BackupOperatorToDA: From Backup Operator To Domain Admin
BackupOperatorToDA – From Backup Operator To Domain Admin
If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller.
All credit from filip_dragovic with his initial POC! I build this project because I wanted to have a more generic binary with parameters and also be able to export the SAM database on the remote share!
Example:
- Using the user RON member of the Backup Operators group on another server than the DC
- I dump and export the SAM database on the remote share
- Then I read the SAM file with secretdump
- An I use the computer account for the DC to dump the NTDS!
What’s the magic?
The code is really simple, there are only 3 steps:
RegConnectRegistryA: Establishes a connection to a predefined registry key on another computer.RegOpenKeyExA: Opens the specified registry keyRegSaveKeyA: Saves the specified key and all of its subkeys and values to a new file
Blackfield from HackTheBox
This box was designed by aas_s3curity to exploit a user from the group “Backup Operators” to become domain admin and get the root flag. I search a little bit on the available writeups but all of them where using WinRM to exploit the “Backup Operators” group.
With this POC you don’t need to have access to WinRM or RPD:
