DnsAdmins or Backup Operators) is covered on AD Privileged Groups instead, this page is strictly about the privilege itself. Also check the official Microsoft Documentation for more informations about User Rights Assignment
SeNetworkLogonRight
Controls which accounts can connect to the device over the network (SMB, NetBIOS, CIFS, COM+). Informational, not itself an escalation path.SeRemoteInteractiveLogonRight
Grants RDP logon rights to the account. Worth checking for on a target user, since it opens a direct interactive path to the host rather than just a network protocol one.SeBackupPrivilege
This grants a user the ability to create system backups and could be used to obtain copies of sensitive system files that can be used to retrieve passwords such as the SAM and SYSTEM Registry hives and the NTDS.dit Active Directory database file.Method 1 - Backing Up SAM & SYSTEM Registry Hives
Same registry save and extract method as in Windows Credentials Attacks, this privilege is simply what makes thereg.exe save commands there succeed without being a local admin.
Method 2 - Arbitrary File / Folder Copy
Bypasses ACLs entirely, using theSeBackupPrivilegeUtils/SeBackupPrivilegeCmdLets modules from the giuliano108/SeBackupPrivilege PoC
Method 3 - Attacking a Domain Controller: Copying NTDS.dit
This group also permits logging in locally to a domain controller. As the NTDS.dit file is locked by default, we can use the Windows diskshadow utility to create a shadow copy of the C drive and expose it as E drive. The NTDS.dit in this shadow copy won’t be in use by the system. Here you can also load the module from the giuliano108/SeBackupPrivilege PoC.
Getting the file is only half of this: to extract the hashes see NTDS.dit extraction page
SeDebugPrivilege
Allows reading and adjusting the memory of other processes, which is exactly what dumping LSASS needs. The actual dump and parse workflow (ProcDump, Mimikatz, pypykatz) is covered on Windows Credentials Attacks, this privilege is the prerequisite that makes it possible without being SYSTEM already. Remote code execution as SYSTEM, by finding a SYSTEM process and injecting into it instead of just reading it: SeDebugPrivilege-Exploit (C++), SeDebugPrivilegePoC (C#), psgetsys.ps1 (Powershell Script)SeDebugPrivilege-Exploit (C++) and SeDebugPrivilegePoC (C#) are the equivalent native-binary versions of psgetsys.ps1)
SeImpersonatePrivilege & SeAssignPrimaryTokenPrivilege
Allows impersonating another account’s token, almost always escalated to SYSTEM with a “Potato”-family tool that tricks a SYSTEM service into authenticating back to a listener the attacker controls. PrintSpoofer, GodPotato, SigmaPotato, JuicyPotato, a list of various Potato AttacksSeLoadDriverPrivilege
Lets the holder load and unload kernel drivers, used to load a known vulnerable signed driver (Capcom.sys is the standard example) for an in-kernel exploit to SYSTEM.
EoPLoadDriver and ExploitCapcom automates the whole sequence (enable privilege, write the registry key, load the driver) in one step:
SeTakeOwnershipPrivilege
This allows a process to take ownership of an object. At its most basic level, we could use this privilege to gain access to a file share or a file on a share that was otherwise not accessible to us.SeSecurityPrivilege
This policy setting determines which users can specify object access audit options for individual resources such as files, Active Directory objects, and registry keys. These objects specify their system access control lists (SACL). A user assigned this user right can also view and clear the Security log in Event Viewer.SeRestorePrivilege
This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories. It determines which users can set valid security principals as the owner of an object.SeTcbPrivilege
This security setting determines whether a process can assume the identity of any user and, through this, obtain access to resources that the targeted user is permitted to access (impersonation). This may be assigned to antivirus or backup tools that need the ability to access all system files for scans or backups. This privilege should be reserved for service accounts requiring this access for legitimate activities.Re-Enabling a Disabled Privilege
A privilege listed, but disabled inwhoami /priv still needs enabling before it does anything. You can use EnableAllTokenPrivs.ps1 or Enable-Privilege.ps1
Quick Reference Tools
HackTricks: Abusing Tokens
Full background on Windows token privileges beyond what’s covered here.