Use backup privilege to obtain protected local credential material

Needs: Usable backup privilege, compatible backup API/command and a matched protected source set with a writable destination

Backup privilege to local credential material

REM Backup privilege to local credential material
reg save HKLM\SAM C:\Windows\Temp\SAM.hive
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive

Backup privilege to local credential material

# Backup privilege to local credential material
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Verify → Verify complete matched source artifacts and exact account mapping after parsing.

If it fails → Ordinary file-copy denial does not disprove backup semantics; missing required hives or protection can still prevent useful extraction. More detail ↓

If → then

Protected local registry material is available under sufficient host privilege → Extract local account hashes from matched SAM and SYSTEM
Needs: Matched SAM/SYSTEM from the same system and appropriate read/backup access
An NT verifier from an appropriate credential source → Recover or reuse an NT password hash
Needs: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use backup privilege to obtain protected local credential material

USE WHEN: A token has the relevant backup rights and protected registry/files are a useful credential source
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: Matched credential material suitable for offline parsing

Recognize the clue

Inspect the actual token for backup-related rights and distinguish a privilege-aware read API from an ordinary file copy.

whoami /priv

SYNTHETIC EXAMPLE OUTPUT

SeBackupPrivilege   Back up files and directories   Disabled

Means: The privilege is assigned but initially disabled; permitted software may enable it for backup-semantic reads.

Confirm: Check that the privilege can actually be used, supporting API/context, complete matched source set and writable output.

After validation: A permitted backup-aware operation produces matched protected source files: select offline extraction.
Ruled out in this context: The token has no required privilege and no alternate read permission: reject this backup route.
Still inconclusive: Ordinary copy denial does not settle a backup-semantic operation; verify the API rather than inferring absence.

Troubleshooting: Ordinary file-copy denial does not disprove backup semantics; missing required hives or protection can still prevent useful extraction.

Additional prerequisite checks

whoami /priv
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa

Backup privilege to local credential material

Use the matched hive pair. Output is local credential material, not automatic SYSTEM/domain/remote authorization; classify and validate it through the credential procedure.

Why it works

Backup-mode read access can bypass ordinary read ACLs through supporting APIs; it does not grant arbitrary execution. Matched registry hives supply the key material required for credential parsing.

Worked example · hypothetical

Observation: a backup-capable account cannot directly read a protected file. Test: use the documented privilege-aware hive-save route. Illustrative output: matched SAM/SYSTEM files are obtained. Interpretation: parse offline and classify the resulting local hashes.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗