SeRestorePrivilege can let a low-privileged domain account escalate to SYSTEM on a Windows Server 2019 Domain Controller when combined with Server Operators membership. The article shows three attack paths: offline SAM/SYSTEM hive extraction for Pass-the-Hash, service binary path hijacking for a reverse shell, and replacing Utilman.exe for pre-authentication SYSTEM access. #SeRestorePrivilege #ServerOperators #Utilman.exe #EvilWinRM #Impacket #VMTools
Keypoints
- Server Operators membership automatically grants SeRestorePrivilege and SeBackupPrivilege.
- WinRM access with Evil-WinRM confirms the account’s enabled privileges on the Domain Controller.
- SAM and SYSTEM hives can be saved and exfiltrated for offline NTLM hash extraction.
- Pass-the-Hash enables administrative access without needing the plaintext password.
- Service hijacking and Utilman.exe replacement both provide SYSTEM-level code execution.
Read More: https://www.hackingarticles.in/windows-privilege-escalation-serestoreprivilege/