ADPRIV-005: Server Operators Enumeration
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check resolves the well-known built-in group at S-1-5-32-549 (CN=Server Operators,CN=Builtin,DC=<domain>) and enumerates its members via the member attribute, expanding nested groups recursively. For each principal returned, Guerrilla pulls sAMAccountName, objectClass, objectSid, userAccountControl, lastLogonTimestamp, and pwdLastSet so the operator can triage stale or service accounts immediately. The check also reads the group nTSecurityDescriptor to detect non-default DACL entries (the group itself can be made writable by lower-tier principals via misconfigured delegations, which then permits self-addition). Finally, it cross-references the local Default Domain Controllers GPO for the "Allow log on locally" and "Allow log on through Remote Desktop Services" user rights to confirm that Server Operators still receive interactive logon on every DC (the default), which is the precondition that makes membership immediately exploitable.
Por qué importa
Server Operators is one of the four built-in groups (with Account Operators, Backup Operators, and Print Operators) that Microsoft classifies as "service administrator" because membership in any of them effectively equals Domain Admin. The group grants SeBackupPrivilege and SeRestorePrivilege on domain controllers (which permits raw read of NTDS.dit and the SYSTEM hive, enabling offline DCSync), SeSystemtimePrivilege (which permits Kerberos ticket skew attacks against the entire domain), SeShutdownPrivilege and SeRemoteShutdownPrivilege on DCs, and the right to manage any non-AD-DS service running on a DC. Service-management rights are the cleanest exploitation path: a Server Operator can run sc.exe config <service> binPath= "cmd /c net group \"Domain Admins\" attacker /add /domain", sc.exe start <service>, and the binary executes as SYSTEM on the DC. The group is protected by AdminSDHolder (adminCount=1 on members), which means once an account is added it inherits the SDProp protections, but those protections do not prevent the privilege escalation itself; they only complicate downstream ACL changes. Because the group has been present since Windows NT 4.0, real-world environments routinely contain legacy members added during initial deployment and never removed.
Ruta de ataque
Step 1: Discovery. The attacker, holding any authenticated foothold, enumerates Server Operators membership via Get-ADGroupMember -Identity "Server Operators" or via BloodHound (which marks the group as Tier 0 and surfaces all members and their inbound control paths). Membership of a single compromised account ends the assessment: the path to Domain Admin is direct. Step 2: Interactive logon to a DC. Server Operators retain SeInteractiveLogonRight on domain controllers by default. The attacker initiates an RDP or local console session to any DC using the compromised account. Step 3: Service hijack for SYSTEM execution. The attacker selects a non-critical service running as LocalSystem on the DC, for example AppManagement, VSS, or a third-party agent. They reconfigure the service binary path: sc.exe config AppManagement binPath= "cmd.exe /c net group \"Domain Admins\" attacker /add /domain". They then restart the service: sc.exe stop AppManagement && sc.exe start AppManagement. The Service Control Manager launches the new binary as NT AUTHORITY\SYSTEM, which on a DC is equivalent to Domain Admin context for any local operation including LSASS access. Step 4: Credential extraction. With SYSTEM on a DC the attacker dumps NTDS.dit via ntdsutil "activate instance ntds" "ifm" "create full c:\temp" "quit" "quit", or directly reads krbtgt and other secrets from the SAM and LSA via Mimikatz lsadump::lsa /patch. Alternatively the attacker uses SeBackupPrivilege to copy NTDS.dit and SYSTEM hive offline without service hijack. Step 5: Persistence. With krbtgt the attacker forges Golden Tickets for arbitrary identities, or injects a Skeleton Key, or modifies AdminSDHolder to grant durable rights on every protected group. Forest compromise is complete. Alternative path: where interactive logon to a DC is restricted but the Server Operators member retains SeBackupPrivilege via Backup Operators-style delegation, the attacker uses diskshadow or vshadow to snapshot the system volume and exfiltrate NTDS.dit without ever logging in to the DC console.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain over LDAP and queries the built-in object at CN=Server Operators,CN=Builtin,<defaultNamingContext>, reading the member attribute and the nTSecurityDescriptor. Members are resolved through tokenGroups expansion so nested group additions surface as direct findings. For each member the check pulls userAccountControl to identify disabled accounts (still a finding, since they can be re-enabled), service-account markers (TRUSTED_FOR_DELEGATION, DONT_REQUIRE_PREAUTH), and lastLogonTimestamp to flag stale accounts that are particularly attractive to attackers. Any non-empty membership generates a High-severity finding regardless of count. The check also samples the Default Domain Controllers Policy via Get-GPOReport on the GUID 6AC1786C-016F-11D2-945F-00C04FB984F9 and parses SeInteractiveLogonRight, SeServiceLogonRight, and SeBackupPrivilege assignments to confirm that the Server Operators SID (S-1-5-32-549) still resolves to interactive logon on DCs, which it does in any unmodified environment. Optionally, when run with -DeepInspect, ADPRIV-005 enumerates non-Microsoft services on each DC via Get-CimInstance Win32_Service to identify hijack candidates that a Server Operators member could pivot through.
Valor recomendado
Empty. Use dedicated service management accounts with specific delegation instead
Remediación
Enumerate Server Operators membership using Get-ADGroupMember -Identity 'Server Operators'. Remove all members and implement targeted delegation for any required server management tasks. Audit DC logon rights separately
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5)
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.5
- MITRE ATT&CK
- T1078.002, T1543.003