSTEM registry hives, discover that the local admin hash is useless on a domain controller, then use Diskshadow and Robocopy to grab the NTDS.dit file, extract the domain Administrator's NTLM hash, and log in via pass-the-hash.
SeBackupPrivilege
A Windows privilege that allows a user to read any file on the system, bypassing all access control lists (ACLs). It is intended for backup software.
Think of it as a master key to every filing cabinet in the building, granted so you can photocopy everything for safekeeping.
SeRestorePrivilege
A Windows privilege that allows a user to write any file on the system, bypassing ACLs. It is the counterpart to SeBackupPrivilege.
In simple terms, if SeBackupPrivilege lets you read anything, SeRestorePrivilege lets you overwrite anything.
Backup Operators
A built-in Windows group whose members automatically receive SeBackupPrivilege and SeRestorePrivilege. Membership in this group is a common privilege escalation vector.
Think of it as the group you check for immediately after landing on a box, because its members can read the entire file system.
SAM (Security Account Manager)
A database file in the Windows registry (HKLM\SAM) that stores local user account password hashes.
In simple terms, this is where Windows keeps the hashed passwords for accounts that are local to this one machine (not domain accounts).
SYSTEM hive
A registry hive (HKLM\SYSTEM) that contains the boot key needed to decrypt the SAM database.
Think of it as the key you need alongside the SAM file to actually extract the password hashes. Without it, the SAM data is encrypted and useless.
NTDS.dit
The Active Directory database file, stored on every domain controller at C:\Windows\NTDS\ntds.dit. It contains password hashes for every domain account.
In simple terms, this is the SAM equivalent for the entire domain. Extracting it gives you every user's NTLM hash.
Diskshadow
A built-in Windows utility that creates Volume Shadow Copies, which are point-in-time snapshots of a drive. It can expose the snapshot as a new drive letter.
Think of it as a way to photograph a locked filing cabinet's contents without opening it, because the operating system will not let you copy certain files (like NTDS.dit) while they are in use.
Robocopy
A built-in Windows file-copy utility that supports the /b (backup mode) flag, which uses SeBackupPrivilege to bypass ACLs during the copy.
In simple terms, Robocopy with /b copies files you would normally be denied access to, as long as you hold SeBackupPrivilege.
Volume Shadow Copy (VSS)
A Windows service that creates consistent snapshots of volumes, even while files are open and in use. Diskshadow is a command-line interface to this service.
Think of it as a freeze-frame of the entire drive at a specific moment.
pypykatz
A Python implementation of Mimikatz that can parse SAM, SYSTEM, and NTDS.dit files offline to extract password hashes.
In simple terms, it reads the dumped database files on your attacking machine and gives you the hashes, without needing to run anything on the target.
impacket-secretsdump
An Impacket tool that extracts password hashes from SAM, SYSTEM, and NTDS.dit files. It can operate locally (on files you have copied) or remotely.
Think of it as the standard tool for turning dumped AD database files into a list of username:hash pairs.
Pass-the-hash
An authentication technique where you supply an NTLM hash directly instead of a plaintext password. Many Windows services, including WinRM, accept this.
In simple terms, you do not need to crack the hash. You use it as-is to authenticate.
NTLM hash
The MD4-based password hash format used by Windows for local and domain authentication. It is the hash stored in the SAM and NTDS.dit databases.
In simple terms, this is the value you extract and either crack or pass directly.
After gaining a shell, the first command to run is whoami /all. This shows:
Your username and SID.
Every group you belong to (look for Backup Operators, Domain Admins, Remote Management Users).
Every privilege assigned to your token (look for SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeImpersonatePrivilege).
In the Baby walkthrough, the user caroline.robinson was a member of BUILTIN\Backup Operators and held SeBackupPrivilege (Enabled) and SeRestorePrivilege (Enabled).
The "Enabled" state matters. A privilege that is listed but "Disabled" can sometimes be enabled programmatically, but one that is "Enabled" is ready to exploit immediately.
Backup Operators is a built-in Windows group designed for users who need to back up and restore files.
Members receive SeBackupPrivilege and SeRestorePrivilege, which together grant unrestricted read and write access to the entire file system, bypassing all NTFS permissions.
From a pentester's perspective, membership in this group is nearly equivalent to local admin: you can read the SAM, SYSTEM, and NTDS.dit files.
This group is often overlooked during security audits because its name sounds benign.
With SeBackupPrivilege, you can export the SAM and SYSTEM registry hives using built-in commands:
mkdir C:\Temp
reg save hklm\sam C:\Temp\sam
reg save hklm\system C:\Temp\system
Download these files to your attacking machine (Evil-WinRM has a built-in download command).
Extract hashes with pypykatz or impacket-secretsdump:
pypykatz registry --sam sam system
This gives you the local Administrator hash (RID 500).
On a domain controller, the local Administrator account and the domain Administrator account share the same name but are separate accounts with separate password hashes.
The SAM database stores only the local machine's accounts. The hash you extract from SAM is the local admin hash.
Domain controllers authenticate domain users against the NTDS.dit database, not the SAM. So the local admin hash will not work for domain-level authentication.
This is the critical "gotcha" in the walkthrough: you extract a hash, try to use it, and it fails. The fix is to go after NTDS.dit.
NTDS.dit is locked by the Active Directory service while the DC is running. You cannot simply copy it.
Diskshadow creates a Volume Shadow Copy (a snapshot) of the C: drive and exposes it as a new drive letter, giving you access to a static copy of every file.
Create a script file (script.dsh) with the following content:
set context persistent nowriters
add volume c: alias caro
create
expose %caro% E:
If creating the script on Linux, run unix2dos script.dsh to convert line endings before uploading.
Upload the script to the target and run it:
diskshadow /s script.dsh
The shadow copy is now mounted at E:\ and the NTDS.dit file is accessible at E:\windows\ntds\ntds.dit.
Robocopy with the /b flag copies files in backup mode, using SeBackupPrivilege to bypass ACLs:
robocopy /b E:\windows\ntds . ntds.dit
This copies ntds.dit from the shadow copy to the current directory.
Download the file to your attacking machine using Evil-WinRM's download function.
With the NTDS.dit, SAM, and SYSTEM files on your machine, run:
impacket-secretsdump -ntds ntds.dit -system system local
This extracts every domain account's NTLM hash, including the domain Administrator.
The output format is: domain\username:RID:LMhash:NThash:::
The NT hash (the second hash after the colon-separated LM hash) is the one you use for pass-the-hash.
With the domain Administrator's NTLM hash, authenticate without cracking it:
evil-winrm -i
You now have a shell as the domain Administrator on the domain controller. Full compromise.
Students often assume that the Administrator hash from the SAM file is the domain Administrator hash. It is not. On a domain controller, the SAM stores the local machine account's administrator hash, which is separate from the domain admin account stored in NTDS.dit. This distinction trips up nearly everyone the first time.
Students sometimes think SeBackupPrivilege only lets you back up files to a specific backup location. In reality, it grants unrestricted read access to every file on the system, regardless of NTFS permissions.
It is a common mistake to try copying NTDS.dit directly from C:\Windows\NTDS\ while the domain controller is running. The file is locked by the AD service. You must use a Volume Shadow Copy (via Diskshadow or vssadmin) to get an unlocked copy.
Students sometimes forget the unix2dos conversion step when creating the Diskshadow script on a Linux machine. Windows line endings (CRLF) are required, and the script will fail silently with Unix line endings (LF).
SeBackupPrivilege escalation is a staple of AD pentesting exams and labs. If you see Backup Operators in your group memberships, you should immediately think: SAM + SYSTEM dump, then NTDS.dit via Diskshadow.
Know the Diskshadow script syntax by heart. The four lines (set context, add volume, create, expose) are worth memorising.
The local-vs-domain admin hash distinction is a common trick question in exams and interviews.
impacket-secretsdump syntax with the -ntds, -system, and local arguments is tested frequently. Know the difference between running it locally (on files) and remotely (against a live DC).
Pass-the-hash with Evil-WinRM (-H flag) is the standard finishing move for AD boxes with WinRM open. If you can get the domain admin hash, you can get the shell.
True or False: SeBackupPrivilege allows you to write any file on the system.
False. SeBackupPrivilege grants read access. SeRestorePrivilege grants write access.
Fill in the blank: The Active Directory database file that contains all domain account hashes is called ____.
NTDS.dit
True or False: You can copy NTDS.dit directly from C:\Windows\NTDS\ while the domain controller is running.
False. The file is locked by the AD service. You need a Volume Shadow Copy.
Fill in the blank: The Robocopy flag ____ copies files in backup mode, bypassing NTFS ACLs.
/b
True or False: The Administrator hash extracted from the SAM database on a domain controller is the same as the domain Administrator hash in NTDS.dit.
False. They are separate accounts with separate hashes.
Q: You run whoami /all and see SeBackupPrivilege: Enabled and membership in BUILTIN\Backup Operators. What is your escalation path?
A: Dump the SAM and SYSTEM registry hives with reg save, extract the local hashes, then use Diskshadow to create a Volume Shadow Copy and Robocopy to copy NTDS.dit. Run impacket-secretsdump against the NTDS.dit and SYSTEM files to extract the domain Administrator hash, then pass-the-hash with Evil-WinRM.
Q: You extract an Administrator hash from the SAM file and try to authenticate with it via Evil-WinRM. It fails. Why?
A: The SAM stores the local administrator hash, not the domain administrator hash. On a domain controller, these are separate accounts. You need to extract the domain admin hash from NTDS.dit instead.
Q: Write the four lines of a Diskshadow script that creates a shadow copy of C: and exposes it as drive E:.
A: set context persistent nowriters / add volume c: alias myalias / create / expose %myalias% E:
Q: What Robocopy command copies NTDS.dit from a shadow copy mounted at E: to the current directory?
A: robocopy /b E:\windows\ntds . ntds.dit
Q: You have ntds.dit and system files on your attacker machine. What command extracts all domain hashes?
A: impacket-secretsdump -ntds ntds.dit -system system local
This material follows directly from LDAP enumeration and initial access. The enumeration phase gives you the foothold; this phase turns that foothold into full domain compromise. Together they form a complete AD attack chain from zero to domain admin.
Related escalation paths worth studying: SeImpersonatePrivilege (Potato attacks), SeDebugPrivilege (process injection), DCSync (replicating hashes remotely without touching NTDS.dit), and Kerberoasting (cracking service account hashes offline). Each targets a different privilege or misconfiguration but follows the same pattern of enumeration, exploitation, and credential extraction.
SeBackupPrivilege, SeRestorePrivilege, Backup Operators group, privilege escalation Windows, SAM dump, SYSTEM hive, NTDS.dit extraction, Diskshadow, Robocopy backup mode, Volume Shadow Copy VSS, pypykatz, impacket-secretsdump, pass-the-hash, NTLM hash, Evil-WinRM pass the hash, domain controller compromise, AD privilege escalation, reg save hklm, local vs domain administrator, Vulnlab Baby, OSCP privilege escalation, Windows token privileges