-
Notifications
You must be signed in to change notification settings - Fork 514
/
EnableSeBackupPrivilege.ps1
103 lines (83 loc) · 3 KB
/
EnableSeBackupPrivilege.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
function Enable-SeBackupPrivilege {
<#
.SYNOPSIS
Enables SeBackupPrivilege for the current (powershell/ise) process.
It allows you to read ACL-protected files using the same console.
You have to have the privilege in your token first - check it with "whoami /priv" if not sure.
.DESCRIPTION
Author: Grzegorz Tworek
Required Dependencies: None
Optional Dependencies: None
.EXAMPLE
C:\PS> Enable-SeBackupPrivilege
#>
# API Calls interface for: OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, GetLastError
# Structure definition for: TokPriv1Luid
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Security.Principal;
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct TokPriv1Luid
{
public int Count;
public long Luid;
public int Attr;
}
public static class Advapi32
{
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool OpenProcessToken(
IntPtr ProcessHandle,
int DesiredAccess,
ref IntPtr TokenHandle);
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool LookupPrivilegeValue(
string lpSystemName,
string lpName,
ref long lpLuid);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool AdjustTokenPrivileges(
IntPtr TokenHandle,
bool DisableAllPrivileges,
ref TokPriv1Luid NewState,
int BufferLength,
IntPtr PreviousState,
IntPtr ReturnLength);
}
public static class Kernel32
{
[DllImport("kernel32.dll")]
public static extern uint GetLastError();
}
"@
# Get current process (powershell) handle
$ProcHandle = (Get-Process -Id ([System.Diagnostics.Process]::GetCurrentProcess().Id)).Handle
Write-Debug "Current process handle: $ProcHandle"
# Open token handle with TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY
Write-Debug "Calling OpenProcessToken()"
$hTokenHandle = [IntPtr]::Zero
$CallResult = [Advapi32]::OpenProcessToken($ProcHandle, 0x28, [ref]$hTokenHandle)
Write-Debug "Token handle: $hTokenHandle"
# Prepare TokPriv1Luid container
$TokPriv1Luid = New-Object TokPriv1Luid
$TokPriv1Luid.Count = 1
$TokPriv1Luid.Attr = 0x00000002 # SE_PRIVILEGE_ENABLED
# Get SeBackupPrivilege luid
$LuidVal = $Null
Write-Debug "Calling LookupPrivilegeValue for SeBackupPrivilege"
$CallResult = [Advapi32]::LookupPrivilegeValue($null, "SeBackupPrivilege", [ref]$LuidVal)
Write-Debug "SeBackupPrivilege LUID value: $LuidVal"
$TokPriv1Luid.Luid = $LuidVal
# Enable SeBackupPrivilege for the current process
Write-Debug "Calling AdjustTokenPrivileges"
$CallResult = [Advapi32]::AdjustTokenPrivileges($hTokenHandle, $False, [ref]$TokPriv1Luid, 0, [IntPtr]::Zero, [IntPtr]::Zero)
$LastError = [Kernel32]::GetLastError()
Write-Debug "GetLastError returned: $LastError"
#0 - OK.
#6 - one of previous steps failed. Observe the output for handles equal to 0 or just re-run entire script.
#1300 - privilege not held
}
$DebugPreference = "Continue"
Enable-SeBackupPrivilege