ADPRIV-006: Backup Operators Enumeration
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the membership of the Built-in Backup Operators group (SID S-1-5-32-551) in the target domain. It binds to the group object at CN=Backup Operators,CN=Builtin,DC=domain,DC=tld and walks the member attribute, resolving each linked DN through LDAP. For every member it records the object class (user, computer, group, foreignSecurityPrincipal), the samAccountName, the userAccountControl flags (DISABLED, PASSWORD_NEVER_EXPIRES, DONT_REQUIRE_PREAUTH), the lastLogonTimestamp, the pwdLastSet, and any nested group expansion via tokenGroups. The check also queries the resulting User Rights Assignment on the Default Domain Controllers GPO to confirm that the group still resolves to SeBackupPrivilege, SeRestorePrivilege, and SeShutdownPrivilege on the DC tier, since custom GPOs occasionally add or remove these rights and the actual capability of the group depends on the effective UR assignment on the DC, not just group membership.
Por qué importa
Backup Operators is one of the few built-in groups that grants a privilege which the NTFS access check explicitly honors as a bypass. SeBackupPrivilege lets the holder open any file with FILE_FLAG_BACKUP_SEMANTICS regardless of the DACL, including the live ntds.dit and the SYSTEM registry hive on a domain controller. With those two artifacts an attacker recovers the BOOTKEY, decrypts the directory database offline with secretsdump.py or similar, and obtains the NTLM hash of every account in the forest, including krbtgt. The krbtgt hash then enables Golden Ticket forgery, which provides persistent Tier-0 access independent of password resets. SeRestorePrivilege further allows writing arbitrary files back, which is the basis for the well-known DLL hijack on c:\windows\system32 used by tools like SeBackupPrivilege-Tools and PowerShell SeBackupPrivilegeUtils to escalate to SYSTEM on a DC without ever touching LSASS. Because the abuse path leaves no event in the Security Account Manager and no logon to Domain Admins, this group is a long-favored persistence and stealth-escalation channel for both red teams and threat actors. The group is also a member of the AdminSDHolder-protected set, which means its ACL is re-stamped hourly by SDProp and any clean-up of permissions on the group object itself will revert.
Ruta de ataque
1. Reconnaissance: the attacker enumerates Builtin\Backup Operators using Get-ADGroupMember "Backup Operators", net localgroup, or SharpHound (which surfaces a HasSession or MemberOf edge ending at a Tier-0 DC). 2. Credential acquisition: the attacker phishes, kerberoasts, or otherwise compromises any account that is a direct or nested member of Backup Operators. No Domain Admin compromise is required. 3. Foothold on a DC: the attacker authenticates to a domain controller using the compromised principal. Backup Operators are granted "Allow log on locally" and "Log on as a batch job" on DCs by default, so interactive logon, WinRM, or scheduled task execution all succeed. 4. NTDS extraction, raw branch: the attacker uses diskshadow.exe (built-in) to script a Volume Shadow Copy of C: and copies ntds.dit and the SYSTEM hive out of the shadow path. Example: diskshadow /s script.txt where script.txt contains add volume c: alias dc1 \u2192 create \u2192 expose %dc1% z: \u2192 then robocopy z:\windows\ntds . ntds.dit /b. The /b switch uses backup semantics, which is exactly where SeBackupPrivilege bypasses the ACL. 5. NTDS extraction, library branch: the attacker loads SeBackupPrivilegeUtils / SeBackupPrivilegeCmdLets in PowerShell (Giuliano Bertello) and calls Copy-FileSeBackupPrivilege to read C:\Windows\NTDS\ntds.dit and reg save HKLM\SYSTEM system.hive, again without ever touching the DACL. 6. Offline cracking: secretsdump.py -ntds ntds.dit -system system.hive LOCAL dumps every NTLM hash in the forest, including krbtgt. 7. Persistence: with the krbtgt hash the attacker forges Golden Tickets via mimikatz kerberos::golden or Rubeus, providing forest-wide Tier-0 access that survives password rotations of the compromised Backup Operator account. 8. Alternative escalation: with SeRestorePrivilege the attacker writes a malicious DLL into the DC system32 path that is loaded by a SYSTEM service, achieving local SYSTEM without DCSync and without dropping any classic credential-dumping tool on disk.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Builtin\Backup Operators object by well-known SID (S-1-5-32-551) via Get-ADGroup -Filter { objectSID -eq "S-1-5-32-551" } so the check works in any locale where the group display name is translated. It enumerates the member linked attribute with Get-ADGroupMember -Recursive, expanding nested groups so an indirect member through, for example, a help desk role group is still reported. For each member the check pulls userAccountControl, lastLogonTimestamp, pwdLastSet, servicePrincipalName, and adminCount. Any member object whose class is user (as opposed to a managed service account or a dedicated backup computer object), or any member with a non-empty servicePrincipalName (a kerberoastable account that can therefore yield Backup Operator rights via offline cracking), is flagged. The check then reads the effective User Rights Assignment on the Default Domain Controllers GPO via secedit /export to confirm that SeBackupPrivilege and SeRestorePrivilege still resolve to the group SID, since custom URA GPOs sometimes silently remove the right and would invalidate the finding severity. Results include the member DN, samAccountName, ObjectClass, enabled state, last logon, and whether the principal is also kerberoastable or trusted for delegation.
Valor recomendado
Empty or restricted to dedicated backup service accounts only. No user accounts
Remediación
Enumerate Backup Operators membership using Get-ADGroupMember -Identity 'Backup Operators'. Remove all user accounts. If backup service accounts require membership, ensure they are dedicated, have strong passwords, and are monitored. Consider agent-based backup solutions that do not require Backup Operators membership
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5)
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.6
- MITRE ATT&CK
- T1003.003, T1078.002